MD5: 006e029743d92f283a5585af8b299d0e
SHA1: 30e82967ab2b2f6e6b7a1ed67b0009857d7b5135
SHA256: 58cd97cbc6cd1f76ccc7fb5670ae53412bbb1381d0a744e7ee3fa4390c8bfa1c
SSDeep: 12288:xPvp93LWtzzSOtnBHlql7H1cL3aq2thdQ6tF0hqRlrlgQCcQ9FHKlLrS 6drb4gn:xPvT3qzzVnBHlq5iL3aq L0hStlg/cQb
Size: 735112 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, UPolyXv05_v6
Company:
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Installer. An installation package.

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):

%original file name%.exe:1596
%original file name%.exe:3720
006e029743d92f283a5585af8b299d0e.tmp:3916
006e029743d92f283a5585af8b299d0e.tmp:3908

The Installer injects its code into the following process(es):

%original file name%.exe:300

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:300 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\bootstrap_11120.html (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\4CFD6549_stp.CIS (2900 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Pause_Button.png (577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\main.css (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00182FE5.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Grey_Button_Hover.png (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\0402FCE9_stp\icc.dll (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isf_1573506.flat (6314 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\Pebotocotot2[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\ie6_main.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0017FAEA.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\IE_logo[1].png (1842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Quick_Specs.png (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\No_Button[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\42D5B627_stp.EXE.part (4645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\4CFD6549_stp\RAM.dll (151 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Minimize_Hover.png (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\FR.locale (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0018436D.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\LOGO[1].png (1840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Gegogego[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\4CFD6549_stp.CIS.part (531 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Yudekekug_Dark[1].jpg (5485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Tonononot_BG[1].jpg (7131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\progress-bar.css (506 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\FF_logo[1].png (1842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\42D5B627_stp.EXE (460510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\button.css (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Lilisipipe[1].png (1842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Taderonadan[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001849D5.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\csshover3.htc (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\0402FCE9_stp.CIS (13980 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\Ropopi_Title[1].png (845 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Bisli_logo[1].png (3234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\checkbox.css (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Close.png (674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\form.bmp.Mask (148 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Noseresel[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\Seniser[1].png (12964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Close_Hover.png (653 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\CH_logo[1].png (1842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0018433E.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\BG[1].png (7318 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Logo_Bisli[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Gegogego_Bisli[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\EN.locale (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Memiticeper_BG_BR[1].png (5375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Sesakesaye_bisli[1].png (6401 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Notonoronot1[1].png (6896 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\sponsored.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Yes_Button[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0018505D.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\BG.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Progress.png (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Notoseso[1].png (3474 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Grey_Button.png (230 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Yes_Button_Hover[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\No_Button_Hover[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\ProgressBar.png (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Resume_Button.png (718 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00180172.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\ES.locale (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Icon_Generic.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\browse.css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\DE.locale (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isf_1573432.flat (151 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Notonoronot2[1].png (10614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\default_tb.png (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Minimize.png (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\images\progress-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\Tonononot_B1[1].png (1842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Yudekekug1[1].jpg (3259 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\PT.locale (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\declineBG[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Loader.gif (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Color_Button.png (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Memiticeper_BG[1].png (10106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\images\button-bg.png (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\0402FCE9_stp\sqlite3.dll (3716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is140275273\0402FCE9_stp.CIS.part (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0018435D.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Color_Button_Hover.png (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001843EA.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\images\progress-bg2.png (978 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\bootstrap_11120.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0018436D.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00182FE5.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isf_1573432.flat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isf_1573506.flat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0018433E.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001849D5.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00180172.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0018435D.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001843EA.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0017FAEA.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0018505D.log (0 bytes)

The process %original file name%.exe:1596 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-US1LG.tmp\006e029743d92f283a5585af8b299d0e.tmp (62 bytes)

The process %original file name%.exe:3720 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-RB9DC.tmp\006e029743d92f283a5585af8b299d0e.tmp (62 bytes)

The process 006e029743d92f283a5585af8b299d0e.tmp:3916 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-J5IBD.tmp\006e029743d92f283a5585af8b299d0e.tmp (23 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-J5IBD.tmp\006e029743d92f283a5585af8b299d0e.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-J5IBD.tmp (0 bytes)

The process 006e029743d92f283a5585af8b299d0e.tmp:3908 makes changes in the file system.
The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-0PIU4.tmp\006e029743d92f283a5585af8b299d0e.tmp (23 bytes)

The Installer deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-0PIU4.tmp\006e029743d92f283a5585af8b299d0e.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-0PIU4.tmp (0 bytes)

Registry activity

The process %original file name%.exe:300 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 6A A9 04 39 A2 7D 03 BD 04 84 2F 4F B7 27 29"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"
"Name" = "%original file name%.exe"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1596 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 65 76 38 5A AB 21 76 51 DB 01 03 67 B1 03 0E"

The process %original file name%.exe:3720 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 25 00 EB 5C A6 85 44 A3 78 48 9C E7 52 3A D7"

The process 006e029743d92f283a5585af8b299d0e.tmp:3916 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 0E 9B 97 D0 22 0A CA C9 D6 6F 46 8B 8F 50 27"

The process 006e029743d92f283a5585af8b299d0e.tmp:3908 makes changes in the system registry.
The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 99 61 31 2A 1D 96 E3 FC DC 00 FD 39 F5 6A 22"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 1.5
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments: This installation was built with Inno Setup.
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://info.fileorgcdn.com/?v=1.02&c=fbfaf111&at=140275273&cntr=0	54.200.161.179
hxxp://54.225.246.127/?pcrc=1361839804&v=2.0
hxxp://os-slv-1323817372.us-west-2.elb.amazonaws.com/File.org/?v=5.0&c=1418100568
hxxp://file.org/dl/redir/inst/c1e69fb1d4f7005d5f1f49ee8ff532cf-RealPlayerCloud.exe	66.39.64.146
hxxp://us03.procloudstorage.com/inst/c1e69fb1d4f7005d5f1f49ee8ff532cf-RealPlayerCloud.exe	162.210.197.77
hxxp://146.185.27.53/img/Global/declineBG.png
hxxp://146.185.27.53/img/Global/Yes_Button.png
hxxp://85.159.237.103/ofr/RAM.cis
hxxp://85.159.237.103/ofr/isicicc.cis
hxxp://cdnus.fileorgcdn.com/ofr/RAM.cis	50.115.122.45
hxxp://cdnus.fileorgcdn.com/ofr/isicicc.cis	50.115.122.45
hxxp://146.185.27.53/img/Global/Yes_Button_Hover.png
hxxp://146.185.27.53/img/Global/No_Button.png
hxxp://146.185.27.53/img/Global/No_Button_Hover.png
hxxp://146.185.27.53/img/Taderonadan/Taderonadan.png
hxxp://146.185.27.53/img/Lilisipipe/Lilisipipe.png
hxxp://146.185.27.53/img/Noseresel/Noseresel.png
hxxp://146.185.27.53/img/IE_logo.png
hxxp://146.185.27.53/img/CH_logo.png
hxxp://146.185.27.53/img/FF_logo.png
hxxp://146.185.27.53/img/Notoseso/Notoseso.png
hxxp://146.185.27.53/img/Ropopi/Ropopi_Title.png
hxxp://146.185.27.53/img/Meteterot/BG.png
hxxp://146.185.27.53/img/Meteterot/Logo_Bisli.png
hxxp://146.185.27.53/img/Sesakesaye/Sesakesaye_bisli.png
hxxp://146.185.27.53/img/Yudekekug/Yudekekug1.jpg
hxxp://146.185.27.53/img/Yudekekug/Yudekekug_Dark.jpg
hxxp://146.185.27.53/img/Yudekekug/Bisli_logo.png
hxxp://146.185.27.53/img/Tonononot/Tonononot_BG.jpg
hxxp://146.185.27.53/img/Tonononot/Tonononot_B1.png
hxxp://146.185.27.53/img/Pebotocotot/Pebotocotot2.PNG
hxxp://146.185.27.53/img/Notonoronot/Notonoronot1.png
hxxp://146.185.27.53/img/Notonoronot/Notonoronot2.png
hxxp://146.185.27.53/img/Mapayuy/LOGO.png
hxxp://146.185.27.53/img/Memiticeper/Memiticeper_BG.png
hxxp://146.185.27.53/img/Memiticeper/Memiticeper_BG_BR.png
hxxp://146.185.27.53/img/Gegogego/Gegogego.png
hxxp://146.185.27.53/img/Gegogego/Gegogego_Bisli.png
hxxp://146.185.27.53/img/Seniser/Seniser.png
hxxp://img.fileorgcdn.com/img/Yudekekug/Yudekekug_Dark.jpg
hxxp://img.fileorgcdn.com/img/Lilisipipe/Lilisipipe.png
hxxp://img.fileorgcdn.com/img/Seniser/Seniser.png
hxxp://img.fileorgcdn.com/img/Global/No_Button.png
hxxp://img.fileorgcdn.com/img/Global/No_Button_Hover.png
hxxp://img.fileorgcdn.com/img/Global/declineBG.png
hxxp://img.fileorgcdn.com/img/Notoseso/Notoseso.png
hxxp://img.fileorgcdn.com/img/IE_logo.png
hxxp://img.fileorgcdn.com/img/Mapayuy/LOGO.png
hxxp://img.fileorgcdn.com/img/Global/Yes_Button_Hover.png
hxxp://img.fileorgcdn.com/img/Gegogego/Gegogego.png
hxxp://img.fileorgcdn.com/img/Taderonadan/Taderonadan.png
hxxp://img.fileorgcdn.com/img/Yudekekug/Yudekekug1.jpg
hxxp://cdneu.fileorgcdn.com/ofr/isicicc.cis
hxxp://img.fileorgcdn.com/img/Notonoronot/Notonoronot1.png
hxxp://img.fileorgcdn.com/img/Noseresel/Noseresel.png
hxxp://img.fileorgcdn.com/img/Tonononot/Tonononot_B1.png
hxxp://img.fileorgcdn.com/img/Meteterot/Logo_Bisli.png
hxxp://img.fileorgcdn.com/img/Ropopi/Ropopi_Title.png
hxxp://img.fileorgcdn.com/img/Memiticeper/Memiticeper_BG.png
hxxp://img.fileorgcdn.com/img/Sesakesaye/Sesakesaye_bisli.png
hxxp://os.fileorgcdn.com/File.org/?v=5.0&c=1418100568	54.245.224.246
hxxp://cdneu.fileorgcdn.com/ofr/RAM.cis
hxxp://img.fileorgcdn.com/img/Memiticeper/Memiticeper_BG_BR.png
hxxp://rp.fileorgcdn.com/?pcrc=1361839804&v=2.0
hxxp://img.fileorgcdn.com/img/Meteterot/BG.png
hxxp://img.fileorgcdn.com/img/Global/Yes_Button.png
hxxp://img.fileorgcdn.com/img/FF_logo.png
hxxp://img.fileorgcdn.com/img/Yudekekug/Bisli_logo.png
hxxp://img.fileorgcdn.com/img/CH_logo.png
hxxp://img.fileorgcdn.com/img/Tonononot/Tonononot_BG.jpg
hxxp://img.fileorgcdn.com/img/Pebotocotot/Pebotocotot2.PNG
hxxp://img.fileorgcdn.com/img/Gegogego/Gegogego_Bisli.png
hxxp://img.fileorgcdn.com/img/Notonoronot/Notonoronot2.png

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible Call with No Offset TCP Shellcode
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
SURICATA STREAM SHUTDOWN RST invalid ack

Traffic

POST /?v=1.02&c=fbfaf111&at=140275273&cntr=0 HTTP/1.1

Accept: */*

Host: info.fileorgcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 172

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7JjX L3BktYU3MDW0 phUFMYcxNBcNiAQ006X3bo9m6eyl 5AtLOaMc5gSBo fl6wYFoi8qz6qjFViX4n3/GMfBU3mJ3Aza2 tHhZK5B8orvZ6Th1zrxvAGNstLUhU7L/SEdlECxT Xr7exln6vb/ANk=
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 07 Nov 2014 20:13:54 GMT

Content-Length: 856

Connection: keep-alive
M0L5nPOHTHpseySl88LgPRzj6OmW0ucif2Bd5erp8gQoEkU nuz85StFM1SJWoEIJdODdG
NAYxYPb6Hrs3fIavujHD hH00HicRCgXt3PvOnB8lBxHWe7la5waK6RrR9ZbKryxdv6UHo
pwe5Q6Hv zFT2M5Lp1qFtRNaUMyU40ZjuVTGJe8jPm3SBnt7BxMqVSRkEDYW4HYQszryER
xKbrbghHOWmCRC03IAP oEEYmpXzHUC2zJTU3iVlWosGMZ55PFzIyfGhZg8gwXAewth6yn
TYOTcU9o/ctJTckNCft65aWhgvStKxxBn7tcte2O3E612GF7OTNMI7zmcMWGxMdPGVBWVY
wuguA5vdjopI1v4lH19PLa5ns4qLM25A/VF/6DAvZpC2m2UE6CAHbRHgCGf3wmM72Xv9br
Fg7XeQVpnU8L9ANwhR7 yiH34ebZIgVDoA2ds HiKX9aO8YUnOaUZxbyBquR8LDfXxTpTx
umaBoVuP114TZ99Ktpd8xULmM8V0JsCXH0JCd2HCa8zcREGpZr396Uq8MDY3oPkpZckJDY
hmoThwkkp1jQv/epYFUeslWbzhJ2LAXwTGozsPNT0ZV61i5tDB8aLBu5vNBtKh6r7JsAzw
Ko9/ 0wTN HBfY4KPHCFKzW4YuUFqZPxKh2nx4/1xXwtLwusH5U/GSm3waEco/zLk5w8WD
07FhP7R1Rv0JLZgInKw3YfxFKuZRmN9hAllG02Kqne3/WEztNgCzxL0z5RZOIoG374ZDll
KcngOwWx/zT UTXWWXXs0R4 jSxuBLXXThLPqOwMFReMgASCgLiBuKAMy5hhRXOJmYczEV
SHeM8R6DbBDFQA==HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date:
 Fri, 07 Nov 2014 20:13:54 GMT..Content-Length: 856..Connection: keep-
alive..M0L5nPOHTHpseySl88LgPRzj6OmW0ucif2Bd5erp8gQoEkU nuz85StFM1SJWoE
IJdODdGNAYxYPb6Hrs3fIavujHD hH00HicRCgXt3PvOnB8lBxHWe7la5waK6RrR9ZbKry
xdv6UHopwe5Q6Hv zFT2M5Lp1qFtRNaUMyU40ZjuVTGJe8jPm3SBnt7BxMqVSRkEDYW4HY
QszryERxKbrbghHOWmCRC03IAP oEEYmpXzHUC2zJTU3iVlWosGMZ55PFzIyfGhZg8gwXA
ewth6ynTYOTcU9o/ctJTckNCft65aWhgvStKxxBn7tcte2O3E612GF7OTNMI7zmcMWGxMd
PGVBWVYwuguA5vdjopI1v4lH19PLa5ns4qLM25A/VF/6DAvZpC2m2UE6CAHbRHgCGf3wmM
72Xv9brFg7XeQVpnU8L9ANwhR7 yiH34ebZIgVDoA2ds HiKX9aO8YUnOaUZxbyBquR8LD
fXxTpTxumaBoVuP114TZ99Ktpd8xULmM8V0JsCXH0JCd2HCa8zcREGpZr396Uq8MDY
<<< skipped >>>

GET /ofr/isicicc.cis HTTP/1.1

Range: bytes=204800-382061

Accept: */*

Host: cdneu.fileorgcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.4.7

Date: Fri, 07 Nov 2014 20:14:02 GMT

Content-Type: application/octet-stream

Content-Length: 177262

Connection: keep-alive

x-amz-id-2: 3IkXIx2yo UhtiDqk0jJpuYskvZ1qnkNfrDR7f8V5t5WkMmvcbURK4lJvRsH12I/xPv2CwvksGs=

x-amz-request-id: 2126F5FD83BA6A2C

x-amz-meta-cb-modifiedtime: Thu, 28 Aug 2014 08:06:42 GMT

Last-Modified: Thu, 28 Aug 2014 08:07:54 GMT

x-amz-version-id: Cps7ujoLu7tbSmpel034FEsiI5AkDorU

ETag: "4b79f0fd86d9c68b64393776fdc910ef"

Content-Range: bytes 204800-382061/382062
.?:...R.B...\.x..l...L.......>[email protected]....<..!....Q.Q
|....U..........sh..%.........n9.:..r...>......BZ....>..Vm..3...
I.EEN...4...*f..'....x..(....{..<.\....S..5....p9J....}...=...."..&
gt;.. ..hg..\[email protected]!......kv..$(.owmuTrB.L......G.......
.......G....x....E]^....S.0.[.....K.....8....-.L...........\s.@.... ..
.!....3..{.yZ...m.;....... Y.3.......9.W>B .....2.3......Fu..;8.w..
....\...s?G..E......=..S...#...F....."`a.ec.^.aC$.^j.D..`.c.\ ...J7.|.
..*..&.o..`{..&..B.G.....h@~'`..h..\.......A..8k...>GV.....E.)...Rn
...1.. 8..kCF(.........3EK..b......cK.y..PqS.M....)...{.m.. l.e...u..*
.hs.....S'..y..J..b]B...%.r.}.L!.p.w......V....E.g..(:.<B...S..M...
..(.`....k.j...R.....[ s..5.b.......|..o..S..PDN.[.l...{bv...ktB.Fs..o
..].{.......5o:........{.0.C..."3M...Q:@..".:.Q@...?m6..,.....f.......
..'...Dx.dI.k.k...zq.hK.}.\....v~.W.\.].8h.e.:....j...K..{M...'!.....K
...z.:0....~..\P@[..v... .Z...\.G...hoa$$5.....4.H&.#.......Y..6..v.v.
.T..>s3...t...9C.}..X_J..T.........../1B.Uk)...1Z..4.......c...).].
...E..4..5c:.n.J..nl.....o..-..zp.n.V.D.a.wD.<.....#......L..|NID..
.......N.c.c.......z?P*......B...C8.AK..h..~z..... H.S1.=N.ka.F.;.O&..
<.Wv....N..\........F}../.G.b{)R..e.z._.:VqUH..oi..a.fC-c..&.w.."Y.
<.7B.P.....X..t....X..s.y,......Q)..o.v...hi.R.$...................
.}..z...-F.V....m.k.spF..2!Pf.{.t8..U;Q.(.....lD.....J^k..x.?.G.q.{..o
FuT.MJG..,7.)A\5....=.u}b:sV..nv...j..2.|L.......q .s.5A...8!.........
...U.=.{G!...$..i.7.O{Fw...G=,k.]........7...n...( d..n.D..{Cu..{q
<<< skipped >>>

GET /ofr/isicicc.cis HTTP/1.1

Range: bytes=0-382061

Accept: */*

Host: cdnus.fileorgcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

CIS................S.......n.......P........>p..OaF~&.U"&..........
kM.....l..C..^.a].....U...U...#a ...h......d....D]b.....q....*.......J
x.,.r.`*....e.uZ.....N....,.0I..C.Pu..:..i.....hkNa ..;0..[d.}.....Zu.
.L;0.*P7V....Qv.#@\x.)ek.<.o;....W..............Au\.E.N......._{.cs
.p3....w)[email protected]../d.n...rP.O..`.l..&..k..Mzp....;#X...^jt..
.\.q=\N.[.'I..sP.-[8..1R\..S...9(..Z....(R..-.*......t.....]..C_T.4Mj.
....N.,h....:} Y.}.K9.)2........f.&..A.aqnv.}.=.#OOTRVO2...1X..7.htmO.
..$..0.=.1.Y.`.A.M....V...:T..5$....C`.....!.u.. .EK7=.....8..k.....@.
`.P..S.W.....G....Wz....j..;.<..w.0.$fF..&[.}.9........[#...%k.L...
Q..$. '[email protected]).B...E5..Q..M<
...-...o..D...V..H.. ............0.?_/Py.\....,..#.V..p.......<k...
.H...Zv..( i{M...._.... '.].k...D...k%..7.........~.T..."..A..A.u5.b".
.......vv.2..%......-C9^}EQ..]..$.Z..bj..R..SX.._&@Oq0'.....y&.s.X=o!.
.\ ..#.....i.f...=D.2.E..fZ.4e.=B..k.{..G.;V../...s......C.C....v.9...
..E|.... -M...T.#.Fu.....XmY.5!..w.V6.@*..TX&..6..tF.[.a.5...r.7...W..
......0...7....h....(....KJZ68.m.p......U.i..]..q...y.gymw.=...h...8aq
.#.^<..Y..,q#d..."B.-..kL...F.........Ko/@g...Rg.U...o.@.$..!.j.z.d
;..1.....].e12....;#...R..x..#.m...M.yq_8.".....".....7V...\........v.
....6.....0N..(.{'....<...w...9k.R{hVp.."..m.x...k.....;.#..h.5..6.
.j.;.!...=?-{a/9/..g.. .>..N:...s.7....~.m.....w.Q...J.1v..P......U
....5.."...g.!PF5...-..!4!...`..:....J.^......%_..f..%...)E.."8t.3....
oW....,. >`;Z......l..aX..v.6.Jw.I8Q0..LW<...4......!.k,].=}
<<< skipped >>>

GET /img/Global/declineBG.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:00 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: f02p0x7rQcV0vhuw4eOvNIWYLnSxyCgcPRKKAe2KyyGOgdqwR5XXX5doCkUk353x

x-amz-request-id: 5CC129176CDD15AE

x-amz-meta-s3fox-filesize: 1527

x-amz-meta-s3fox-modifiedtime: 1385033566667

Last-Modified: Thu, 21 Nov 2013 11:43:23 GMT

x-amz-version-id: TJNGNP9J.pYgtH1WelxAjMHRSvYRyHyQ

ETag: "c3671f6a6b3932da75a4c6b57cd45614"

Content-Length: 1527

Accept-Ranges: bytes
....


GET /img/Sesakesaye/Sesakesaye_bisli.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:03 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: kMtvsxMYYdc1/CHfIuxVyMCrgP0i mjCYfp3q53kPqOq8zCR UP U8FfGODFzu3P

x-amz-request-id: F3157E93351F77CB

x-amz-meta-cb-modifiedtime: Fri, 07 Feb 2014 16:36:40 GMT

Last-Modified: Fri, 07 Feb 2014 16:40:30 GMT

x-amz-version-id: yfosfRpOf.8mDjaIHnFVAoJJNdB_rGPY

ETag: "e3a7e42373e168852fc2a4d9a17d2583"

Content-Length: 19316

Accept-Ranges: bytes
.PNG........IHDR.......).............pHYs.......... .....OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /img/Yudekekug/Bisli_logo.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:04 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2:  /NC4LQ4mB06qW5OXO0yJQEhy7AVPm7ojXZHHBwPjSU6/aprJtsvJRcN0XAI1fkTUC Kbf5NpjM=

x-amz-request-id: 60B42A46B3CC80E6

x-amz-meta-cb-modifiedtime: Tue, 12 Aug 2014 08:30:30 GMT

Last-Modified: Tue, 12 Aug 2014 08:31:09 GMT

x-amz-version-id: fBZABG6YpbRlr_n73rd7Zyad.2nHaRBB

ETag: "c4627898594fb97ec0604a5390536e53"

Content-Length: 12065

Accept-Ranges: bytes
.PNG........IHDR.......-.....U.|.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:0EB1A4997F8EE311B6ABD46460EE8FA0" xmpMM:DocumentID="xmp.did:BDE3
E9A5207D11E492A1C85C4B573F54" xmpMM:InstanceID="xmp.iid:BDE3E9A4207D11
E492A1C85C4B573F54" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3C65D4606020E4119764
FF11BD7AA0C3" stRef:documentID="xmp.did:0EB1A4997F8EE311B6ABD46460EE8F
A0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>k.#... QIDATx..]..........3.A....J(.$$.HD....
H.98c.F.h....|.l.m.p..&...`....1..&H.`$...Z.]...........j.m...0.......
...U.....W.j............0 ....\.B...."_4.........k....o.....f..Q.i.Fk}
F........HY.(y.PlS..U.!^.;..s..E...,B...n........f..q...d2.}.0.m.C....
..,.K..9.....r....4.$. ....rr..w.o...`.<G.Q....2QQQ.=.G...uc=S..W..
.............e=.m^'.I........m..UUUyg..{...^..{.N,..$..^........4j....
..i.o..'..h...3..:.v....w...s.N.....V....-....:.e(...u..7.......',[]..
.........pu..Gc"V..f$\.`.o..Fg|..O....;7..i..Mn.0=..>..!....-Q.
<<< skipped >>>

GET /img/Tonononot/Tonononot_B1.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:04 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: / E4vpCR4im4j6oPfwtHI0qDDHSwkcM4KSN6h4gyfKgWAdrNPP2KuBd3KUH2gyctRdFQehEGViM=

x-amz-request-id: 413B55AA6E7FFA08

x-amz-meta-cb-modifiedtime: Wed, 03 Sep 2014 13:52:15 GMT

Last-Modified: Wed, 03 Sep 2014 13:53:07 GMT

x-amz-version-id: 7raex06p_wQ9VJMNNmdAHOofyrl6svrf

ETag: "071c042ab6428d4f1bfaf6897a7de3db"

Content-Length: 7400

Accept-Ranges: bytes
.PNG........IHDR.......-.....q.f^....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:716F8CED337111E4B586D050
639A965C" xmpMM:DocumentID="xmp.did:716F8CEE337111E4B586D050639A965C"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:716F8CEB337111E4B5
86D050639A965C" stRef:documentID="xmp.did:716F8CEC337111E4B586D050639A
965C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>X.hu...\IDATx..].t..u..]=.z.,...e....].X../
.&....ST;...R. J...TNZ.4).m...>$H%ix. .:....$..<,.`...b.?%Y..J..
{gu.;..........{.=......3......M...$I.$I.4..#.@.$I.$M6YR..d2e}#/..r;..
....=.v...C@...'....&..u.W2O2.".'J...k$%..|.n...;wz..R.j:VP..t._.,....
..j..{......]g...7.1...$..$I...a.........'rV*5.x....dm.F..yjI....S.<
;g..b.1.)AQ^..T8..R.H.45...O.......".d.u..O...H\.._.....8...G.$I......
...SO..!X.,\...'..?...G....p.......l..z..ec....`yn.....$){.G.....v....
8..8....}\.{Q6.4.7..y;...##F..^......h...{u.....#.m.$M1M8.. ....:^...I
..z.....y=v...........0OgM..?.$IJ7.....]vgZ. ..^...<6.Bv...d..#
<<< skipped >>>

GET /img/Notonoronot/Notonoronot2.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:05 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: kP3COwZpu /ODnxUjQIa54UQShijETHEjP40DtRS2dsV7X2gD7lbPCVe7 9PluqXcGfb4vw7bU4=

x-amz-request-id: 9BE3F656AD858A91

x-amz-meta-s3fox-filesize: 36568

x-amz-meta-s3fox-modifiedtime: 1394353636607

Last-Modified: Sun, 09 Mar 2014 09:36:25 GMT

x-amz-version-id: dIdXAASH6zDrkxiyt76zKZayvldvyS91

ETag: "cca9aa3741d7cf3b22beedeb5e0bebfe"

Content-Length: 36568

Accept-Ranges: bytes
.PNG........IHDR...0...........}.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:84B4A51725A5E311B86A888C91C8A1BA" xmpMM:DocumentID="xmp.did:E6D2
DB63A53D11E3A016979B2BEC45F4" xmpMM:InstanceID="xmp.iid:E6D2DB62A53D11
E3A016979B2BEC45F4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:402ED7B437A5E311B86A
888C91C8A1BA" stRef:documentID="xmp.did:84B4A51725A5E311B86A888C91C8A1
BA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.!.N....IDATx......W}..g....vW..dI....p..`...
!...#.BBH.H...$..$/...0..L..c...U.eY......N;........J..,.....h..zfv...
O.RJ0..0..<.0..0..0....0..0....0..0....0..0....0..0....0..0....0..0
,0..0..0,0..0..0,0..0....0..0..,&.y/hY....E...A.W.....X".....g....]..2
.=x...V...O....p...........D...~......tz._.*.J..C.=..|.>..UC0k..66.
...O.F.2.....u.......~z.A............^yI..h....E.zB.[...^.....w...t...
m ..,?........='.v D.wP..p....Vo..7.{...g..H....Y. ....;kz.....K.a..aN
..H.{.......up....8.C.,[...;....D.001$.E.HN..8.M.r.84,......._..u.
<<< skipped >>>

GET /img/Memiticeper/Memiticeper_BG_BR.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:05 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: 1EvqsI3Eu3apzWvtBvZ4Jmnh C4Ldx5gug1SYvher25K M6Jd21NvMt MUMR/oni

x-amz-request-id: E3B20FE3ABD3741D

x-amz-meta-s3fox-filesize: 27832

x-amz-meta-s3fox-modifiedtime: 1400575288008

Last-Modified: Tue, 20 May 2014 08:42:30 GMT

x-amz-version-id: hMLSB0vgTOklyG4KCIA_O16asryLpIqE

ETag: "5b150fe1f86e276f160e26276100a09a"

Content-Length: 27832

Accept-Ranges: bytes
.PNG........IHDR...0.........0.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:47D7CD6B132168118DBBA8AD0A7AA509" xmpMM:DocumentID="xmp.did:09F8
7922DFF811E3A66CD6F6724AE1DD" xmpMM:InstanceID="xmp.iid:09F87921DFF811
E3A66CD6F6724AE1DD" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:048011740720681183
D1DF84D53E4E64" stRef:documentID="xmp.did:47D7CD6B132168118DBBA8AD0A7A
A509"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>j$>M..h.IDATx....|.......p8..{..(R......
..Il'.....}......f..d...N6..q\b.....%Q.(..{.3.....w..)..*.4..........p
...{..NQ.........T...........'...?...X.X$..qQ......j.....!d..$..#..j..
.c..(.*MRn.-.{Cmqa...K...w.z]q..s.......@....~...wO....msM....v.......
L.|j...[...W.........9........h.X..kU..YU...~J....l.G. ...k.K.2?n?J...
........[VS.ne...........w`........E..%}R..S...)...e....LmU~v.........
.={..0......,.u.......-...z.tMU....J.'_.)5.....N..s.c?.....i...et..j..
@4.....!T..V-.{..#.......#.....g...'=..../w{~....-.N..X,..]q...CH.
<<< skipped >>>

GET /img/Seniser/Seniser.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:06 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: Hi/7m7uUs1DBoEWSVzH3HAFz8WJU1CYTQWMnx8S uSaDYY0c7T0sAkH86f0/RIgg

x-amz-request-id: 03429F82D6310FAC

x-amz-meta-s3fox-filesize: 50085

x-amz-meta-s3fox-modifiedtime: 1390986529596

Last-Modified: Wed, 29 Jan 2014 09:13:59 GMT

x-amz-version-id: QjqTwx_WtPuZIJz7CFxx6CtYgyzT8pRK

ETag: "f1b0c2e8dbea7007de3b729877ed968e"

Content-Length: 50085

Accept-Ranges: bytes
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:EB591AE63587E311AC799D5F5C8BA5FF" xmpMM:DocumentID="xmp.did:B7A6
F41288C411E39181D0C065CD57B3" xmpMM:InstanceID="xmp.iid:B7A6F41188C411
E39181D0C065CD57B3" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EB591AE63587E311AC79
9D5F5C8BA5FF" stRef:documentID="xmp.did:EB591AE63587E311AC799D5F5C8BA5
FF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>..FD....IDATx...u.\.....]..U.... n1..df..c.I&
....g&.dB...O...8.c'f.!..B.[R........S.w..w2s'sgr........:u..o...:G...
......2...P....g..L...C..#...j....F..Kk..- K...........d.A.G,.....R.,.
o.....g...63.F.P.G...T....$~Y..d.....G.....P...."fU...LX......w#k...e\
.....{.....M-.L...a...{N.[w..M_."....P.....1...a(.9.O..U.!C.O~.x:...3.
68......9........^(.(._.......N..*M.T./.lR..5h.r.C..Ft>...2.@:-.../
R........{.j5.....(.!.(. .E~..`...x-.}..l.........@..(O....T..b.y%....
U(....,...".F@....../..*.4<.,&e.L(-x.......x}S.2....*.....\.(.*
<<< skipped >>>

HEAD /ofr/isicicc.cis HTTP/1.1

Accept: */*

Host: cdneu.fileorgcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 07 Nov 2014 20:14:00 GMT

Content-Type: application/octet-stream

Content-Length: 382062

Connection: keep-alive

x-amz-id-2: 3IkXIx2yo UhtiDqk0jJpuYskvZ1qnkNfrDR7f8V5t5WkMmvcbURK4lJvRsH12I/xPv2CwvksGs=

x-amz-request-id: 2126F5FD83BA6A2C

x-amz-meta-cb-modifiedtime: Thu, 28 Aug 2014 08:06:42 GMT

Last-Modified: Thu, 28 Aug 2014 08:07:54 GMT

x-amz-version-id: Cps7ujoLu7tbSmpel034FEsiI5AkDorU

ETag: "4b79f0fd86d9c68b64393776fdc910ef"

Accept-Ranges: bytes

GET /ofr/RAM.cis HTTP/1.1

Range: bytes=0-68753

Accept: */*

Host: cdnus.fileorgcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: nginx/1.4.7

Date: Fri, 07 Nov 2014 20:14:01 GMT

Content-Type: application/octet-stream

Content-Length: 68754

Connection: keep-alive

x-amz-id-2: i/7S0 3qqusoaFxqGYvkvKQNsWQ9hR9XtH93SytmPqM5ribIw81b27KlmOlpGC 1

x-amz-request-id: 419CAF64A927F11D

x-amz-meta-cb-modifiedtime: Tue, 25 Feb 2014 09:01:03 GMT

Last-Modified: Tue, 25 Feb 2014 09:33:04 GMT

x-amz-version-id: 0J7Ku3fOApQ0maOx9q3GISpaX.5t75it

ETag: "85a9022d4d17cf300c437ae38df1e2b6"

Content-Range: bytes 0-68753/68754
CIS................;...............P.......E.v P.. .v.f*...]....HO..HO
...#a .O..>.ucs..#1.y.e0..M8h..'.../.H...[&....-l......0dnz.H.u...f
.8e..@|..R...~....6..Ey.&..K... U.[.F.s{.b..w..@...[b.........Wo.,....
....].[hc>.`.>$((V..=[.y.)..R....@....*.P.B....].a....J.....g...
G.`Y..`.......\...a.....A...=.'[email protected]=H.N.K.Pp.. .)...].Z.iJ......
h1qV......../.|...x......O.N...{.........*....6....IC... -...1R.#OW..O
] .h.L05%3...VP.M.eX.......U.n.u...V...3c- .........].y'...d)9.7..N.D 
/.B.6)]..I....C..ci..E"..KV..._.x....i2....E..\`.......*$...t.\ .:.h..
...}G..a..5...?.sP.U&W>.S..t\[.,..E=.$.i[bO2..5.9....b.N.sm.....yk.
{..*g|..^..:3.......7.o..:Ks...oP..*....e..e.{C.t.. .'..|O..J..`..../.
1.....s..rq..).....1&}.{[email protected].....=.\.......S6...............
...EC.......$3.......y...7.U."..75.m..e...KU.....Q...Q.L..LY.oH..i..h.
.s.*....N..[J. [email protected]:..P.N...........cC...K...[.!.j.../y.AAQ
.....W.t.....}>Q.`.Y..O...xX.N.s.q.T)..m..4..]....B.!,S..W.f.r*h.e%
h.W<.....3...V..k.q...i..z....=J3.......^.fq*.[.._>...s...}1s.h.
.E-...N.3s.~.. .,.^..'!.E.w..'}.JTPH..A..L.,P....W.....mW..D........zH
.=.."...SoC..-...... Y-.>4#.....F.......% .Q-..p.c.X.:......p.:bi;.
C5.s..2R92..H.|.V.....q..U.{(......!......l.^..Vz.L....x...{..........
...n:...3i.M8.d8..A.......O..U...j.y..I.7z71^g.u....a.0Y...G.S..g.....
Lzb_..$a.&.pV.........=w.E.`..E.Y....L..2.1.Yl>;..%W...G6..........
}..Bl.z'.kQ.Do.......Zf.i].cI]......G."z....%.........a..X .......'v|:
[email protected]..:t..g\.Q... .c*...[...x...<>8c.<
<<< skipped >>>

POST /?pcrc=1361839804&v=2.0 HTTP/1.1

Accept: */*

Host: rp.fileorgcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 1152

Cache-Control: no-cache

.I..~...$$......$.a...<..........d.Xe..L...:..pr..$.sr ..gem..8......J.fk.X.....v./.....i...........~.{..yt..uw.4..vc3....$T.\..[^..W.....:$..'n..p@......./..$`....!.P....W.....2E...j4,p?.O...1..... .......O.q..'=.[|I..P(.E.k.v\M..J.G7.j,..z~~X..M..Nwx...Mv...6..qA&...Z.. .U.].f4...'...8A^.*T..x.h

5xh....@.[.H\-H.0.....Zx.
....7J..4B.....v...kC.....~..t......!p?<.....-..."&{X.V!.w..s.w.....C....>.....6.}.@....%.~'....NcSy..B...l....;..hF.`..#.J.J..s.?A....(1]mY4.3.... ..r#..?6R!.......'....a..f..%.;...$Gu.........uB.8...|..l..?....%...$.Z...%...J..h.,M......-.....Bt.5..,q....... .7(..q.....d.....^....>[email protected]]....dFQ5..x.....RG.G..9__...aIg<?4...~%..... !F.F.<..6.....i8....k=.....K...Hw ...q_.VwJeX.V-%...k..o.=L<C...K.&..$1 ....M.|[email protected]......|M.m.IZA...G..Tf....T.a....~/..~..rs...h.V4..~...NBNR.e..l&pO.}..@.]......8.p.f.dU\.{...v.Z.....>..7l>.w<.g.7..l...*..S...n._.... ,..d..

..E..sZ.3..`.^c~/......m 3:.
.v..e....L...0.|....9^....L.."...>.|=..\..
r.g<.~@.#.i.L......@,Q.....B'......zX.H..&....),t.../....TUt...2RE.........v..(...>..y.TL..g.v..s..I%.:.4..[..Y......3.&..&..........{4...0.V.._.

.o....Q..
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Fri, 07 Nov 2014 20:13:55 GMT

Server: TornadoServer/3.1.1

Content-Length: 4

Connection: keep-alive
DONE..

HEAD /ofr/RAM.cis HTTP/1.1

Accept: */*

Host: cdneu.fileorgcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Fri, 07 Nov 2014 20:14:00 GMT

Content-Type: application/octet-stream

Content-Length: 68754

Connection: keep-alive

x-amz-id-2: Ru5EMuccuGJqx26fmYji4Ag/8RN2CKK8 i 9Ueq9QLsd wQ4Ac0EJJjgABeqHNfX

x-amz-request-id: 6C57ADD5CFC26F6A

x-amz-meta-cb-modifiedtime: Tue, 25 Feb 2014 09:01:03 GMT

Last-Modified: Tue, 25 Feb 2014 09:33:04 GMT

x-amz-version-id: 0J7Ku3fOApQ0maOx9q3GISpaX.5t75it

ETag: "85a9022d4d17cf300c437ae38df1e2b6"

Accept-Ranges: bytes

GET /img/Global/Yes_Button.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

.PNG........IHDR...T.........d.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:2D2B0E0924EA11E392EFCCF1
BDECC388" xmpMM:DocumentID="xmp.did:2D2B0E0A24EA11E392EFCCF1BDECC388"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2D2B0E0724EA11E392
EFCCF1BDECC388" stRef:documentID="xmp.did:2D2B0E0824EA11E392EFCCF1BDEC
C388"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..&X....IDATx...1..0.E.......... .d.6\.&.ND
H.v....9.{....)...D$k...O...T.[Sl.I....K.....S3..fB...2?w.....2...../=
#.3.E(B...E(B...E( ...E(..Z..f..)U..l9.....7...........I..w...).u*..P#
G...?...%....\.l....IEND.B`...


GET /img/Global/Yes_Button_Hover.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:01 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: RWVvgI74HRlZRIBphfYCH3Nt94KeYeZ/ZJZQr cgEtix0aHUgXVZLbbJcnK/nYlh

x-amz-request-id: 8695BDDF487FF23C

x-amz-meta-s3fox-filesize: 1094

x-amz-meta-s3fox-modifiedtime: 1380713503000

Last-Modified: Wed, 13 Nov 2013 16:12:44 GMT

x-amz-version-id: L9RQqPthtuNtMC55hxM9o_RZqWXqZtid

ETag: "aec475b9d6280598800f3ceafea4af8c"

Content-Length: 1094

Accept-Ranges: bytes
.PNG........IHDR...T.........d.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:30B2AE2724EA11E392EFCCF1
BDECC388" xmpMM:DocumentID="xmp.did:30B2AE2824EA11E392EFCCF1BDECC388"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30B2AE2524EA11E392
EFCCF1BDECC388" stRef:documentID="xmp.did:30B2AE2624EA11E392EFCCF1BDEC
C388"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>. ,.....IDATx......0.E..D....@L.^L...!...2.
..........=.....vq?.H.l4[.v..d.S.l......x..W{=..k...L(..3.....k.s..3..
.K....B..P..B..P@(B...E(B..u.f4.3..)e..l9z.i.?o..7.7M.....%...y..$.:.t
A..K........S..^/......IEND.B`.....
<<< skipped >>>

GET /img/Global/No_Button.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:01 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: kDhVfF8ZpmA7 sNwv4vFZL/GNzY u3ltIKfeeaHr4FixvUU2ClfmC0a6URGNTpVm

x-amz-request-id: 05522AF282E33F96

x-amz-meta-s3fox-filesize: 1090

x-amz-meta-s3fox-modifiedtime: 1380713503002

Last-Modified: Wed, 13 Nov 2013 16:12:45 GMT

x-amz-version-id: H1gWa5fQ5azVvHrSdifdTj_fe_Q1czxc

ETag: "4462e7ebdf4a24f57b288fbca0602dea"

Content-Length: 1090

Accept-Ranges: bytes
.PNG........IHDR...T.........d.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:2D2B0E0124EA11E392EFCCF1
BDECC388" xmpMM:DocumentID="xmp.did:2D2B0E0224EA11E392EFCCF1BDECC388"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2B97008A24EA11E392
EFCCF1BDECC388" stRef:documentID="xmp.did:2B97008B24EA11E392EFCCF1BDEC
C388"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>...\....IDATx...1..1.E'A...J/ .*.....ZYne..
3....jR...!.#I1?.H..5..v..T.KSl...Rz...r.W.......m\|...C.'.`.#.f......
.A(B..P@(B...E(B...E(B.....f&Y:.j..-G......3.&...i...s.G.l.a;...%].j.V
.j.....h"..5.......IEND.B`.....
<<< skipped >>>

GET /img/Global/No_Button_Hover.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:01 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: DUYBUYmpmjiFKMODyMWCQoeesXjLXJF Ki2fPTM/kZlY/wqenq/ZUu8tFAup4azG

x-amz-request-id: 2F72CDAF9183B9D3

x-amz-meta-s3fox-filesize: 1091

x-amz-meta-s3fox-modifiedtime: 1380713503004

Last-Modified: Wed, 13 Nov 2013 16:12:47 GMT

x-amz-version-id: wNmfJwpUmazhRatL.BZxBG0x.XZldhEV

ETag: "6d55a62314755c1454569b2b098a3a9f"

Content-Length: 1091

Accept-Ranges: bytes
.PNG........IHDR...T.........d.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:30B2AE2324EA11E392EFCCF1
BDECC388" xmpMM:DocumentID="xmp.did:30B2AE2424EA11E392EFCCF1BDECC388"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30B2AE2124EA11E392
EFCCF1BDECC388" stRef:documentID="xmp.did:30B2AE2224EA11E392EFCCF1BDEC
C388"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........IDATx...1..0.E........8A9?=..h'.NDH
.v..b $.{....)...D$j...O;.v...I6....../.s.....f....2.>.......1..?..
...... ...E( ....."...P."..PWhFC1...R.N...g......~.9h..~*.\.Q..3l'....
.B.\.W...`.............IEND.B`.....
<<< skipped >>>

GET /img/Taderonadan/Taderonadan.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:01 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: XeyZteoddMT7zB1aXipURwVWKsd6UNKVph0XvKwdImG99gDcfpXHDgr2hOv x9UW

x-amz-request-id: 72D33F0951C744D1

x-amz-meta-cb-modifiedtime: Sun, 20 Jul 2014 17:16:32 GMT

Last-Modified: Sun, 20 Jul 2014 17:18:55 GMT

x-amz-version-id: AxXc6EI.8NWvuCfiSgXfADM8rlZv9_vs

ETag: "e99f71cea95a6d0237d85c8ae5acfade"

Content-Length: 2643

Accept-Ranges: bytes
.PNG........IHDR...t...........:.....sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAThC....WU...
.{[email protected]..$.f.X.(..Rfb...3.2.4i...$.B).`9#1.S..H....B..,..cw.}
.,......s......]....7..{^..s...~....G..."&."!...SN...%l..`Y"Wt.=E..m..
..9.v..........>xPt..../..w.......S\..l..3k..8....3.hz.3.y..j..."#.
%b.V<..m.bWo,vf6...d.iM6.:qT..5..8dZ[..S.v.Mo..L.zp....\..3.^DC.N.h
$o..DaC...<...,.&..J.....j..4-~...]....". f....M..9-.&....A..}...n.
....D]....3.^@[email protected] . [email protected]&.3.K..
........"$..W."h...6.0...'n...SY(e.<..6g.C...u.h..x%...{.b!..""b..x
,.......n....3.O.a.....l.............]....C.&.L..W......./=...t.....'.
[email protected]..%:"(s,e!A.7....\/ms..p..........[..{.y" &T.."$....t...)_.,..a6
...j8,h. .........y.;u?v...i...(^.|.......P{...}[email protected].&(b..=Zj6..
.g..G....|.....MU.:MPDN.4...n[...ym.].J..7..v....,.>.../..s6\......
Xk...D...*.......c....!l2.......DaK.V...BH...f....V....e....b.-.....-.
..#................f.=....t\p...B..=}....R....l=...../..O......2..}...
P.n....]..)..|.Y..l....p....._Sn...e.f.M..n....l.3.....).....^n.Li^.w.
..t.3A....(.E.n1V|Z<`.>*...>S<%8.2{....f.Y.Y.e1Jp....W...)
}../..\..p.I.o..b.xR....'........H.]Aud L.D...Y'....i......x..4..e....
...'.......Az.....&..B....j{.='`.........G...._._.^...%3...!WG.xU."x9W
.....z.!.4x..b.`G.:<........Sp?.._p..WL.;.wl.....l...-q..?#>A.S.
.`p,..........z...e...'...C. ..x..?;.....=4;...;..y.....lU.4.Ug?&..,y^
.o.7..t.p.1.?)..I..e..%.0.....m....l.\S...e..).KA......).h.N.X$..*
<<< skipped >>>

GET /img/Lilisipipe/Lilisipipe.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:02 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: ZiyYLvKXdt/eUVtb6sYVQ3ydG7cCdz61hUinLZBa1zGRnOXQfhSf27dVEP IxYGA

x-amz-request-id: 96F68D106F97F324

x-amz-meta-s3fox-filesize: 4205

x-amz-meta-s3fox-modifiedtime: 1394472583656

Last-Modified: Mon, 10 Mar 2014 18:21:58 GMT

x-amz-version-id: aUbNYoFSmvGMGSTNwmSzDDFZRwAmOUET

ETag: "c55aebc8002d65f19bf01be44577c1ce"

Content-Length: 4205

Accept-Ranges: bytes
.PNG........IHDR...t...........:.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /img/Noseresel/Noseresel.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:02 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: WH5/DBSO3ZAqqXITp9v1L1kg9kUM3gxVv9PkIIn4zx/v03/aWcHmlH9M4k2fPcKi dyQ6p04nBE=

x-amz-request-id: 2076CBE4DA4C24BE

x-amz-meta-cb-modifiedtime: Mon, 25 Aug 2014 13:34:54 GMT

Last-Modified: Mon, 25 Aug 2014 13:35:30 GMT

x-amz-version-id: TAf5uJduPCODkFdQAiP8vO0WMberqYrD

ETag: "26035609b62311690edfe84078a6de29"

Content-Length: 1574

Accept-Ranges: bytes
.PNG........IHDR...t...........:.....sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAThC..Y..U...
.A....QD...Y.QP.'Q.(......&F.......5.."... ....AEi......./....|1..5...
.=m.=.CO;.!.../......sn.[..S...*..v.Dm...*Sbh.)1....ZeJ..2%.V..C.L..U.
c.. ...-JT..-C....%*K)...` [email protected]=|...:.{.....X..,..,.
c...r.......A.`...r]a..h#.*.. ..C...CW......L.....(...0.F@w..._g$.....
2^.Yz@..... .z...0....6..D.2y...t.js..M)..F.vh...)]2..J14......,...a.f
......e..YnY.e..W.....Y.j:.8.=il.[ ~. ....,X..f.}[email protected]....`6&l
t;.:.i;.aU....;...Y......o..5../j......S......._;.........5;9.j...n...
..... [email protected].:k.e.W7..u.....`.U.Fc2PF...$P..0.:[..X..@...../
.&...B......k.F..S.Wx........V...R..uMn_. .t.a.w..n......Ow.q....#]...
......w.....)>..... ...,R|.<..........X......3........7......aB&
...q.........\ 9.vM.q.'.....\).[...P......j..j.!X...M.st....F5...Z..w.
..z.e.z.}.....z.H. ....c......Y.....JC......?..........R(.P....l'|..n.
..V...g.^{.4m....U.T.....A.x...........S.:g..2t%.w.....S.4,.:..g....*.
...Cp..<C.jq...x..DcaE.8_....I..^ C..;A..NV..h......iP....K......j.
E....n....0..z....[. a.E..D}.].bj.4A.*..h..j.b...X......x....{~...PHmn
....\.).P..w..7.=.....w.....3.Y..............CA.....|.VP.e.X.~7<.~.
Z.P...5.......d..T.....!.........G.=.....~..a.2...O...S....AZxh.*.^.M.
:_[.{@[.......GN.....kA.R..!...a.......k..z...E...........0..=.4%..-..
...aS......H&...L..Z.^..Gj?.w._4.......V..kd..]9M...B..e.|.k/...I."...
[email protected])h?...........o..=m.4.%.Cp.........kCp.&1.......U.....[....0
<<< skipped >>>

GET /img/IE_logo.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:02 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: 38CGKt5N/IssSNUJX9ruC3jtYGWy1owH1gxRlSLxu4ukj9k1FeLP0p9h 9hnz 74

x-amz-request-id: 6E08B572BD0C4032

x-amz-meta-cb-modifiedtime: Thu, 21 Nov 2013 15:31:46 GMT

Last-Modified: Thu, 21 Nov 2013 15:40:00 GMT

x-amz-version-id: ULP9X2D2g9vGJo_NefwroanEdNt0Bt7c

ETag: "0866b0f3be00fd96d58f7fba54d6700d"

Content-Length: 5406

Accept-Ranges: bytes
.PNG........IHDR.............Rf.2....pHYs..........o.d...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /img/CH_logo.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:02 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: IPRE3T1eOALzYaueuf6zkJ4Dm/NlnjxmE4jbfw0 eRTJW0wjOo0SO66ke8bKxu4W

x-amz-request-id: 2AAAB9282DCDA8DE

x-amz-meta-cb-modifiedtime: Thu, 21 Nov 2013 15:31:44 GMT

Last-Modified: Thu, 21 Nov 2013 15:40:01 GMT

x-amz-version-id: osjur0cYkvY0gJkbPOZZ_tbD.fAnrMVX

ETag: "ad8ed967a43ae4d7d6c28ff2ed3c8550"

Content-Length: 4577

Accept-Ranges: bytes
.PNG........IHDR.............Rf.2....pHYs..........o.d...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /img/FF_logo.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:02 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: QoEgysmYWN5Y5HHaQrMI5n6JoBBoWJJTA QF ZPWBiCJJclFB0vnAzeF636 R9Vg

x-amz-request-id: A650FF3C7E791D9E

x-amz-meta-cb-modifiedtime: Thu, 21 Nov 2013 15:31:45 GMT

Last-Modified: Thu, 21 Nov 2013 15:40:00 GMT

x-amz-version-id: g_t3b7eiRe5f7z2B5bSNHqt0MOq9rM5O

ETag: "6bcecb3debf7e4a0569b6a9d6e62adab"

Content-Length: 5025

Accept-Ranges: bytes
.PNG........IHDR.............Rf.2....pHYs..........o.d...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /img/Notoseso/Notoseso.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:02 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: dtiB5pP/JqZJadYNjBREnALFcr0MwmlriwfTCh2QwkopMp MmpMwLMhpNEDeGtexSRWcAru8q10=

x-amz-request-id: E0F8B65A38E45562

x-amz-meta-cb-modifiedtime: Tue, 14 Oct 2014 11:39:08 GMT

Last-Modified: Tue, 14 Oct 2014 11:39:28 GMT

x-amz-version-id: J1atscP57_rpQRGzmv3zQcwrpTdUbHeN

ETag: "6190cd022b781904da782bcb61d8f061"

Content-Length: 11772

Accept-Ranges: bytes
.PNG........IHDR.......)......z.2....gAMA......a.....pHYs..........(J.
....tEXtSoftware.paint.net 4.0.3...P..-zIDATx^..wx.G...k{w..:...m....g
4B$....D.".(..9.. ..DV..PD"'...9g...d..{j.G.......q.:..v.tuuwu........
.`2.s..d.....&...........l0...su.....]..s...[.....u..6.....U. M.......
.&.{^.m...W=..5<k.5..7uqv*............d..Su.C.J.F~...m....ic..)O..e
.....P........vv0.8T....T.f..P..]......SVcd.f..... ................0e.
N..MA.....].Ku...5..6u.^.sg..V.........Z.je...T.j....A....@.*P...u.vs.
...S5..u.$4.2.I.Ik1$....8.....'|.......3.0).......M..`../...V.... ..t.
..oB......E...c.c.J..`;;9..6h`...C....8.15.. .*P.r.......\.|...g._.a.:
OI...../.$:...M...kP4../A..E........G.._...#.3`....G..i..p.&$....K..r.
.....FM.x.*..9;T5.0<'...~.r.&P..)./5.. .*P.r.....^..N.f.;.X...?...c
.<o.ZLHC.!..n.......c7a.........<N...#[email protected]'
...Fh.E..O.o..g..U......b...2.k.N...u.5...fR...R...(Gj.2..\..6..qm....
.u...|.VS6 hl..L...u[q..i.|.g<z..~..)~......M...e../.../....C.=w..2
vc..5h;6.-.......I.1 .....{........gWg'..W...^....O.DyS....@.*P....l.Q
Bp.N-:..76r..G.F...h5..}..aU.V..p.?...7.......ck.6gNAFZw.......2.b..1.
.m%v...3./..O.q..m.d...Yk.f.Z......Oc..s....S..q...oK......NB.?..w)...
..@.*P....j.....z.F-.._.....-9...S.4&....q......z.K..%.........~.&....
..}........_....._..............!HO....o.....:1.u........8..Ig....g&.[
W.....f...6...LS./H..T......M....P.b...........c.....h?... 7.....s.gl.
....O.....}..~9....JbS..X..&...0n..1Q..%........S.j....,.(..3.a...8v.,
...E.:.P.o6..,.]z..A.n.\.jJ...}.F~~.N.:[email protected]`.[;9T{.F.:
<<< skipped >>>

GET /img/Ropopi/Ropopi_Title.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:03 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: 0/qVLFFRNJVp7wiUZn7KXvUztj4Hm5SWHfQ6XX18lAAN6jhGKaLjKMU7Xvux3yzV

x-amz-request-id: C15CEE7ED753FD2A

x-amz-meta-s3fox-filesize: 6116

x-amz-meta-s3fox-modifiedtime: 1387450415497

Last-Modified: Thu, 19 Dec 2013 10:53:55 GMT

x-amz-version-id: 3I.0T8r7FzB4TXAFhfckgLMsgXRICC.S

ETag: "ceb0a8abdb1e31bd3593877e0d862ea8"

Content-Length: 6116

Accept-Ranges: bytes
.PNG........IHDR.......&.......o.....sRGB.........gAMA......a.....PLTE
...r..u..m. p./s.3w.8w.6w.8x.6z.:}.Aw..x..{..~.!..<..>..C..H..C.
.K..E..K..F..K..Q..S..Z..R..X..M..S..[..]..b..b..m..#..#..%..)..,..*..
-.....0..0..2..8..4..8..9..<..:[email protected]
..M..T..Z..T..Z..Q..U..U..Y..F..K..N..Q..T..S..T..S..U..V..Y..\..Y..\.
.c..c..k..d..q..Y..]..Z..]..]..^..Z..]..[..]..f..k..a..e..a..e..`..f..
c..e..j..f..o..j..m..t..z..s..x..x..s..{..a..e..a..d..b..e..c..e..j..e
..h..g..j..m..j..m..n..l..r..q..u..q..u..p..r..u..y..p..r..t..t..y..~.
.v..}..x..{...........................................................
......................................................................
......................................................................
......................................................................
..........e....tRNS...................................................
......................................................................
......................................................................
.................................................................S..%.
...pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....;IDAThC.Y
._....... I. .....d..~..4...&($Q.bl....R....E..J...D..V.u.\..[o7......
.b_..w.W...7WW...v.......4....O..~..=.9I.?.op%|...q.?_...WB...7.#^:~..
7>.6...4b.HO.. ..],&.k...8(N..x....2..Pl..1ac..^.f........C"?.....u
.w.......].1.jZ..`[email protected].. ..W........Xw .kB..E....U....;.
........C......w..\|~..}...)....i..?X>.~Y....o.#c...0.c0..G...@
<<< skipped >>>

GET /img/Meteterot/BG.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:03 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: P6jh4nvKTqfayTWk6dGRock1lNoq7/8PVqKbel3tCJCaVtM1WGjfeOFV8p/P0xfO

x-amz-request-id: 1C3A6672E5B7F874

x-amz-meta-cb-modifiedtime: Mon, 30 Jun 2014 13:44:46 GMT

Last-Modified: Mon, 30 Jun 2014 14:02:36 GMT

x-amz-version-id: jpGC425R_OlcDnACSExk7ey67AcYQKhd

ETag: "043d131dd01570364d721ff22ccfa8dc"

Content-Length: 27171

Accept-Ranges: bytes
.PNG........IHDR...0.........0.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E09CBA18005A11E4A0029A53
74AB7098" xmpMM:DocumentID="xmp.did:E09CBA19005A11E4A0029A5374AB7098"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E09CBA16005A11E4A0
029A5374AB7098" stRef:documentID="xmp.did:E09CBA17005A11E4A0029A5374AB
7098"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..S...f.IDATx.....$Gu&.Y.u......[[email protected]
..6z`0...3.......{<...<~..`.....a..<.......a....d$.KH.I..[..n
uoUMdF........[u ....>.....y....'.......E....f.......6..^z4..~.....
.w\p.c..}.r..o...GQ......v.v.......U...l......~.'./[..>..`.t.....&l
t;.h......f?....nz...e....\..W.......'...K.s.0..C#Qz.3..j.......~Z.h..
mC.iw..$.5...............'.g.>...S./.....=9.}pO...=A.........Z.>
.c....P...6....'S.@.......!.s....:!!k....pFsO...A...8.......v....gh.{7
.....g{.....'c...M.z.W.{[email protected]...[I..........))=......
'....V......}..8......Np~.8#x!.V..I./]..........%.}..([email protected]@
<<< skipped >>>

GET /img/Meteterot/Logo_Bisli.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:03 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: g04INn341ExZWhqDPVjqNHD/HeYGxAr8Z9WsiR4to/YJ/3hfD4ddn5eogLIeKuiJ

x-amz-request-id: E63981DB89A28D17

x-amz-meta-cb-modifiedtime: Mon, 30 Jun 2014 13:44:46 GMT

Last-Modified: Mon, 30 Jun 2014 14:02:36 GMT

x-amz-version-id: ZQda6qnscjEAlDAbM7HluQqYmzw.1usC

ETag: "98c1a226408550fae1e4d1c0b06be05a"

Content-Length: 5471

Accept-Ranges: bytes
.PNG........IHDR...c...-......i......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:32361D3F005B11E4B64A98B3
AC520C46" xmpMM:DocumentID="xmp.did:32361D40005B11E4B64A98B3AC520C46"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:32361D3D005B11E4B6
4A98B3AC520C46" stRef:documentID="xmp.did:32361D3E005B11E4B64A98B3AC52
0C46"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..H.....IDATx..[.xSe.>Y.&M..M....."...R.
.;..."..........#:......6..#."..(.B.Z.Q..=i.&...I..?.B....8.?>.|}.M
....w.{.......|....... .F`...}......}[email protected]....&...p...."T*m....T,
[email protected].!$D.u.j..c......M.g....m.....~<......CG0....b. B&.77....v@.
$..#c..?>._~..44....`w.BZj..E.C..r0....z. w"....7...V....m.".1.j.. 
2<.......9.FCSK#..x6..G.$......~..[,.....{.!.........7}.lX.y......f
.L...hX.r....&\.8D...^.L......JO.ed$Dy.,.....([email protected]...:...
..Y"aH*>.P|\..PI.A*.e.... @.~....H..?!"1...CuM.[..\...r...kJsk.....
...D...z< m.....C.1N.F.N..8hY.. .Qy.|...MI.tL .(..G.X(=..4.....
<<< skipped >>>

GET /img/Yudekekug/Yudekekug1.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:03 GMT

Content-Type: image/jpeg

Connection: keep-alive

x-amz-id-2: vzbfO6tY55Yr7mNlWfzHTvaT99hiYYj2NebZtF0m0QjEGMRsFjU2kXjW3HDDY/uE

x-amz-request-id: 3A4F971C8AE1F9A3

x-amz-meta-s3fox-filesize: 20240

x-amz-meta-s3fox-modifiedtime: 1396439944109

Last-Modified: Wed, 02 Apr 2014 12:00:42 GMT

x-amz-version-id: 6oxF0hlBCaqqtx1SptKFa_3sq6hxBvnL

ETag: "4e5a1392ce9e9359c8cc5e373f228757"

Content-Length: 20240

Accept-Ranges: bytes
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EB7EEFA12AB3E3
11AF31E1AF3FE601EF" xmpMM:DocumentID="xmp.did:6720C427B33E11E3BE83C6F0
EDC90271" xmpMM:InstanceID="xmp.iid:6720C426B33E11E3BE83C6F0EDC90271" 
xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:EB7EEFA12AB3E311AF31E1AF3FE601EF" stRef:
documentID="xmp.did:EB7EEFA12AB3E311AF31E1AF3FE601EF"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.......................0..............................................
.......................................!1.AQ..aq.........."2....B.R#34
br.5..C$..c.....%6.........................!1.AQa2.q".......B...Rr.34.
...#.b..C............?..G./.....)(1v....N.Mpt.%..<PA..1...|EAf....'
...`.........I..P..$.5..`..-..A..K X...([email protected]..?....(.....
...0A..!.AK. .....a.:.].....2. ...J.........e<PN.K....)5..%.X9.
<<< skipped >>>

GET /img/Yudekekug/Yudekekug_Dark.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:04 GMT

Content-Type: image/jpeg

Connection: keep-alive

x-amz-id-2: jsJYeZMrk4UqNmgD R2LvFE41kIS5T6MzyX7Q82govta1Coxcv50Ijm8Y5yJ3noV1sk3 QQ7L00=

x-amz-request-id: DB4F44FBB1A192F4

x-amz-meta-s3fox-filesize: 32730

x-amz-meta-s3fox-modifiedtime: 1396454431540

Last-Modified: Wed, 02 Apr 2014 16:03:32 GMT

x-amz-version-id: Hy4i82lt7RbCIX7vPu9KSrM9eXY4NtDa

ETag: "acedb8672b2cb75820e05df9ebf4ec8a"

Content-Length: 32730

Accept-Ranges: bytes
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EB7EEFA12AB3E3
11AF31E1AF3FE601EF" xmpMM:DocumentID="xmp.did:3BE97C6EB9A211E3816A9C8C
047CB23D" xmpMM:InstanceID="xmp.iid:3BE97C6DB9A211E3816A9C8C047CB23D" 
xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:FA02086B3EB3E311AF31E1AF3FE601EF" stRef:
documentID="xmp.did:EB7EEFA12AB3E311AF31E1AF3FE601EF"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.......................0..............................................
.........................................!1...A.Qa".q.2..B...R#...3$..
.b4.r......CSs.Dd.c.Tt.%.........................!1.AQa"..q......2B..R
#.....3br..c$.............?..v.......2..".8.EcP.u...a[[email protected]|.`UE
...dr...........#8..m..0..V.....r&.f&q.q...5c...h'rX.?.HUB\.09.j.uu...
.Y. [email protected]...'..:..UY...Q.h..H.....#......XnxN.P...o.A9......
<<< skipped >>>

GET /img/Tonononot/Tonononot_BG.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:04 GMT

Content-Type: image/jpeg

Connection: keep-alive

x-amz-id-2: mX0BPJTBKqP87DalumNWMbF3huiwsWXiCzIF27d4YOqc4ZZsaHC W8YXLjq3p3zfoCwc2/QiNeE=

x-amz-request-id: 007BDBCAC7B54FC3

x-amz-meta-cb-modifiedtime: Wed, 03 Sep 2014 13:19:56 GMT

Last-Modified: Wed, 03 Sep 2014 13:21:43 GMT

x-amz-version-id: WTCpfwUb.KAD9n7gi5Nq9SPbIa6BOcnb

ETag: "8f98418795781c87bcbf9f34e7703964"

Content-Length: 38602

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B2FDA0CDC92DE411B
BE8B41E63CE39DC" xmpMM:DocumentID="xmp.did:7FEB66AD336511E4A310CAA900D
5BB6B" xmpMM:InstanceID="xmp.iid:7FEB66AC336511E4A310CAA900D5BB6B" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:B2FDA0CDC92DE411BBE8B41E63CE39DC" stRef:doc
umentID="xmp.did:B2FDA0CDC92DE411BBE8B41E63CE39DC"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
....................0.................................................
.............................................!1.AQ"...a2q.B......R#3..
.br.$...4...CS.u.Vv78.c..dE.&.w.X9......................!1..AQ.aq...
...."2..B3...Rbr#....s5.$4..C.6............?..WS.@5=..S.@5=..S.@5=..S.
@5=..S.@5=.......O}.......j{.....j{......Z.@s.........................
......O}.....O}.....O}.....O}.....O}.....O}.....O}.....O}.....O}..
<<< skipped >>>

GET /img/Pebotocotot/Pebotocotot2.PNG HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:04 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: peR2b2DYsnjmu40F 1j64tGM/ 4s62vj55AVVxSzDYbDJmXfqoTAkpwprw/ghCv0jfImgJE4tBg=

x-amz-request-id: 8774C123A7A68770

x-amz-meta-cb-modifiedtime: Tue, 28 Oct 2014 07:20:12 GMT

Last-Modified: Tue, 28 Oct 2014 07:31:28 GMT

x-amz-version-id: Y5ZaEWlBWBHpNC9oXqeuW4x37QSHhoB.

ETag: "50d8a0167f6544843a2c08d66df03b6a"

Content-Length: 7529

Accept-Ranges: bytes
.PNG........IHDR.......!.....$.......gAMA......a.....pHYs..........(J.
....tEXtSoftware.paint.net 4.0.3...P....IDATx^.[.tU.ue%.$&O4u.....tu%M
[email protected]\..S.$..b v.$.`0`.Yr..A.A.......F......................
..n...g=..........>.}w3o.M3.?.....2-.I.......(..K).i.S.6vm....\v.&g
t;.v].X&c.M.$..,KH..).xKD...DL..\.....v$...y.M......i....g."...$.LJ..k
.-a....4.{...........]..6X@&u...Z.....]K`.G.}.U....)-.l.<|.13...y.M
....8.L....er [email protected]..&.....w..*..u.e..z,..Tu.R
v.S.o.]...v=..}6v..,..%7-..C.....L../j..:.Z......0..|.*!Df..I.3?.}.%..
....An.....m......B...0....L%AP}....8....LHS.C..p.U .i.c...D ...3..=..
.f;qR......N......qN..H.e.....AX..Ww..nc........zyc/n..w...%q...a.|..&
........[.....r...xw|...g?}......*..".N..i.k....2*.....9.....5...c1). 
..>0i..2Y......~..hv..ZnP....>.../o...v_P.......8.&....C.a..2-%t
"....'...J.....`[email protected];L.:.sN..J...h.].P...v.
j.........l.r> d.....8............!c`...`.}...z<6.u%}.t.........
..1(..b.$...J...9...D.vFt..7..c...d...Ii............?.U3>s....M.Xf.
T"."'d..In@....>8........Ct.....5.6$...r......}@[email protected]@'7.
r.d._...o`[email protected]:...4./..J..7..D.........M1.Wk".[.*"..i...$.a.8t`
..!....i...A.zn.........$.tz...........{.=JL.G.g.F:0.#[email protected]...
`bP...........l..m.D......W ..c....V1.0..N...<....q.'..-.G...{d.S..
P.P...O6573.4A.....U8..H.....S...|C.....w....6.<...V.;..=!...... .J
.....C..W.......xy....C1...*.......&d%:..g...|.cJvp..|D....~.y..e....$
.|..=R.w..............;wF"...}.E.T.....4'...#g..f......~H..F.8....
<<< skipped >>>

GET /img/Notonoronot/Notonoronot1.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:05 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: NcRYnLTxWOX/u6wMIUuP45R4W5gfk33E7IFn/n/A/WFk02WyqDIrFOHeuwDFiKsE2OFTOcePxZk=

x-amz-request-id: 7E72907C4B5E1024

x-amz-meta-s3fox-filesize: 29501

x-amz-meta-s3fox-modifiedtime: 1394353610742

Last-Modified: Sun, 09 Mar 2014 09:36:24 GMT

x-amz-version-id: ti8BJF60.JJNDrEnRRfPhpLnBdls58ng

ETag: "3f455eced790557f15400f872d7908ac"

Content-Length: 29501

Accept-Ranges: bytes
.PNG........IHDR...0...........}.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:84B4A51725A5E311B86A888C91C8A1BA" xmpMM:DocumentID="xmp.did:F3D5
B9D6A53D11E389C2F1F0D236A3B5" xmpMM:InstanceID="xmp.iid:F3D5B9D5A53D11
E389C2F1F0D236A3B5" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:402ED7B437A5E311B86A
888C91C8A1BA" stRef:documentID="xmp.did:84B4A51725A5E311B86A888C91C8A1
BA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>..E...omIDATx.....dU.......:.......3.!.(..%..
... ......(..b.D>.AE......'29vO.T.]....=.V.....3.u....NU.p..b..g...
.H.e.a..a.f"!.O.0..0....0..0....0..0....0..0,0..0..0,0..0..0,0..0....0
..0....0..0....0..0....0..0....0..0....0..0....0..0....0..0....0..0,0.
.0..0,0..0..0,0..0..0,0..0....0..0....0..0....0..0....0..0....0..0....
0..0....0..0....0..0....0..0,0..0..0,0..0..0,0..0....0..0....0..0....0
..0....0..0....0..0....0..0....0..0....0..0....0..0....?..0.3...|(.J.z
[E.TI........5Y@-,K..|.....O....<..........AM......?kw.i..I....
<<< skipped >>>

GET /img/Mapayuy/LOGO.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:05 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: S/89G8u6RqcvxLFt68lo7Mva4i8AtlwHBxE/Vk5z6IdEIg5ubhBP1bk00lUSGBUh

x-amz-request-id: 77ADD104F95A35BB

x-amz-meta-cb-modifiedtime: Mon, 10 Feb 2014 08:51:03 GMT

Last-Modified: Mon, 10 Feb 2014 09:24:37 GMT

x-amz-version-id: 5u3JQZ1GPK62zlrEEfaN7rrrBMh6wKoK

ETag: "14f5d50e6a8628e97604c97e4735fe7d"

Content-Length: 16671

Accept-Ranges: bytes
.PNG........IHDR...,... ........y....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /img/Memiticeper/Memiticeper_BG.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:05 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: 5bR4f8GY2MhFJVuPQqSJrv6JztzRn6Qmhdw33e66Yt wA82Qva czIGlj25UPpO5

x-amz-request-id: B0594DF1EF2985D9

x-amz-meta-cb-modifiedtime: Mon, 27 Jan 2014 16:11:24 GMT

Last-Modified: Mon, 27 Jan 2014 16:11:45 GMT

x-amz-version-id: .y2VxUmNKrfeEZRhs8H2wQTsvVaKgQZQ

ETag: "4ad19f532c0996da281e610aa2992a96"

Content-Length: 42970

Accept-Ranges: bytes
.PNG........IHDR...0...........}.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:47D7CD6B132168118DBBA8AD0A7AA509" xmpMM:DocumentID="xmp.did:302D
482E876D11E3BA75C5A7B57E5B7C" xmpMM:InstanceID="xmp.iid:302D482D876D11
E3BA75C5A7B57E5B7C" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6BD240655887E311AC79
9D5F5C8BA5FF" stRef:documentID="xmp.did:47D7CD6B132168118DBBA8AD0A7AA5
09"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>[email protected]...(bw.fm.n..K.._...
nS...t.3gMgww7.X....Hw.... ........<..W...=..{....Q.x..T.g.>X..A
..{........kK... ..P...#....R..&>.......z...H"E...>[email protected]
1...E....(....s...... );G"J..A.. ..X............ [.LM...7.....0k.....C
n..o.. ......P......... ^...d.o'.. ...H..A......P..m....o.#.R(....|P[.
4r...-?..z..i. ."`...!.r......C..s.*?..k....C..F"H...>B........"...
.G.|...eJ... ....A..A..#.. ....A..A...0. .. ."`.A..Ax..i.../..........
..<7*.&....../c...d.....Fuh....Q.._...s.`..k..w../...A...g..`..
<<< skipped >>>

GET /img/Gegogego/Gegogego.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:05 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: clrThI DFCrIb7g5acO/G  IkKdPsHzuL8D8dspxbzODiqIhrB1Y4Ug3az7XNxmK

x-amz-request-id: C3EF663A30E91CF4

x-amz-meta-cb-modifiedtime: Tue, 24 Jun 2014 10:14:33 GMT

Last-Modified: Tue, 24 Jun 2014 10:31:23 GMT

x-amz-version-id: lQ1ZjbNz94SNdd_NOMYFRoL.dGISZGI2

ETag: "72031603c036e8a90ce3f5ad7163c689"

Content-Length: 10928

Accept-Ranges: bytes
.PNG........IHDR...0...........}.....sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.Paint.NET v3.5.11G.B7..*.IDATx^.........
j..J..G E.]..3..a2!1..q.\l.7c....%.....(..........`....8.&......0....&
!...G;...#..(.J.V..j.....>.........#}dw.....}.<}...c............
......................................................................
......................................................................
............................................jq...f..[.2Y.,.9b....h..E.
j_3.S....jGb.d....%....O<V"....l.....`R..|......G.4z.k........5..,.
>Q#.....'.G...Z.T!........I..i.-Y...4....Z...h.kl%.y.[..Q..,.....4.
5..u.......<[email protected]|..WF....h....l..w.
..{.._.....G.K.-.....5.S%/Y.PNz..A..d.$....W8Z...v..F.JH...@]...p. . .
`.%O:.s...h4..O|..I..I...U..s..L4.DJb...\Nyu.........5?f!.H..........K
H.h..I?.?n......D.H........Sk-...e9.=....u.}...Zf.s....M..(.....1...M.
.....2...:W ....'w..,^.L*..{U.....pLL$....BT..|..,Y"..&2qI3.....3K....
X..*..F....s..s..1Sx.3Q..,Y"'G,=...[-..P........:.6$..s..}.Y..=.'.,...
.oD...i(...kt.3;....|.....zV.$rR5*_..o..&..G`.%.r...rr...#.Z.1..R..b..
.%.3n........../....N;...}....j$/].D......(..?Y..V.{..7.=.....w..e...E
,2.ku2..`n....Ki...Y...$jE....B....'......o!.|......Yk.......z.V....lS
...z...\Y.Mja...|.J...s?.d.X..H^<A...^......Q..../...t..c..e.......
.DD.....E=2..]CG./.Xg.5=.e.....C..V>......>|. .^6=|..l\u....P~..
..ko<6...?_.;............L......%J..,.....8.)...r.......=V...W..4..
X.'...].y..j..2......T #Q...0z.jx....K0.u....X..N._....)S%z....[Y.
<<< skipped >>>

GET /img/Gegogego/Gegogego_Bisli.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: img.fileorgcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Fri, 07 Nov 2014 20:14:06 GMT

Content-Type: image/png

Connection: keep-alive

x-amz-id-2: KVlH8al81D62mctTA/c207qxaxqgtGKco3avj2MubjW1yPiGGpXaCm4DJ8 DYIqO

x-amz-request-id: 1E16020E24AB733A

x-amz-meta-cb-modifiedtime: Wed, 26 Mar 2014 10:22:00 GMT

Last-Modified: Sun, 30 Mar 2014 06:55:20 GMT

x-amz-version-id: dQSLbyuSQbJhu3bSmJ8OUaai0Dq6hO.H

ETag: "655a3c68842717ac143b877be16f9161"

Content-Length: 10056

Accept-Ranges: bytes
.PNG........IHDR.......*.............pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /inst/c1e69fb1d4f7005d5f1f49ee8ff532cf-RealPlayerCloud.exe HTTP/1.1

Range: bytes=0-49009239

Accept: */*

Host: us03.procloudstorage.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Fri, 07 Nov 2014 20:13:52 GMT

Server: Apache

Last-Modified: Sun, 29 Dec 2013 21:31:53 GMT

ETag: "460512-2ebd258-4eeb30e480440"

Accept-Ranges: bytes

Content-Length: 49009240

Content-Range: bytes 0-49009239/49009240

Connection: close

Content-Type: application/x-msdownload
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........M.&.,.u.,.u
.,.u;bwu.,.u..qu.,.u..Eu.,.u.Tlu.,.u.T|u.,.u.,.uI,.u..Du.,.u..tu.,.u..
uu.,.u..ru.,.uRich.,.u................PE..L......R....................
........;........ [email protected]...... .....@.......
......................2....r..........P...............X.......t ...#..
.............................a..@............ ..,.....................
.......text............................... ..`.rdata...d... ...f......
............@[email protected]......."[email protected].....
......................@[email protected]...`[email protected]....
......................................................................
......................................................................
......................................................................
......................................................................
............................................U.....SVWh.#C..k....u.j`.5
..C......3.YY;.t.V...........3...V.P.SSh.....]....!C.P...#C..=.#C..D.}
..tK.}.....u!9].u..u......E......P(..u......P<.E.P..."C..E.P..."C.S
SS.E.P....u......P,..V.PH.....V.P..._^[.....Q.3....t........8A.u.8A.u.
8A.u.3.@..%.#C.SUVW.t$........j(3.j@...#C..^X.^\...!C...U...!C........
@[email protected] .x$...#C.U...!C.U...!C..F.SPSSjdjdSSh...
.WWS...#C._.F\..^][[email protected][email protected]..
.F\...#C...t.P...#C...^.....V....2....u...j.j.V.P03..e.F.Wh8$C.h0$
<<< skipped >>>

POST /File.org/?v=5.0&c=1418100568 HTTP/1.1

Accept: */*

Host: os.fileorgcdn.com

User-Agent: ICAS

Content-Length: 1220

Cache-Control: no-cache

0A0Czu0F1L1I1PtF1F1C1NtN0U0I0DzutDtDtD0CtBzytA0B0D0FtB0FyEtC0D0BtN0W0VzuyDtFtCtN0W0S0PzutAtN0O0S0L1T1G1Nzu1P1GtN0E2V1P0C1M1J0S2Y1HzuzyyEzytAtByDtDzyyEtN1L1B0A1Q1H1L1GzutCtN0T0KzutCyDzzyEzyyDtAtN0U0I0DzutDtDtD0CtBzytA0B0D0FtB0FyEtC0D0BtN0U0I0D0N1P2WzutDtDtD0CtBzytA0B0D0FtB0FyEtC0D0BtN0M0G0U0I0Dzu1OtA1TyE1PtDyEtCtGzytD1RzytGyEyC1Q1OtG1TtAyD1TtGzzyDtD1TyCzyyE1O1T1PyD1StN0M0S0I0DzuyBzyyCzzyEyDzyyDyBtGtCyDyCtAzyzzyDtAyEyEtGtCzztDtCyCyByEyDtAtCtN0S0I0D0U0I0DzutB0FyB0E0EyBzzyDyD0DtAzzzzyD0CtDyC0ByCtAyD0FtBtA0Dzz0C0CyEtC0D0BtN0M0A0C1V0LzutDtDtD0CtBzytA0B0D0FtB0FtOtA0AtCzytBtFtCyCzztFtCtFtCtBtDtOtA0AyCtOtA0AtCtN0S0D0TzutBtDtCyEtCtCtDyBtCyBtDyByEyDtBtBtBtN0V0M0Czu0V0M0WtN1L1B0V0M0D1P1OzutCtN0P0E1V0M0O0D0Ezu0D0L0LtN1I1L2ZzutCyDtAzzyByCyDtN1L1Q1B1RzutAyEtN0D0E0P1V0M0O0DzutBtN1L1B0A1Q1H1L1GzutCtN1L1B0U1T1R0O1GzutDtN1L1B0U1B1P1C0A1Q1H1L1GzutCtN0R0N1T1H1Pzu1RtOtA0AtOyD0CtDtDyC1PtDtBzyyByEtA1QzytB1OtBzztA1TyDyDzzyD1T1Ozz1StBzyzy1QtD1PtF1P2V1PtN0O0S0L1T1G1Nzu1P1GtN0O0S0V1P1CzuyDtFtCtN0O0S0S0P0V1P1CzutAtN0O0S2VyCyEzutDtN0P0P0Nzu1B1T1G1Q1S1F2V1V1B2X1RtF1P2V1PtN0M1P1H0P1M0AzutBzytDtN0M1P1H0P1M0TzuyDtCtCtN0M1P1H0V1L1C0AzutBtDtDyBtN0M1P1H0V1L1C0TzutBtDyEyBtN0P0R0O0D0U0C0T1V0T0I0T0L0Ezu1C1P1T1I1E1I1T2U1P1C1V1Q1F2W1G1I1F1T1Q
HTTP/1.1 200 OK

Content-Type: text/html

Date: Fri, 07 Nov 2014 20:13:55 GMT

Server: nginx

X-ICSCT-CC: CA

X-ICSCT-CITY: Montr.al

X-ICSCT-GICSET: global1364

X-ICSCT-IP: "%local server IP%"

X-ICSCT-SERVER-NAME: ads.slave-13-us-west-2

X-ICSCT-TIMESTAMP: 20141107151355282

X-ICSCT-VERSION: 1.2.4.1

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive
1ace....o..sg..p.(..<.hl.j..m.H`._Zs.nlV...B.x.#........w.~.".. ...
..d...K.....m.i0.,...:;3\[email protected][email protected]:*Yk.D0
.i.\....7..D..)Y...J....)...7...AD..4.t..S..j....H.3>A...@..;...5..
3 RN/`$nXPA.......T...`...M.......;.6n-o.&... ...z.>.(...:......]..
.....Bm.l........5.J..."..q...5...K>./....0...V*....K.....S...>.
_..QH.....<XO" 1L.. <..!H9v.,i~..F.......p.A.................0..
?....\.........H.H*..I...x.}r!.....y.Bt........0...EC......MD7..%.V.wZ
....B?.....y...>_=.6n m.&.Z..Z....~.~...&1..c!...cg.....:..8.......
X.....A.Z....v..ij.T8(/$.4U..?......0k...j.............../=..#.<3|.
.8(.........6\.o..z......\...t...Z.....).&f...Z.%K .]....4...:.x..X &l
t;i.E....t.)...,!......j...X...)/......7D...A..j...>......(........
....ux&..%..(4L B...<1.......P..*.L.&....m...A...."@..-.2Og..e.W^.G
.'.H.j... ..N.../\S..BaZM..K..a/.6.(..} .....f..%......&..!.Nz..X;.-..
B.....8..Mb......../.|.4:].*...~!..r..Q....$).H{%zl2..U..9.&[...-....,
..& .x...'!.`.. ........D.H.....QPq..pqn.V..F.......9....R.....B......
A.-. k..\.9..LX9..9...P%..Pe....A..qg...\.kN.ur!..9.=.....Ou...'/....C
..Nd}......m.....L..7m-.....e.\.t..?.#..lj....Q......t}..N..W(..G. n..
..`....a.....-.5.3..&...Q:..Fgo&Y....z...&..#.I)..m..=...r2........Q_.
....!.....2...zG.*[.....u.....=.2?......HP..TH...N.....Y,.}$.B.C7R"...
........._C...$y...){L..YM.......b;..P8_[...Y......:.8.E..U...d...4&..
a.c...X'._..0......kG..d....2'.......j...U.......R#..'?..?Y..:...$../.
..1..W..C......k..]....V.........G4..;.h.`..T...Z'..5...hk.*.....3
<<< skipped >>>

HEAD /inst/c1e69fb1d4f7005d5f1f49ee8ff532cf-RealPlayerCloud.exe HTTP/1.1

Accept: */*

Host: us03.procloudstorage.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Fri, 07 Nov 2014 20:13:52 GMT

Server: Apache

Last-Modified: Sun, 29 Dec 2013 21:31:53 GMT

ETag: "460512-2ebd258-4eeb30e480440"

Accept-Ranges: bytes

Content-Length: 49009240

Connection: close

Content-Type: application/x-msdownload

HEAD /dl/redir/inst/c1e69fb1d4f7005d5f1f49ee8ff532cf-RealPlayerCloud.exe HTTP/1.1

Accept: */*

Host: file.org

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Found

Date: Fri, 07 Nov 2014 20:13:55 GMT

Server: Apache/2.2.29

location: hXXp://us03.procloudstorage.com/inst/c1e69fb1d4f7005d5f1f49ee8ff532cf-RealPlayerCloud.exe

Vary: Accept-Encoding

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

The Installer connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

shell32.dll

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.0)

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

*@@$ˆ)'22.

H^^.ShhG]rree

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

%original file name%.exe_300_rwx_00404000_00001000:

kernel32.dll

%original file name%.exe_300_rwx_00900000_000B4000:

.rsrc

rnel32.dllwGetLongPathNam,

Q0.Fl

.xh%]

(_.SCK_LINES/$

JYUIt.Vl?

* (()@-3$-

0J%Fs

Keyw

%s[%d]

.FDiag

B.IIx

?7E(AL("%s",4),"

XI.Cr

4'.Yt

keysK<

k3.yhF

.cu%S

O%uorT

Ht.HA

ibD.ZP

\*.*2XE

.dwcnh

vfjzg V.fG!>_

De-a.ew

webqsk

.fcclJL

JL-Q.JW

1.2.3

,M.DJ?

bVsqlz3_

 [.Il

KG.Ia

.FJn`m

0.XC/X[

H|iqi.DD.

UC.HS

.cP>&*

chmk.mswrzf

,kt V -,%D

c.cjjm0).S"

.rdf'.fks

.qiuykchVw

HB@FY,.sdaw

dcm.NH

.wuf.

=.uwJj

:.pk\d`P

i!%u$3

vgv,.Pn

ir$ah.Lx

^.rzPcQI/&^#&

Lmca(WglzgjH.Mo5

8"~l.VwDgv:V/

.dv6B.:

.bcs3i

!zY^A.XGw

h`8q.Hy

RI.AT

;XQw`%f

gjvZi.AT

n.hhp

mw.ll

C|.uC

UrlJ

.Uvl7Ll#Q

?3URLs@

n6.GIg$

L_LCUNTF, KHC.op=

6?0N2=.Lq

W]E).rG

a%dH^

.LC&U

!-W.vB

aaFj`iZ.iFN

%f@#"

)hix.CBOP

RWoCJ[hx.Xu

NAER_[URNDT].Lw/OFL[^\\[@

.BOhZ

m^rk.Um_gtw

'JXpx6.tg

nDlb.vok

.Bp/pe,

IWeb

.mI25

y.jHP

i.SpT

!.blv

m.Advi

.1..WAHO9[Zcn*b

;)W.gD

HX.Pd`bj

IWV.cQ

fa`w.eoicTjo7

D\[email protected]

!a%Cv

MSGOf

\6$945'/

UM.xX

.Hagddw M,7

r.vY?"[

hWkkaTmjC.Oo

VZY*rf.aeWXM

.qB/hkk[lfqd

PIPE_DATA'

cnyzgcEi.Tc/7

a,/.ia

v=.vpF

nwgbo\hfm.cV]

h%d;s

.VccSivfkw V

o>TP\Oqah`k,.nlvcTmK

'AwdAmcd.oi

wYb.wv

VNJPu.IgYJgrwljQ`q2

z`o1caig2,.hf5b"

wg8k-P.VO

%xH1 FZ"

khbbxl,.blzz

C$.rv

]s.ZRy

4.nBG

.EG "\

vh%sOL).

%sf[T

MwO .uC

uDpM

.PY#"

E`.kwO$

}%Sz f

Cs.xFA3

.TK!N

s[%Cq

|.Yy/

%U4p`

.oEA${W

ÿ @

IE%D>_

"$ %),'8

H.JXA^

*/.)*72-7)

#-**(-#,

Jp.PMDF<7N

>.iwLI

KERNEL32.DLL

advapi32.dll

comctl32.dll

comdlg32.dll

gdi32.dll

ole32.dll

oleaut32.dll

shell32.dll

URLMON.DLL

user32.dll

version.dll

wininet.dll

ShellExecuteExW

HtmlUIInstallerSADLL.dll

.frZ'

#.Xf=

Gfcpncrtbgn

%original file name%.exe_300_rwx_009C1000_00156000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

EVariantBadIndexError

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordD

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys4_

AutoHotkeys|_

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview(f

WindowState`a

OnKeyDown|:

OnKeyPress<:

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

2301654879

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

Portuguese

i\*.*2XE

i.dwcnhE

webqskv`T-Y

nmhpjhc03.fcclJL

i.ulzn1E

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code

sqlite3.dll

ESQLiteException

TSQLiteDatabase

TSQLiteTable

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

select [sql] from sqlite_master where [type] = 'table' and lower(name) = '

Could not prepare SQL statement

SQLite is Busy

Ecezcb-4 S,Tmeic6.fA

 W,iqi.DD

-00,chmk.ms

Locate sqlite3.dll

8SQLit

install.rdf

chrome version is not a number:

DoAddChromeStartupPage - status:

DoSetChromeHomePage AL=

VHB@FY,.sda-0,` U,K\JH,-c`ql,.RMH\@ U,fk-1,8*J`cl-0,iq,-]`d-4,mm U,]-1,jsdj`w,-GA R,^.P

exception while getting Chrome SP(after DB copy):

-0,iq-3,dcm.NH

Exception in InstallChromeExtensionRegistry:

YUJ@X@,.ji-1,yn-3,a-2 Q,_@Z Q,ek-2,umkz^ywb<,  R,) V ,,RFD^@,.hh8 N,\

@QA^ T,WOLHF,.eazyavg-2,Qfbmeqs.i,4

Bchnsjz/Uco-2,en,._tixfbc-1,/OB,.Mgeezv V,]faho-0,stk.y,f

SetChromeSP: failed to Add SP:

to chrome

SetChromeSP: failed to set SP:

as default search provider at chrome

RemoveChromeSearchProvider - cannot remove

RemoveChromeSearchProvider - exception:

DoSetChromeExistingSP - no file:

sqlGetQueryResultEx failed! Query:

Gndovgv,.Pnc-1,`c R,^qdtggnp,.JO.]-h

DoSetChromeExistingSP: error:

Q-4,sbkfmhQ`qh-4,nq-4,hir S,dah.Lx

Q-3,cmf,.Bacb V,[gotkj-;.]

Kjij-0,ja.pz

Ckkhskc07.Rb

IE version is not supported:

is not supported:

Y^A.XG

Hn-0,em`cY\CKmbcommd.Hy

TPipeServer

TPipeObject

TPipeServerListener

TPipeClientU

Starting default pipe server, PipeName:

isrPipe

Falied to start default pipe server, PipeName:

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

Retrieved Filename from Url:

Restart attempts surpassed the maximum (

) is different than supported (

Urls stored in Chunks Map differ from the ones provided, ignoring the Chunks Map:

Chunks Map contains URLs, but the size is illegal:

New Source created, url:

, httpCode:

, url:

, Url:

, old Url:

, new Url:

Switching suspended Server back to use; Url:

, HttpCode:

TDownloadConnection.Destroy() was called from not authorized thread (

HttpCode:

Unsupported 3xx redirect response, code:

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

0.0.0.0

6?0N2=.Lq

;768>1-80

005345000000

000000000000

000000000010

000000000030

cabinet.dll

Rijndael Key is too short!

 ;7.Q,>N-Y,[ T,Tc.Uv

Reporting failed on first attempt, second attempt is cancelled (finallizing)! HttpRes:

First report attempt failed, going for second! HttpRes:

The report failed! HttpRes:

Report sent, Url:

TUninstallExecuter

)hix.CB

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

RootKey:

RegDelKey:

(FF) TUninstallExecuter.RestoreBrwAddrSearch: OpCode=

Opera SP is in use, can't restore

TUninstallExecuter.RestoreBrwSearchProvider: OpCode=

FireFox SP is in use, can't restore

ExecuteCmd: key=

KillProcess: key=

: key=

Remaining uninstall instructions after exeution:

ExecuteCmd:

ExecuteCmd: ExitCode:

CJ[hx.Xu

Downloading Bundles data from adServer on url:

,,XW2.lu

,.cwLlgmc5.O-]

NAER_[URNDT].Lw

Report main param:

Exclusive Execution mode is switched to:

Report param

Report param:

Package execution returned bad ExitCode:

Package execution failed, bad ErrorCode:

LJ_.ge

fxk S,Cym^rk.Um

ole32.dll

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizablelp

OnWindowSetLeft

OnWindowSetTop

OnWindowSetWidth

OnWindowSetHeightTq

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath

OnEnableModelessh

OnTranslateUrl

OnCommandExec

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDownP

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXps://

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyDown

OnKeyPress

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

JS function sync-execution failed with message:

] execution failed with message:

MAPI32.DLL

LeftPopup

not supported

YR-0,xh]izn.cQ

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

https

Log server Url is invalid:

Sending Log to the following Url:

Log Http request has failed, res:

MSGALL

irsoMsgDialog

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoIsMutexExists

irsoCreatePipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetExeInjection

irsoSetSQLiteDll

irsoGetSQLiteDll

irsoLocateSQLiteDll

TExecArgsX

.html

H-4,njBdi-2,o-4,r.vY

-4,fhxXahcxgw.rg

gghYcjrf.ae

jehGbeags.qB

PIPE_DATA

PIPE

-0,cnyzgcEi.Tc

LNYCD_^.eP

HMVH9>.PE

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

IE WebBrowser docRendMode:

IE WebBrowser docRendMode is not 7 (

THtmlUIExeAppU

Pipe [

HtmlUIExeApp

Pipe command unknown:

gbo`dhfm.cV

irsoExecutePackage

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoIsFireFoxInstalled

irsoIsChromeInstalled

irsoIsOperaInstalled

irsoGetFireFoxHomePage

irsoGetChromeHomePage

irsoGetOperaHomePage

irsoSetFireFoxHomePage

irsoSetChromeHomePage

irsoSetOperaHomePage

irsoSetChromeOnStartup

irsoAddChromeUrlToStartupPages

irsoGetFireFoxDefaultSP

irsoGetChromeDefaultSP

irsoGetOperaDefaultSP

irsoAddFireFoxDefaultSPFromXML

irsoAddFireFoxDefaultSP

irsoSetFireFoxAddressBar

irsoAddOperaDefaultSP

irsoAddChromeDefaultSP

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoLocateSQLite

irsoGetFireFoxCookie

irsoGetChromeCookie

irsoIsFireFoxExtensionInstalled

irsoInstallFireFoxAddon

irsoInstallChromeAddon

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoReportInfo

irsoSetExclusiveExec

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

An attempt to download bundle data was denied: adServer domain name must remain the same! Url:

_moCjx^cJbh.VJ

Report Url changed dynamically from:

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

?456789:;<=

!"#$%&'()* ,-./0123

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

.EG "\

vh%sOL).

kK.Fwi

%sf[T

MwO .uC

uDpM

b%s2G

E`.kwO$

.eXPl

G*.fC

45|.xL

}%Sz f

Cs.xFA3

.TK!N

s[%Cq

|.Yy/

%U4p`

J.feo

¯.'w@F-B}'\

.oEA${W

WaitNamedPipeA

PeekNamedPipe

GetWindowsDirectoryW

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

ConnectNamedPipe

RegQueryInfoKeyA

RegOpenKeyExW

RegOpenKeyExA

RegFlushKey

RegEnumKeyW

RegEnumKeyExA

RegDeleteKeyW

RegDeleteKeyA

RegCreateKeyExW

RegCreateKeyExA

RegCloseKey

SetViewportOrgEx

ShellExecuteExW

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

"$ %),'8

38000=344

&W%%C)1

.AF{H)

H.JXA

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

944(@32%2u8

.PMDF<7N

&&'%%'%'%

.idata

.edata

P.reloc

P.rsrc

Jp.PMDF<7N

>.iwLI

Attempt to access registry key: "

supported by OS for "HKEY_CURRENT_USER\Software\"; access directly under "HKEY_CURRENT_USER\Software\Wow6432Node".

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

!Found Firefox sqlite dll at:

!Reading firefox cookies without sqlite.dll support

!Reading Chrome cookies without sqlite.dll support

DoAddChromeStartupPage

GetChromeDefaultSearchProviderFromDb - failed to get spid, returning default!

AddChromeSP: no profiles

DoSetChromeExistingSP:no sql lite

DoRemoveOperaSearchProvider - cannot remove

" was sucessfully removed but references to its HexKey: "

Stopping default pipe server

There is no source with range support for connection, picking one without.

None of our requests are passing in Proxy Mode - suspecting inability to download from current server, trying another HEAD request to make sure.

File size seems to be changed from the same source after HEAD request, suspecting rare case of lack of HEAD support - disabling it.

Only HEAD requests are passing in Proxy Mode - unable to work with this server (probably no Range support)

TDownloadAccelerator.Run() was ignored, since another download is currently in progress.

Urls:

Pause request ignored, servers without HTTP Range support will cause download restart.

The source dropped range support.

The source does not have range support - ignored range request.

UnregDLL executed: "

ExecuteCmd: Exe:

Waiting for all the ongoing reports to complete...

; main package already reported

InstallerName altered after at least one report already sent.

package already reported

Starting execute, exe:

MSI package detected. switching to synchronic package execution

errorUrl

Failed to launch htmlUI from the following url:

Log server Url is not provided.

Log Http request has timed out.

Remote mask loading is currently not supported. mask:

Setting SQLite dll path to:

Registry entry removed: HtmlUI Browser object's IE7 fallback support is now enabled.

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_CURRENT_USER).

There is a registry hack to prevent HtmlUI Browser object's IE7 fallback - failed to remove it (HKEY_LOCAL_MACHINE).

Loading in stealth mode, url:

Read form default pipe timed out, can't determine if there's another instance running

Pipe server TIMED OUT , can't determine if there's another instance running. continuing..

CANNOT start default pipe server, possible reason is that another instance of this installer is stuck

Please login as administrator and try again.

Installer Account Name altered after at least one report already sent.

isroSetReportUrl() was ignored due to lack of Privelege Mode.

Installer Report Url changed after at least one report already sent.

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

No help found for %s#No context-sensitive help installed$No topic-based help system installed6Cipher has already been padded, cannot process message,Cipher is not in valid state for this action4Message length for %s must be a multiple of %d bytes1Keymaterial is too large for use (Security Issue)0Initvector is too large for use (Security Issue))Hash function have to many bits processed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form

!Control '%s' has no parent window

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s

Invalid stream format$''%s'' is not a valid component name

Ancestor for '%s' not found

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation!Invalid variant operation ($%.8x)

Variant is not an array5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value"'%s' is not a valid currency value!'%g' is not a valid date and time

'%s' is not a valid GUID value

I/O error %d

006e029743d92f283a5585af8b299d0e.tmp_3908:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

shell32.dll

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.0)

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

006e029743d92f283a5585af8b299d0e.tmp_3916:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

shell32.dll

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.0)

Inno Setup Messages (5.5.0)

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1596
   %original file name%.exe:3720
   006e029743d92f283a5585af8b299d0e.tmp:3916
   006e029743d92f283a5585af8b299d0e.tmp:3908

2. Delete the original Installer file.
   
3. Delete or disinfect the following files created/modified by the Installer:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\bootstrap_11120.html (156 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is140275273\4CFD6549_stp.CIS (2900 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Pause_Button.png (577 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\main.css (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\00182FE5.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Grey_Button_Hover.png (231 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is140275273\0402FCE9_stp\icc.dll (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\isf_1573506.flat (6314 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\Pebotocotot2[1].png (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\ie6_main.css (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0017FAEA.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\IE_logo[1].png (1842 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Quick_Specs.png (221 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\No_Button[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is140275273\42D5B627_stp.EXE.part (4645 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is140275273\4CFD6549_stp\RAM.dll (151 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Minimize_Hover.png (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\FR.locale (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0018436D.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\LOGO[1].png (1840 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Gegogego[1].png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is140275273\4CFD6549_stp.CIS.part (531 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Yudekekug_Dark[1].jpg (5485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Tonononot_BG[1].jpg (7131 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\progress-bar.css (506 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\FF_logo[1].png (1842 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\button.css (417 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Lilisipipe[1].png (1842 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Taderonadan[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\001849D5.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\csshover3.htc (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is140275273\0402FCE9_stp.CIS (13980 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\Ropopi_Title[1].png (845 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Bisli_logo[1].png (3234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\checkbox.css (190 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Close.png (674 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\form.bmp.Mask (148 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Noseresel[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\Seniser[1].png (12964 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Close_Hover.png (653 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\CH_logo[1].png (1842 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0018433E.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\BG[1].png (7318 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Logo_Bisli[1].png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Gegogego_Bisli[1].png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\EN.locale (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Memiticeper_BG_BR[1].png (5375 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Sesakesaye_bisli[1].png (6401 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Notonoronot1[1].png (6896 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\sponsored.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Yes_Button[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0018505D.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\BG.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Progress.png (104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Notoseso[1].png (3474 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Grey_Button.png (230 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\Yes_Button_Hover[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\No_Button_Hover[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\ProgressBar.png (812 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Resume_Button.png (718 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\00180172.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\ES.locale (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Icon_Generic.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\browse.css (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\DE.locale (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\isf_1573432.flat (151 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Notonoronot2[1].png (10614 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\default_tb.png (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Minimize.png (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\images\progress-bg.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\Tonononot_B1[1].png (1842 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\Yudekekug1[1].jpg (3259 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\locale\PT.locale (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\declineBG[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Loader.gif (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Color_Button.png (237 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\Memiticeper_BG[1].png (10106 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\images\button-bg.png (131 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is140275273\0402FCE9_stp\sqlite3.dll (3716 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is140275273\0402FCE9_stp.CIS.part (588 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0018435D.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\images\Color_Button_Hover.png (238 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\001843EA.log (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ish1571625\css\sdk-ui\images\progress-bg2.png (978 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-US1LG.tmp\006e029743d92f283a5585af8b299d0e.tmp (62 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-RB9DC.tmp\006e029743d92f283a5585af8b299d0e.tmp (62 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-J5IBD.tmp\006e029743d92f283a5585af8b299d0e.tmp (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-0PIU4.tmp\006e029743d92f283a5585af8b299d0e.tmp (23 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.